mirror of
https://github.com/authelia/authelia.git
synced 2026-10-28 09:34:52 +08:00
master
100
Commits
| Author | SHA1 | Message | Date | |
|---|---|---|---|---|
 renovate[bot]andAmir Zarrinkafsh
|
e66fbbe5ff |
build(deps): update dependency baseline-browser-mapping to v2.11.33 (#13579)
This PR contains the following updates: | Package | Change | [Age](https://docs.renovatebot.com/merge-confidence/) | [Confidence](https://docs.renovatebot.com/merge-confidence/) | |---|---|---|---| | [baseline-browser-mapping](https://redirect.github.com/web-platform-dx/baseline-browser-mapping) | [`2.11.31` → `2.11.33`](https://renovatebot.com/diffs/npm/baseline-browser-mapping/2.11.31/2.11.33) |  |  | --- ### Release Notes <details> <summary>web-platform-dx/baseline-browser-mapping (baseline-browser-mapping)</summary> ### [`v2.11.33`](https://redirect.github.com/web-platform-dx/baseline-browser-mapping/compare/v2.11.32...v2.11.33) [Compare Source](https://redirect.github.com/web-platform-dx/baseline-browser-mapping/compare/v2.11.32...v2.11.33) ### [`v2.11.32`](https://redirect.github.com/web-platform-dx/baseline-browser-mapping/compare/v2.11.31...v2.11.32) [Compare Source](https://redirect.github.com/web-platform-dx/baseline-browser-mapping/compare/v2.11.31...v2.11.32) </details> --- ### Configuration 📅 **Schedule**: (UTC) - Branch creation - At any time (no schedule defined) - Automerge - At any time (no schedule defined) 🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied. ♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox. 🔕 **Ignore**: Close this PR and you won't be reminded about this update again. --- - [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check this box --- This PR was generated by [Mend Renovate](https://mend.io/renovate/). View the [repository job log](https://developer.mend.io/github/authelia/authelia). <!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0NC4xODAuMCIsInVwZGF0ZWRJblZlciI6IjQ0LjE4NC4xIiwidGFyZ2V0QnJhbmNoIjoibWFzdGVyIiwibGFiZWxzIjpbImRlcGVuZGVuY2llcyIsImphdmFzY3JpcHQiXX0=--> Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com> Co-authored-by: Amir Zarrinkafsh <3339418+nightah@users.noreply.github.com> |
||
|
renovate[bot]andAmir Zarrinkafsh
|
1cca08daa3 |
build(deps): update dependency @eslint-react/eslint-plugin to v5.28.8 (#13578)
This PR contains the following updates: | Package | Change | [Age](https://docs.renovatebot.com/merge-confidence/) | [Confidence](https://docs.renovatebot.com/merge-confidence/) | |---|---|---|---| | [@eslint-react/eslint-plugin](https://redirect.github.com/Rel1cx/eslint-react) ([source](https://redirect.github.com/Rel1cx/eslint-react/tree/HEAD/plugins/eslint-plugin)) | [`5.28.6` → `5.28.8`](https://renovatebot.com/diffs/npm/@eslint-react%2feslint-plugin/5.28.6/5.28.8) |  |  | --- ### Release Notes <details> <summary>Rel1cx/eslint-react (@​eslint-react/eslint-plugin)</summary> ### [`v5.28.8`](https://redirect.github.com/Rel1cx/eslint-react/blob/HEAD/CHANGELOG.md#v5288-2026-10-24) [Compare Source](https://redirect.github.com/Rel1cx/eslint-react/compare/v5.28.7...v5.28.8) ##### 🐞 Fixes - `react-x/purity`: builtin member resolution no longer follows computed or unknown middle segments (ex: `window[fetch]`, `window.myLibrary.fetch`), preventing false reports of non-builtin calls. ([#​2074](https://redirect.github.com/Rel1cx/eslint-react/issues/2074)) ##### 🏗️ Internal - `@eslint-react/eslint`: added dual-purpose `getText` for direct or callback-style source text extraction, replacing repeated `context.sourceCode.getText` wrappers across packages. ([#​2073](https://redirect.github.com/Rel1cx/eslint-react/issues/2073)) **Full Changelog**: <https://github.com/Rel1cx/eslint-react/compare/v5.28.7...v5.28.8> ### [`v5.28.7`](https://redirect.github.com/Rel1cx/eslint-react/blob/HEAD/CHANGELOG.md#v5287-2026-10-23) [Compare Source](https://redirect.github.com/Rel1cx/eslint-react/compare/v5.28.6...v5.28.7) ##### 🐞 Fixes - `react-x/purity`: now reports `Date` calls during render, including `Date()`, `Date(arg)`, and `window.Date()`; unlike `new Date(arg)`, `Date(arg)` ignores its arguments and always returns the current time. ([#​2071](https://redirect.github.com/Rel1cx/eslint-react/issues/2071)) Thanks to [@​aki05162525](https://redirect.github.com/aki05162525)! ##### 🏗️ Internal - Bumped `effect` and `@effect/platform-node` to `4.0.6`, `@tanstack/react-router` to `1.170.46`, `@tanstack/react-start` to `1.169.4`, and `eslint-plugin-de-morgan` to `2.3.0`. ##### New Contributors - **TAKAGI AKIHIRO** ([@​aki05162525](https://redirect.github.com/aki05162525)) made their first contribution in [#​2071](https://redirect.github.com/Rel1cx/eslint-react/issues/2071). **Full Changelog**: <https://github.com/Rel1cx/eslint-react/compare/v5.28.6...v5.28.7> </details> --- ### Configuration 📅 **Schedule**: (UTC) - Branch creation - At any time (no schedule defined) - Automerge - At any time (no schedule defined) 🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied. ♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox. 🔕 **Ignore**: Close this PR and you won't be reminded about this update again. --- - [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check this box --- This PR was generated by [Mend Renovate](https://mend.io/renovate/). View the [repository job log](https://developer.mend.io/github/authelia/authelia). <!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0NC4xODAuMCIsInVwZGF0ZWRJblZlciI6IjQ0LjE4MC4wIiwidGFyZ2V0QnJhbmNoIjoibWFzdGVyIiwibGFiZWxzIjpbImRlcGVuZGVuY2llcyIsImphdmFzY3JpcHQiXX0=--> Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com> Co-authored-by: Amir Zarrinkafsh <3339418+nightah@users.noreply.github.com> |
||
|
renovate[bot]andAmir Zarrinkafsh
|
5692581314 |
build(deps): update haproxy:3.4.7-alpine docker digest to 2caaf8b (#13577)
This PR contains the following updates: | Package | Type | Update | Change | |---|---|---|---| | [haproxy](https://hub.docker.com/_/haproxy) ([source](https://redirect.github.com/docker-library/haproxy)) | final | digest | `3c8c1df` → `2caaf8b` | --- ### Configuration 📅 **Schedule**: (UTC) - Branch creation - At any time (no schedule defined) - Automerge - At any time (no schedule defined) 🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied. ♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox. 🔕 **Ignore**: Close this PR and you won't be reminded about this update again. --- - [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check this box --- This PR was generated by [Mend Renovate](https://mend.io/renovate/). View the [repository job log](https://developer.mend.io/github/authelia/authelia). <!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0NC4xODAuMCIsInVwZGF0ZWRJblZlciI6IjQ0LjE4MC4wIiwidGFyZ2V0QnJhbmNoIjoibWFzdGVyIiwibGFiZWxzIjpbImRlcGVuZGVuY2llcyIsImRvY2tlciJdfQ==--> Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com> Co-authored-by: Amir Zarrinkafsh <3339418+nightah@users.noreply.github.com> |
||
|
renovate[bot]andAmir Zarrinkafsh
|
3e18ed9496 |
build(deps): update dependency react-i18next to v17.1.9 (#13583)
This PR contains the following updates: | Package | Change | [Age](https://docs.renovatebot.com/merge-confidence/) | [Confidence](https://docs.renovatebot.com/merge-confidence/) | |---|---|---|---| | [react-i18next](https://redirect.github.com/i18next/react-i18next) | [`17.1.3` → `17.1.9`](https://renovatebot.com/diffs/npm/react-i18next/17.1.3/17.1.9) |  |  | --- ### Release Notes <details> <summary>i18next/react-i18next (react-i18next)</summary> ### [`v17.1.9`](https://redirect.github.com/i18next/react-i18next/blob/HEAD/CHANGELOG.md#1719) [Compare Source](https://redirect.github.com/i18next/react-i18next/compare/v17.1.8...v17.1.9) - fix(useTranslation): namespaces added to or removed from the `ns` array are now picked up. The hook used the array itself as the `useMemo` dependency list, and React only compares the entries both lists have in common when its length changes, so going from `useTranslation(['nsA'])` to `useTranslation(['nsA', 'nsB'])` kept returning `['nsA']`: React warned that the dependency array changed size, `nsB` was never loaded, and with `nsMode: 'fallback'` keys only in `nsB` rendered as the key. Removing a namespace kept the old list the same way. The namespaces are now compared by content, so a growing list loads the new namespace (suspending until it is loaded, as switching from `'nsA'` to `'nsB'` already does) and `t` uses it. Lists that keep their length behave as before. Thanks [@​lprnmns](https://redirect.github.com/lprnmns) ([#​1945](https://redirect.github.com/i18next/react-i18next/pull/1945)). ### [`v17.1.8`](https://redirect.github.com/i18next/react-i18next/blob/HEAD/CHANGELOG.md#1718) [Compare Source](https://redirect.github.com/i18next/react-i18next/compare/v17.1.7...v17.1.8) - fix(Trans): an interpolation variable named `format` is no longer dropped. `Trans` reads `format` in an interpolation object as the formatter name (`{{ value, format }}`), so with `{{ format }}` as the only key nothing was left: `<Trans>Export as {{ format }}</Trans>` warned `TRANS_INVALID_OBJ` and used the default string `Export as ` instead of `Export as {{format}}`. When `format` is the object's only key it is now treated as the variable. `{{ value, format }}` works as before. Without an `i18nKey`, the key derived from the children changes accordingly, from `Export as ` to `Export as {{format}}`. i18next-cli serializes `Trans` children with react-i18next, so extracting with this version produces the same key. Thanks [@​Pharex38](https://redirect.github.com/Pharex38) ([#​1944](https://redirect.github.com/i18next/react-i18next/pull/1944)). ### [`v17.1.7`](https://redirect.github.com/i18next/react-i18next/blob/HEAD/CHANGELOG.md#1717) [Compare Source](https://redirect.github.com/i18next/react-i18next/compare/v17.1.6...v17.1.7) - fix(IcuTrans): each HTML entity in a translation is now decoded exactly once. Named, decimal and hexadecimal entities were decoded in three passes, and each pass decoded the output of the previous one, so an escaped numeric entity was decoded twice: `"Write &#​169; to get &#​169;"` rendered `Write © to get ©` instead of `Write &#​169; to get ©`, and `&#​60;` rendered `<` instead of `&#​60;`. This also hit interpolated values with `escapeValue: true`, where a value containing `&#​60;` is escaped to `&#​60;`. Escaped named entities like `&lt;` already stayed `<`, as browsers and `Trans` decode them. Unknown named entities and entities above U+10FFFF still stay as written. Thanks [@​Pharex38](https://redirect.github.com/Pharex38) ([#​1943](https://redirect.github.com/i18next/react-i18next/pull/1943)). ### [`v17.1.6`](https://redirect.github.com/i18next/react-i18next/blob/HEAD/CHANGELOG.md#1716) [Compare Source](https://redirect.github.com/i18next/react-i18next/compare/v17.1.5...v17.1.6) - fix(Trans): a `count` passed in `tOptions` is now used. `Trans` spread `tOptions` and then set its own `count` prop, so a count only in `tOptions` was overwritten with `undefined`: `<Trans i18nKey="items" tOptions={{ count: 5 }} />` rendered the key `items` instead of `5 items`, and with children `Trans` could pick the wrong plural form. Like `context`, `Trans` now falls back to `tOptions.count`, handled the same way as the `count` prop. A `count` prop, a count in the children or `values.count` still take precedence, and `tOptions` is not modified. Thanks [@​nk-batman21](https://redirect.github.com/nk-batman21) ([#​1942](https://redirect.github.com/i18next/react-i18next/pull/1942)). ### [`v17.1.5`](https://redirect.github.com/i18next/react-i18next/blob/HEAD/CHANGELOG.md#1715) [Compare Source](https://redirect.github.com/i18next/react-i18next/compare/v17.1.4...v17.1.5) - fix(Trans): with an array of keys and no children, `Trans` now falls back to the last key when none of them has a translation, as `t()` does. It used the array itself as `defaultValue`, which i18next handles as an object, so `<Trans i18nKey={['notifications.crm_item_created', 'crm_item_created']} components={[<strong />]} />` rendered `key 'crm_item_created (en)' returned an object instead of string.` instead of `crm_item_created`. An array of selectors falls back to the key of the last selector. The first key that has a translation still wins, and `children`, `defaults` and `tOptions.defaultValue` are used as before. With `saveMissing`, these calls now report the missing key, like a single `i18nKey` does. Thanks [@​nk-batman21](https://redirect.github.com/nk-batman21) ([#​1941](https://redirect.github.com/i18next/react-i18next/pull/1941)). ### [`v17.1.4`](https://redirect.github.com/i18next/react-i18next/blob/HEAD/CHANGELOG.md#1714) [Compare Source](https://redirect.github.com/i18next/react-i18next/compare/v17.1.3...v17.1.4) - fix(types): without `allowObjectInHTMLChildren`, the `children` of HTML elements now use React's own type (`DOMAttributes<T>['children']`) instead of the `ReactI18NextChildren | Iterable<ReactI18NextChildren>` union. Both accept the same children, so nothing compiles differently. For default installs the global `HTMLAttributes` augmentation now repeats whatever `@types/react` declares, so changes in React's types flow through instead of meeting a copy, and type errors on element children no longer list an extra `Iterable<...>`. With `allowObjectInHTMLChildren: true` nothing changes. First step of [#​1928](https://redirect.github.com/i18next/react-i18next/issues/1928). </details> --- ### Configuration 📅 **Schedule**: (UTC) - Branch creation - At any time (no schedule defined) - Automerge - At any time (no schedule defined) 🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied. ♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox. 🔕 **Ignore**: Close this PR and you won't be reminded about this update again. --- - [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check this box --- This PR was generated by [Mend Renovate](https://mend.io/renovate/). View the [repository job log](https://developer.mend.io/github/authelia/authelia). <!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0NC4xODAuMCIsInVwZGF0ZWRJblZlciI6IjQ0LjE4NC4xIiwidGFyZ2V0QnJhbmNoIjoibWFzdGVyIiwibGFiZWxzIjpbImRlcGVuZGVuY2llcyIsImphdmFzY3JpcHQiXX0=--> Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com> Co-authored-by: Amir Zarrinkafsh <3339418+nightah@users.noreply.github.com> |
||
|
renovate[bot]andAmir Zarrinkafsh
|
c8cbfb053e |
build(deps): update traefik docker tag to v3.7.16 (#13584)
This PR contains the following updates: | Package | Update | Change | |---|---|---| | [traefik](https://hub.docker.com/_/traefik) ([source](https://redirect.github.com/traefik/traefik)) | patch | `v3.7.15` → `v3.7.16` | --- ### Release Notes <details> <summary>traefik/traefik (traefik)</summary> ### [`v3.7.16`](https://redirect.github.com/traefik/traefik/blob/HEAD/CHANGELOG.md#v3716-2026-10-20) [Compare Source](https://redirect.github.com/traefik/traefik/compare/v3.7.15...v3.7.16) [All Commits](https://redirect.github.com/traefik/traefik/compare/v3.7.15...v3.7.16) **Bug fixes:** - **\[authentication, service, k8s/ingress-nginx]** Support NTLM and Kerberos in ForwardAuth and ingress-nginx auth-url ([#​14091](https://redirect.github.com/traefik/traefik/pull/14091) [@​juliens](https://redirect.github.com/juliens)) - **\[authentication, service]** Support NTLM and Kerberos authentication in ForwardAuth ([#​14084](https://redirect.github.com/traefik/traefik/pull/14084) [@​juliens](https://redirect.github.com/juliens)) - **\[k8s/gatewayapi]** Fix Gateway API conformance suite setup with the containerd image store ([#​14089](https://redirect.github.com/traefik/traefik/pull/14089) [@​Neffi42](https://redirect.github.com/Neffi42)) **Documentation:** - **\[k8s/ingress-nginx]** Document that rewrite is supported in configuration-snippet ([#​14070](https://redirect.github.com/traefik/traefik/pull/14070) [@​bingtang9](https://redirect.github.com/bingtang9)) </details> --- ### Configuration 📅 **Schedule**: (UTC) - Branch creation - At any time (no schedule defined) - Automerge - At any time (no schedule defined) 🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied. ♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox. 🔕 **Ignore**: Close this PR and you won't be reminded about this update again. --- - [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check this box --- This PR was generated by [Mend Renovate](https://mend.io/renovate/). View the [repository job log](https://developer.mend.io/github/authelia/authelia). <!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0NC4xODAuMCIsInVwZGF0ZWRJblZlciI6IjQ0LjE4MC4wIiwidGFyZ2V0QnJhbmNoIjoibWFzdGVyIiwibGFiZWxzIjpbImRlcGVuZGVuY2llcyIsImRvY2tlciJdfQ==--> Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com> Co-authored-by: Amir Zarrinkafsh <3339418+nightah@users.noreply.github.com> |
||
|
renovate[bot]andAmir Zarrinkafsh
|
83a780b2ac |
build(deps): update dependency i18next-http-backend to v4.0.6 (#13582)
This PR contains the following updates: | Package | Change | [Age](https://docs.renovatebot.com/merge-confidence/) | [Confidence](https://docs.renovatebot.com/merge-confidence/) | |---|---|---|---| | [i18next-http-backend](https://redirect.github.com/i18next/i18next-http-backend) | [`4.0.4` → `4.0.6`](https://renovatebot.com/diffs/npm/i18next-http-backend/4.0.4/4.0.6) |  |  | --- ### Release Notes <details> <summary>i18next/i18next-http-backend (i18next-http-backend)</summary> ### [`v4.0.6`](https://redirect.github.com/i18next/i18next-http-backend/blob/HEAD/CHANGELOG.md#406) [Compare Source](https://redirect.github.com/i18next/i18next-http-backend/compare/v4.0.5...v4.0.6) - fix: when `XMLHttpRequest` throws synchronously (`open()` with an invalid URL, `setRequestHeader()` with an invalid `customHeaders` name, `send()`), the error is now passed to the callback. It was only logged with `console.log`, so the load never finished and i18next `init()` did not resolve. Now i18next takes its usual failed-load path. The XHR path is used when no `fetch` is available and for `file:` URLs. An XHR that completes inside `send()` (some polyfills and fake XHRs) is not called back a second time when its callback throws. Thanks [@​lprnmns](https://redirect.github.com/lprnmns) ([#​203](https://redirect.github.com/i18next/i18next-http-backend/pull/203)) ### [`v4.0.5`](https://redirect.github.com/i18next/i18next-http-backend/blob/HEAD/CHANGELOG.md#405) [Compare Source](https://redirect.github.com/i18next/i18next-http-backend/compare/v4.0.4...v4.0.5) - fix: a `loadPath` function whose promise rejects now reports the error to i18next. The read callback was never called, so `init()` / `loadNamespaces()` never settled (a react-i18next Suspense fallback stayed up for good) and in Node the unhandled rejection ended the process. i18next now takes its usual failed-load path (`failedLoading` event, "loading namespace ... failed" log) and `init()` resolves. The error is passed on without retry, like the other non-network errors. Thanks [@​nk-batman21](https://redirect.github.com/nk-batman21) ([#​201](https://redirect.github.com/i18next/i18next-http-backend/pull/201)) </details> --- ### Configuration 📅 **Schedule**: (UTC) - Branch creation - At any time (no schedule defined) - Automerge - At any time (no schedule defined) 🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied. ♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox. 🔕 **Ignore**: Close this PR and you won't be reminded about this update again. --- - [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check this box --- This PR was generated by [Mend Renovate](https://mend.io/renovate/). View the [repository job log](https://developer.mend.io/github/authelia/authelia). <!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0NC4xODAuMCIsInVwZGF0ZWRJblZlciI6IjQ0LjE4NC4xIiwidGFyZ2V0QnJhbmNoIjoibWFzdGVyIiwibGFiZWxzIjpbImRlcGVuZGVuY2llcyIsImphdmFzY3JpcHQiXX0=--> Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com> Co-authored-by: Amir Zarrinkafsh <3339418+nightah@users.noreply.github.com> |
||
|
renovate[bot]andAmir Zarrinkafsh
|
38f84af5d1 |
build(deps): update pnpm/get.pnpm.io digest to 0feb888 (#13574)
This PR contains the following updates: | Package | Update | Change | |---|---|---| | pnpm/get.pnpm.io | digest | `b7cf47f` → `0feb888` | --- ### Configuration 📅 **Schedule**: (UTC) - Branch creation - At any time (no schedule defined) - Automerge - At any time (no schedule defined) 🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied. ♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox. 🔕 **Ignore**: Close this PR and you won't be reminded about this update again. --- - [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check this box --- This PR was generated by [Mend Renovate](https://mend.io/renovate/). View the [repository job log](https://developer.mend.io/github/authelia/authelia). <!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0NC4xODAuMCIsInVwZGF0ZWRJblZlciI6IjQ0LjE4MC4wIiwidGFyZ2V0QnJhbmNoIjoibWFzdGVyIiwibGFiZWxzIjpbImRlcGVuZGVuY2llcyJdfQ==--> Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com> Co-authored-by: Amir Zarrinkafsh <3339418+nightah@users.noreply.github.com> |
||
|
renovate[bot]andAmir Zarrinkafsh
|
6b19acf420 |
build(deps): update authelia/base:latest docker digest to e372a26 (#13573)
This PR contains the following updates: | Package | Type | Update | Change | |---|---|---|---| | authelia/base | final | digest | `c261389` → `e372a26` | --- ### Configuration 📅 **Schedule**: (UTC) - Branch creation - At any time (no schedule defined) - Automerge - At any time (no schedule defined) 🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied. ♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox. 🔕 **Ignore**: Close this PR and you won't be reminded about this update again. --- - [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check this box --- This PR was generated by [Mend Renovate](https://mend.io/renovate/). View the [repository job log](https://developer.mend.io/github/authelia/authelia). <!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0NC4xODAuMCIsInVwZGF0ZWRJblZlciI6IjQ0LjE4OC4yIiwidGFyZ2V0QnJhbmNoIjoibWFzdGVyIiwibGFiZWxzIjpbImRlcGVuZGVuY2llcyIsImRvY2tlciJdfQ==--> Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com> Co-authored-by: Amir Zarrinkafsh <3339418+nightah@users.noreply.github.com> |
||
|
renovate[bot]
|
a72665715b |
build(deps): update traefik docker tag to v2.11.60 (#13571)
This PR contains the following updates: | Package | Update | Change | |---|---|---| | [traefik](https://hub.docker.com/_/traefik) ([source](https://redirect.github.com/traefik/traefik)) | patch | `v2.11.59` → `v2.11.60` | --- ### Release Notes <details> <summary>traefik/traefik (traefik)</summary> ### [`v2.11.60`](https://redirect.github.com/traefik/traefik/blob/HEAD/CHANGELOG.md#v21160-2026-10-20) [Compare Source](https://redirect.github.com/traefik/traefik/compare/v2.11.59...v2.11.60) [All Commits](https://redirect.github.com/traefik/traefik/compare/v2.11.59...v2.11.60) **Bug fixes:** - **\[authentication, service]** Support NTLM and Kerberos authentication in ForwardAuth ([#​14084](https://redirect.github.com/traefik/traefik/pull/14084) [@​juliens](https://redirect.github.com/juliens)) </details> --- ### Configuration 📅 **Schedule**: (UTC) - Branch creation - At any time (no schedule defined) - Automerge - At any time (no schedule defined) 🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied. ♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox. 🔕 **Ignore**: Close this PR and you won't be reminded about this update again. --- - [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check this box --- This PR was generated by [Mend Renovate](https://mend.io/renovate/). View the [repository job log](https://developer.mend.io/github/authelia/authelia). <!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0NC4xODAuMCIsInVwZGF0ZWRJblZlciI6IjQ0LjE4MC4wIiwidGFyZ2V0QnJhbmNoIjoibWFzdGVyIiwibGFiZWxzIjpbImRlcGVuZGVuY2llcyIsImRvY2tlciJdfQ==--> Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com> |
||
|
renovate[bot]
|
96c6de37e6 |
build(deps): update step-security/harden-runner action to v2.22.2 (#13570)
This PR contains the following updates: | Package | Type | Update | Change | |---|---|---|---| | [step-security/harden-runner](https://redirect.github.com/step-security/harden-runner) | action | patch | `v2.22.1` → `v2.22.2` | --- ### Release Notes <details> <summary>step-security/harden-runner</summary> ### [`v2.22.2`](https://redirect.github.com/step-security/harden-runner/releases/tag/v2.22.2) [Compare Source](https://redirect.github.com/step-security/harden-runner/compare/v2.22.1...v2.22.2) ##### What's Changed - Fixed inbound (ingress) network traffic being incorrectly classified as outbound (egress) traffic on macOS - Fixed implicit endpoints intended for self-hosted runners being applied to custom VM environments on Linux (enterprise tier) - Improved network and DNS tracing, enforcement logic, and process information correlation on Linux (enterprise tier) **Full Changelog**: <https://github.com/step-security/harden-runner/compare/v2.22.1...v2.22.2> </details> --- ### Configuration 📅 **Schedule**: (UTC) - Branch creation - At any time (no schedule defined) - Automerge - At any time (no schedule defined) 🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied. ♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox. 🔕 **Ignore**: Close this PR and you won't be reminded about this update again. --- - [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check this box --- This PR was generated by [Mend Renovate](https://mend.io/renovate/). View the [repository job log](https://developer.mend.io/github/authelia/authelia). <!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0NC4xODAuMCIsInVwZGF0ZWRJblZlciI6IjQ0LjE4MC4wIiwidGFyZ2V0QnJhbmNoIjoibWFzdGVyIiwibGFiZWxzIjpbImRlcGVuZGVuY2llcyIsImdpdGh1Yl9hY3Rpb25zIl19--> Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com> |
||
|
renovate[bot]
|
362a9ae085 |
build(deps): update github/codeql-action action to v4.39.1 (#13568)
This PR contains the following updates: | Package | Type | Update | Change | |---|---|---|---| | [github/codeql-action](https://redirect.github.com/github/codeql-action) | action | patch | `v4.39.0` → `v4.39.1` | --- ### Release Notes <details> <summary>github/codeql-action</summary> ### [`v4.39.1`](https://redirect.github.com/github/codeql-action/releases/tag/v4.39.1) [Compare Source](https://redirect.github.com/github/codeql-action/compare/v4.39.0...v4.39.1) - Update default CodeQL bundle version to [2.27.3](https://redirect.github.com/github/codeql-action/releases/tag/codeql-bundle-v2.27.3). [#​4256](https://redirect.github.com/github/codeql-action/pull/4256) </details> --- ### Configuration 📅 **Schedule**: (UTC) - Branch creation - At any time (no schedule defined) - Automerge - At any time (no schedule defined) 🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied. ♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox. 🔕 **Ignore**: Close this PR and you won't be reminded about this update again. --- - [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check this box --- This PR was generated by [Mend Renovate](https://mend.io/renovate/). View the [repository job log](https://developer.mend.io/github/authelia/authelia). <!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0NC4xODAuMCIsInVwZGF0ZWRJblZlciI6IjQ0LjE4MC4wIiwidGFyZ2V0QnJhbmNoIjoibWFzdGVyIiwibGFiZWxzIjpbImRlcGVuZGVuY2llcyIsImdpdGh1Yl9hY3Rpb25zIl19--> Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com> |
||
|
renovate[bot]
|
9143abc0e0 |
build(deps): update nginx docker tag to v1.31.8 (#13569)
This PR contains the following updates: | Package | Update | Change | |---|---|---| | [nginx](https://hub.docker.com/_/nginx) ([source](https://redirect.github.com/nginx/docker-nginx)) | patch | `1.31.7-alpine` → `1.31.8-alpine` | --- ### Release Notes <details> <summary>nginx/docker-nginx (nginx)</summary> ### [`v1.31.8`](https://redirect.github.com/nginx/docker-nginx/compare/1.31.7...1.31.8) [Compare Source](https://redirect.github.com/nginx/docker-nginx/compare/1.31.7...1.31.8) </details> --- ### Configuration 📅 **Schedule**: (UTC) - Branch creation - At any time (no schedule defined) - Automerge - At any time (no schedule defined) 🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied. ♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox. 🔕 **Ignore**: Close this PR and you won't be reminded about these updates again. --- - [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check this box --- This PR was generated by [Mend Renovate](https://mend.io/renovate/). View the [repository job log](https://developer.mend.io/github/authelia/authelia). <!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0NC4xODAuMCIsInVwZGF0ZWRJblZlciI6IjQ0LjE4MC4wIiwidGFyZ2V0QnJhbmNoIjoibWFzdGVyIiwibGFiZWxzIjpbImRlcGVuZGVuY2llcyIsImRvY2tlciJdfQ==--> Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com> |
||
|
renovate[bot]
|
f1b48ed0ca |
build(deps): update envoyproxy/envoy docker tag to v1.40.1 (#13567)
This PR contains the following updates: | Package | Update | Change | |---|---|---| | envoyproxy/envoy | patch | `v1.40.0` → `v1.40.1` | --- ### Configuration 📅 **Schedule**: (UTC) - Branch creation - At any time (no schedule defined) - Automerge - At any time (no schedule defined) 🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied. ♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox. 🔕 **Ignore**: Close this PR and you won't be reminded about this update again. --- - [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check this box --- This PR was generated by [Mend Renovate](https://mend.io/renovate/). View the [repository job log](https://developer.mend.io/github/authelia/authelia). <!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0NC4xODAuMCIsInVwZGF0ZWRJblZlciI6IjQ0LjE4MC4wIiwidGFyZ2V0QnJhbmNoIjoibWFzdGVyIiwibGFiZWxzIjpbImRlcGVuZGVuY2llcyIsImRvY2tlciJdfQ==--> Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com> |
||
|
renovate[bot]
|
07d97f74c3 |
build(deps): update dependency vite to v8.3.5 (#13566)
This PR contains the following updates: | Package | Change | [Age](https://docs.renovatebot.com/merge-confidence/) | [Confidence](https://docs.renovatebot.com/merge-confidence/) | |---|---|---|---| | [vite](https://vite.dev) ([source](https://redirect.github.com/vitejs/vite/tree/HEAD/packages/vite)) | [`8.3.4` → `8.3.5`](https://renovatebot.com/diffs/npm/vite/8.3.4/8.3.5) |  |  | --- ### Release Notes <details> <summary>vitejs/vite (vite)</summary> ### [`v8.3.5`](https://redirect.github.com/vitejs/vite/blob/HEAD/packages/vite/CHANGELOG.md#small-835-2026-10-21-small) [Compare Source](https://redirect.github.com/vitejs/vite/compare/v8.3.4...v8.3.5) ##### Bug Fixes - **build:** handle missing chunk import maps ([#​23777](https://redirect.github.com/vitejs/vite/issues/23777)) ([8d7623d](https://redirect.github.com/vitejs/vite/commit/8d7623d9b5647714a5b20cbd787a5401ca846229)) - **build:** include preload dependencies to chunk import map hashing ([#​23793](https://redirect.github.com/vitejs/vite/issues/23793)) ([4d16e7c](https://redirect.github.com/vitejs/vite/commit/4d16e7c14d5e1c361f148238b1e81131238ab8e9)) - **bundled-dev:** apply `server.origin` to asset URLs ([#​23683](https://redirect.github.com/vitejs/vite/issues/23683)) ([52ba877](https://redirect.github.com/vitejs/vite/commit/52ba877693c8633458d163117504a8259beb3cf5)) - **bundled-dev:** declare utf-8 charset in fallback page ([#​23846](https://redirect.github.com/vitejs/vite/issues/23846)) ([197daf6](https://redirect.github.com/vitejs/vite/commit/197daf6c4c7bfdaa005bebcc41dd2ff22fa3a5b6)) - **bundled-dev:** ignore build.chunkImportMap ([#​23685](https://redirect.github.com/vitejs/vite/issues/23685)) ([cfe917d](https://redirect.github.com/vitejs/vite/commit/cfe917d67d279a13f20ae9449e3befa736b64b07)) - **bundled-dev:** include user `import.meta.env.*` defines in the `import.meta.env` object ([#​23713](https://redirect.github.com/vitejs/vite/issues/23713)) ([6019aa7](https://redirect.github.com/vitejs/vite/commit/6019aa79975465516da7c6f532d568422b019a25)) - **bundled-dev:** map forwarded error stacks through the bundle source maps ([#​23741](https://redirect.github.com/vitejs/vite/issues/23741)) ([11fe1e4](https://redirect.github.com/vitejs/vite/commit/11fe1e46ff0c136cb90fbe263ba03993bc94df18)) - **bundled-dev:** normalize served output files ([#​23684](https://redirect.github.com/vitejs/vite/issues/23684)) ([df4e02c](https://redirect.github.com/vitejs/vite/commit/df4e02cc8317a62f21edefc79a9690571ffed1f3)) - **bundled-dev:** stop hmr propagation at modules that are no longer imported ([#​23839](https://redirect.github.com/vitejs/vite/issues/23839)) ([7471e8c](https://redirect.github.com/vitejs/vite/commit/7471e8c3b32d3d55243590bb7713e602c9fb0212)) - **css:** don't fail on a literal `%` in `url()` ([#​23676](https://redirect.github.com/vitejs/vite/issues/23676)) ([50b382d](https://redirect.github.com/vitejs/vite/commit/50b382d31835b8b4bc8b6964738ac03146e44261)) - **deps:** update all non-major dependencies ([#​23731](https://redirect.github.com/vitejs/vite/issues/23731)) ([cf80aa5](https://redirect.github.com/vitejs/vite/commit/cf80aa552cac02eac0293330ccd5fde3c7ae8d29)) - **deps:** update all non-major dependencies ([#​23826](https://redirect.github.com/vitejs/vite/issues/23826)) ([77d8373](https://redirect.github.com/vitejs/vite/commit/77d8373510da1b26ce057eb2248e570b7f63fde9)) - **deps:** update rolldown-related dependencies ([#​23733](https://redirect.github.com/vitejs/vite/issues/23733)) ([43f0d05](https://redirect.github.com/vitejs/vite/commit/43f0d052e514c3ad2dea2f7dc44b0720e1f62f48)) - **deps:** update rolldown-related dependencies ([#​23827](https://redirect.github.com/vitejs/vite/issues/23827)) ([c2e0418](https://redirect.github.com/vitejs/vite/commit/c2e04187e49aab7ab809989f0537b4906653acab)) - **optimizer:** fall back to yarn.lock for lockfile hash ([#​23667](https://redirect.github.com/vitejs/vite/issues/23667)) ([f206096](https://redirect.github.com/vitejs/vite/commit/f20609630faa93026924275115d1426fdc08629e)) - **optimizer:** scan `oxc.jsxInject` imports ([#​23758](https://redirect.github.com/vitejs/vite/issues/23758)) ([38f3cb4](https://redirect.github.com/vitejs/vite/commit/38f3cb45b1490ed24775547ceafa677b91a57714)) - **optimizer:** skip patches dir check for yarn.lock fallback ([#​23725](https://redirect.github.com/vitejs/vite/issues/23725)) ([8e890e1](https://redirect.github.com/vitejs/vite/commit/8e890e1ce438bfbc07ea4931ce332e40589940fa)) - **optimizer:** skip patches dir hash for nub lockfile ([#​23761](https://redirect.github.com/vitejs/vite/issues/23761)) ([a7d5696](https://redirect.github.com/vitejs/vite/commit/a7d56967ef0050a09c0507e63a18164bc7a0d486)) - **resolve:** support subpath imports with multiple `#` ([#​23631](https://redirect.github.com/vitejs/vite/issues/23631)) ([0d86b34](https://redirect.github.com/vitejs/vite/commit/0d86b3485fbbd0fcb9a1f70a14adedfcb7a1fff1)) - **resolve:** update resolve.exports to 2.0.4 ([#​23739](https://redirect.github.com/vitejs/vite/issues/23739)) ([4ea708a](https://redirect.github.com/vitejs/vite/commit/4ea708a3ae9a324c6aabca59fade4082bf72f3e5)) - **server:** handle socket errors on upgrade requests not taken by the HMR server ([#​23728](https://redirect.github.com/vitejs/vite/issues/23728)) ([c2c9ef4](https://redirect.github.com/vitejs/vite/commit/c2c9ef4dcd05b3e4d88844ea3a13dc23819ca2a5)) - **server:** only strip base when path matches a full segment ([#​23641](https://redirect.github.com/vitejs/vite/issues/23641)) ([3dfde87](https://redirect.github.com/vitejs/vite/commit/3dfde87b90a9f80b125d710e3e5d4fc795662db6)) ##### Performance Improvements - **ssr:** extract inline source maps without a regexp ([#​23775](https://redirect.github.com/vitejs/vite/issues/23775)) ([6a02780](https://redirect.github.com/vitejs/vite/commit/6a0278055d8501bbaf65b8d34ec094722b4e877a)) ##### Miscellaneous Chores - migrate to Oxlint ([#​23746](https://redirect.github.com/vitejs/vite/issues/23746)) ([5b73935](https://redirect.github.com/vitejs/vite/commit/5b73935881424ed5919571036dd89d3868590f92)) ##### Code Refactoring - **deps:** replace `@vercel/detect-agent` with `std-env` ([#​23744](https://redirect.github.com/vitejs/vite/issues/23744)) ([ce4293f](https://redirect.github.com/vitejs/vite/commit/ce4293f15cc5cd221c5ed60f5cd64e82ca5cbaf5)) - **dev:** consolidate moduleURL to file path utilities ([#​23828](https://redirect.github.com/vitejs/vite/issues/23828)) ([df7b40e](https://redirect.github.com/vitejs/vite/commit/df7b40ee9d691e9f4e2413244f6665ef5482dce3)) - **dev:** separate import resolution from URL conversion ([#​23791](https://redirect.github.com/vitejs/vite/issues/23791)) ([6116689](https://redirect.github.com/vitejs/vite/commit/611668983d4b717f5e5e66cf9f7125bd94f92bf7)) - **dev:** share ModuleURL and BrowserURL conversions ([#​23790](https://redirect.github.com/vitejs/vite/issues/23790)) ([446954c](https://redirect.github.com/vitejs/vite/commit/446954c69c806795c83fe2f97c28ae8f9ef83731)) - **dev:** use ModuleURLs throughout HTML transforms ([#​23815](https://redirect.github.com/vitejs/vite/issues/23815)) ([a162990](https://redirect.github.com/vitejs/vite/commit/a16299092c0f0f3f90e05d4bb5f0168b293c2b52)) </details> --- ### Configuration 📅 **Schedule**: (UTC) - Branch creation - At any time (no schedule defined) - Automerge - At any time (no schedule defined) 🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied. ♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox. 🔕 **Ignore**: Close this PR and you won't be reminded about these updates again. --- - [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check this box --- This PR was generated by [Mend Renovate](https://mend.io/renovate/). View the [repository job log](https://developer.mend.io/github/authelia/authelia). <!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0NC4xODAuMCIsInVwZGF0ZWRJblZlciI6IjQ0LjE4MC4wIiwidGFyZ2V0QnJhbmNoIjoibWFzdGVyIiwibGFiZWxzIjpbImRlcGVuZGVuY2llcyIsImphdmFzY3JpcHQiXX0=--> Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com> |
||
|
renovate[bot]
|
ef68a7c54c |
build(deps): update dependency react-i18next to v17.1.3 (#13565)
This PR contains the following updates: | Package | Change | [Age](https://docs.renovatebot.com/merge-confidence/) | [Confidence](https://docs.renovatebot.com/merge-confidence/) | |---|---|---|---| | [react-i18next](https://redirect.github.com/i18next/react-i18next) | [`17.1.0` → `17.1.3`](https://renovatebot.com/diffs/npm/react-i18next/17.1.0/17.1.3) |  |  | --- ### Release Notes <details> <summary>i18next/react-i18next (react-i18next)</summary> ### [`v17.1.3`](https://redirect.github.com/i18next/react-i18next/blob/HEAD/CHANGELOG.md#1713) [Compare Source](https://redirect.github.com/i18next/react-i18next/compare/v17.1.2...v17.1.3) - fix(IcuTrans): numeric HTML entities above U+FFFF, like emoji, now decode to the right character. `"Hello 👋 <0>friend</0> &#​127881;"` rendered U+F44B and U+F389, private-use glyphs that usually show as a box, instead of 👋 and 🎉: the decoder used `String.fromCharCode`, which keeps only the low 16 bits of the code point. This shows up with translations that a TMS or CMS exports HTML-encoded. Entities above U+10FFFF, which are no valid code points, now stay as written instead of becoming U+0000. Entities below U+10000, including surrogate pairs written as two entities, decode as before. Thanks [@​nk-batman21](https://redirect.github.com/nk-batman21) ([#​1940](https://redirect.github.com/i18next/react-i18next/pull/1940)). ### [`v17.1.2`](https://redirect.github.com/i18next/react-i18next/blob/HEAD/CHANGELOG.md#1712) [Compare Source](https://redirect.github.com/i18next/react-i18next/compare/v17.1.1...v17.1.2) - fix(Trans): when the only child is a string, a tag whose index the children don't have now renders its own text. `<Trans i18nKey="welcome">Welcome</Trans>` with `"Welcome <1>friend</1>"` rendered `Welcome e`, and `defaults="Hi <1>there</1>"` with the child `Hi` rendered `Hi i`. The fallback for a single object of components (`{{ 1: <strong /> }}`) looked the tag up on the string and rendered one of its characters. It now applies only when that child is an object, so `{{ 1: <strong /> }}` renders as before, and the tag falls back to its inner text, as it already did with several children or with a number or an element as the only child. This also stops a single-entry array child holding `null` (`{[null]}`, e.g. from a `.map` that returned `null`) from throwing `Cannot read properties of null`. Thanks [@​Cayan](https://redirect.github.com/Cayan) ([#​1939](https://redirect.github.com/i18next/react-i18next/pull/1939)). ### [`v17.1.1`](https://redirect.github.com/i18next/react-i18next/blob/HEAD/CHANGELOG.md#1711) [Compare Source](https://redirect.github.com/i18next/react-i18next/compare/v17.1.0...v17.1.1) - fix(Trans): with `components` as an object with index keys, the component for key `0` is now rendered. `components={{ 0: <a href={path} /> }}` with `"You're eligible. <0>Get started here.</0>"` rendered the text without the link, a self-closing `<0/>` rendered nothing, and in `<0>a <1>b</1></0>` both elements were lost, while keys `1` and up and the array form worked. The object was passed on as the indexed children, so `<0>` resolved to the object itself. It is now looked up by key, like a named components map. This also fixes an array `components` next to `react.transDefaultProps.components`, which the merge turns into such an object (`{ Bold, 0, 1 }`) and so lost its first entry, and a self-closing named tag in a mixed object (`{ 0: <a />, Bold: <b /> }` with `<Bold/>`), which rendered as the text `<Bold />`. Arrays, named maps and index objects starting at `1` render as before. Thanks [@​nk-batman21](https://redirect.github.com/nk-batman21) ([#​1938](https://redirect.github.com/i18next/react-i18next/pull/1938)). </details> --- ### Configuration 📅 **Schedule**: (UTC) - Branch creation - At any time (no schedule defined) - Automerge - At any time (no schedule defined) 🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied. ♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox. 🔕 **Ignore**: Close this PR and you won't be reminded about this update again. --- - [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check this box --- This PR was generated by [Mend Renovate](https://mend.io/renovate/). View the [repository job log](https://developer.mend.io/github/authelia/authelia). <!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0NC4xODAuMCIsInVwZGF0ZWRJblZlciI6IjQ0LjE4MC4wIiwidGFyZ2V0QnJhbmNoIjoibWFzdGVyIiwibGFiZWxzIjpbImRlcGVuZGVuY2llcyIsImphdmFzY3JpcHQiXX0=--> Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com> |
||
|
renovate[bot]
|
7548da8734 |
build(deps): update node.js to 40cd011 (#13560)
This PR contains the following updates: | Package | Type | Update | Change | |---|---|---|---| | [node](https://hub.docker.com/_/node) ([source](https://redirect.github.com/nodejs/node)) | final | digest | `ae8e1c1` → `40cd011` | | [node](https://hub.docker.com/_/node) ([source](https://redirect.github.com/nodejs/node)) | stage | digest | `ae8e1c1` → `40cd011` | --- ### Configuration 📅 **Schedule**: (UTC) - Branch creation - At any time (no schedule defined) - Automerge - At any time (no schedule defined) 🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied. ♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox. 🔕 **Ignore**: Close this PR and you won't be reminded about these updates again. --- - [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check this box --- This PR was generated by [Mend Renovate](https://mend.io/renovate/). View the [repository job log](https://developer.mend.io/github/authelia/authelia). <!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0NC4xODAuMCIsInVwZGF0ZWRJblZlciI6IjQ0LjE4MC4wIiwidGFyZ2V0QnJhbmNoIjoibWFzdGVyIiwibGFiZWxzIjpbImRlcGVuZGVuY2llcyIsImRvY2tlciJdfQ==--> Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com> |
||
|
renovate[bot]
|
42bfd1e1d5 |
build(deps): update dependency i18next to v26.5.6 (#13564)
This PR contains the following updates: | Package | Change | [Age](https://docs.renovatebot.com/merge-confidence/) | [Confidence](https://docs.renovatebot.com/merge-confidence/) | |---|---|---|---| | [i18next](https://www.i18next.com) ([source](https://redirect.github.com/i18next/i18next)) | [`26.5.3` → `26.5.6`](https://renovatebot.com/diffs/npm/i18next/26.5.3/26.5.6) |  |  | --- ### Release Notes <details> <summary>i18next/i18next (i18next)</summary> ### [`v26.5.6`](https://redirect.github.com/i18next/i18next/blob/HEAD/CHANGELOG.md#2656) [Compare Source](https://redirect.github.com/i18next/i18next/compare/v26.5.5...v26.5.6) - fix: `cloneInstance({ forkResourceStore: true })` now copies the resources at every level. It copied them only down to the namespace objects, so nested keys and arrays stayed shared with the original instance: `addResource()` with a nested key (`fork.addResource('en', 'translation', 'greeting.hello', 'Hi')`) or a deep `addResourceBundle()` on the fork also changed the original instance and every other fork. Flat keys were already isolated. Forking a large store takes a bit longer: with 300k keys in nested groups, about 11 ms instead of 3 ms per fork. Clones without `forkResourceStore` still share the store as before. Thanks [@​nk-batman21](https://redirect.github.com/nk-batman21) ([#​2456](https://redirect.github.com/i18next/i18next/pull/2456), follow-up to [#​2270](https://redirect.github.com/i18next/i18next/issues/2270)). ### [`v26.5.5`](https://redirect.github.com/i18next/i18next/blob/HEAD/CHANGELOG.md#2655) [Compare Source](https://redirect.github.com/i18next/i18next/compare/v26.5.4...v26.5.5) - fix: with the default `skipOnVariables: true`, a `{{placeholder}}` inside a value inserted with an unescaped `{{- var}}` now stays literal, as it already did for `{{var}}`. The escape pass ran after the unescaped values were written and scanned them again, so `t('{{- a}}', { a: '{{b}}', b: 'c' })` returned `'c'` instead of `'{{b}}'`. With pre-built HTML that carries user text, like `t('You may contact {{name}} at {{- emailHTML}}.', { name, emailHTML })`, that text could pull another variable of the same `t()` call into the output. Results with `skipOnVariables: false`, and values without placeholders, are unchanged. Compatibility note: a `{{- var}}` value whose placeholders were meant to be filled from the same `t()` call now keeps them literally; `skipOnVariables: false` restores the old behavior. Thanks [@​nk-batman21](https://redirect.github.com/nk-batman21) ([#​2455](https://redirect.github.com/i18next/i18next/pull/2455), reported in [#​1595](https://redirect.github.com/i18next/i18next/issues/1595#issuecomment-814611747)). ### [`v26.5.4`](https://redirect.github.com/i18next/i18next/blob/HEAD/CHANGELOG.md#2654) [Compare Source](https://redirect.github.com/i18next/i18next/compare/v26.5.3...v26.5.4) - fix: with the default `skipOnVariables: true`, a `{{placeholder}}` inside an interpolated value now stays literal also when the same placeholder appears later in the translation. Each value was written with `String.replace`, which replaces the first copy of the placeholder text, and that could be the copy inside an earlier value: `t('{{name}} has {{count}} items', { name: '{{count}}', count: 5 })` returned `'5 has {{count}} items'` instead of `'{{count}} has 5 items'`. The value is now written at the position of the matched placeholder. Results with `skipOnVariables: false` are unchanged. Thanks [@​nk-batman21](https://redirect.github.com/nk-batman21) ([#​2454](https://redirect.github.com/i18next/i18next/pull/2454), reported in [#​1595](https://redirect.github.com/i18next/i18next/issues/1595#issuecomment-814609503)). - fix: with `useRawValueToEscape: true`, a non-string value in an unescaped `{{- var}}` placeholder or with `escapeValue: false` no longer throws `val.replace is not a function`; it is converted to a string like any other value. </details> --- ### Configuration 📅 **Schedule**: (UTC) - Branch creation - At any time (no schedule defined) - Automerge - At any time (no schedule defined) 🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied. ♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox. 🔕 **Ignore**: Close this PR and you won't be reminded about this update again. --- - [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check this box --- This PR was generated by [Mend Renovate](https://mend.io/renovate/). View the [repository job log](https://developer.mend.io/github/authelia/authelia). <!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0NC4xODAuMCIsInVwZGF0ZWRJblZlciI6IjQ0LjE4MC4wIiwidGFyZ2V0QnJhbmNoIjoibWFzdGVyIiwibGFiZWxzIjpbImRlcGVuZGVuY2llcyIsImphdmFzY3JpcHQiXX0=--> Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com> |
||
|
renovate[bot]
|
c608d22a75 |
build(deps): update authelia/base:latest docker digest to c261389 (#13562)
This PR contains the following updates: | Package | Type | Update | Change | |---|---|---|---| | authelia/base | final | digest | `57f8254` → `c261389` | --- ### Configuration 📅 **Schedule**: (UTC) - Branch creation - At any time (no schedule defined) - Automerge - At any time (no schedule defined) 🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied. ♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox. 🔕 **Ignore**: Close this PR and you won't be reminded about this update again. --- - [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check this box --- This PR was generated by [Mend Renovate](https://mend.io/renovate/). View the [repository job log](https://developer.mend.io/github/authelia/authelia). <!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0NC4xODAuMCIsInVwZGF0ZWRJblZlciI6IjQ0LjE4MC4wIiwidGFyZ2V0QnJhbmNoIjoibWFzdGVyIiwibGFiZWxzIjpbImRlcGVuZGVuY2llcyIsImRvY2tlciJdfQ==--> Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com> |
||
|
renovate[bot]
|
d00d5b0f67 |
build(deps): update dependency baseline-browser-mapping to v2.11.31 (#13563)
This PR contains the following updates: | Package | Change | [Age](https://docs.renovatebot.com/merge-confidence/) | [Confidence](https://docs.renovatebot.com/merge-confidence/) | |---|---|---|---| | [baseline-browser-mapping](https://redirect.github.com/web-platform-dx/baseline-browser-mapping) | [`2.11.30` → `2.11.31`](https://renovatebot.com/diffs/npm/baseline-browser-mapping/2.11.30/2.11.31) |  |  | --- ### Release Notes <details> <summary>web-platform-dx/baseline-browser-mapping (baseline-browser-mapping)</summary> ### [`v2.11.31`](https://redirect.github.com/web-platform-dx/baseline-browser-mapping/compare/v2.11.30...v2.11.31) [Compare Source](https://redirect.github.com/web-platform-dx/baseline-browser-mapping/compare/v2.11.30...v2.11.31) </details> --- ### Configuration 📅 **Schedule**: (UTC) - Branch creation - At any time (no schedule defined) - Automerge - At any time (no schedule defined) 🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied. ♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox. 🔕 **Ignore**: Close this PR and you won't be reminded about this update again. --- - [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check this box --- This PR was generated by [Mend Renovate](https://mend.io/renovate/). View the [repository job log](https://developer.mend.io/github/authelia/authelia). <!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0NC4xODAuMCIsInVwZGF0ZWRJblZlciI6IjQ0LjE4MC4wIiwidGFyZ2V0QnJhbmNoIjoibWFzdGVyIiwibGFiZWxzIjpbImRlcGVuZGVuY2llcyIsImphdmFzY3JpcHQiXX0=--> Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com> |
||
|
renovate[bot]
|
ffa215442f |
build(deps): update dependency @eslint-react/eslint-plugin to v5.28.6 (#13561)
This PR contains the following updates: | Package | Change | [Age](https://docs.renovatebot.com/merge-confidence/) | [Confidence](https://docs.renovatebot.com/merge-confidence/) | |---|---|---|---| | [@eslint-react/eslint-plugin](https://redirect.github.com/Rel1cx/eslint-react) ([source](https://redirect.github.com/Rel1cx/eslint-react/tree/HEAD/plugins/eslint-plugin)) | [`5.28.3` → `5.28.6`](https://renovatebot.com/diffs/npm/@eslint-react%2feslint-plugin/5.28.3/5.28.6) |  |  | --- ### Release Notes <details> <summary>Rel1cx/eslint-react (@​eslint-react/eslint-plugin)</summary> ### [`v5.28.6`](https://redirect.github.com/Rel1cx/eslint-react/blob/HEAD/CHANGELOG.md#v5286-2026-10-22) [Compare Source](https://redirect.github.com/Rel1cx/eslint-react/compare/v5.28.5...v5.28.6) ##### 🐞 Fixes - `react-x/set-state-in-effect`: the ref-derived parameter exemption now also applies to helpers wrapped in `useCallback` (ex: `measure(ref.current)` where `measure = useCallback((el) => { setWidth(el.offsetWidth); }, [])`). ([#​2065](https://redirect.github.com/Rel1cx/eslint-react/issues/2065)) Thanks to [@​amhunt](https://redirect.github.com/amhunt)! - `react-x/set-state-in-effect`: a helper call behind a ref-derived guard (`if`, ternary, short-circuit, or early return) now exempts the `setState` calls it reaches, as a `setState` written in its place would be (ex: `if (!anchorRef.current) return; commitPosition(0, true);`); call sites are judged individually. ([#​2065](https://redirect.github.com/Rel1cx/eslint-react/issues/2065)) Thanks to [@​amhunt](https://redirect.github.com/amhunt)! ##### New Contributors - **Andrew Hunt** ([@​amhunt](https://redirect.github.com/amhunt)) made their first contribution in [#​2065](https://redirect.github.com/Rel1cx/eslint-react/issues/2065). **Full Changelog**: <https://github.com/Rel1cx/eslint-react/compare/v5.28.5...v5.28.6> ### [`v5.28.5`](https://redirect.github.com/Rel1cx/eslint-react/blob/HEAD/CHANGELOG.md#v5285-2026-10-22) [Compare Source](https://redirect.github.com/Rel1cx/eslint-react/compare/v5.28.4...v5.28.5) ##### ✨ New - `react-dom/no-unsafe-target-blank`: the suggested fix now adds `rel="noreferrer"` instead of `rel="noreferrer noopener"`, since `noreferrer` already implies `noopener` per the HTML spec; values combining both tokens remain valid. ([#​2068](https://redirect.github.com/Rel1cx/eslint-react/issues/2068)) ##### 🏗️ Internal - Removed redundant transitive dependency overrides. ([#​2064](https://redirect.github.com/Rel1cx/eslint-react/issues/2064)) - Bumped `vite` to `8.3.5` and `lucide-react` to `1.61.0`. **Full Changelog**: <https://github.com/Rel1cx/eslint-react/compare/v5.28.4...v5.28.5> ### [`v5.28.4`](https://redirect.github.com/Rel1cx/eslint-react/blob/HEAD/CHANGELOG.md#v5284-2026-10-21) [Compare Source](https://redirect.github.com/Rel1cx/eslint-react/compare/v5.28.3...v5.28.4) ##### 🐞 Fixes - Reverted the component-scope-bounded identifier resolution introduced in v5.28.3, including the per-component single-report attribution; class declarations in a component body remain recognized as per-render constructions. ([#​2062](https://redirect.github.com/Rel1cx/eslint-react/issues/2062)) Affected rules: - `react-x/no-unstable-context-value` - `react-x/no-unstable-default-props` ##### 📝 Documentation - Updated the AST Explorer links across the website docs and recipes. ##### 🏗️ Internal - `@eslint-react/var`: removed the `boundary` option from `resolve` and `resolveObjectType`, and the `ClassDeclaration` resolution in `resolveObjectType`, following the revert. ([#​2062](https://redirect.github.com/Rel1cx/eslint-react/issues/2062)) - Renamed the `Jsx`-prefixed `@eslint-react/core` exports to all-caps `JSX` (ex: `JsxConfig` → `JSXConfig`, `isJsxLike` → `isJSXLike`). ([#​2061](https://redirect.github.com/Rel1cx/eslint-react/issues/2061)) - Bumped `fumadocs-mdx` to `15.4.9`. **Full Changelog**: <https://github.com/Rel1cx/eslint-react/compare/v5.28.3...v5.28.4> </details> --- ### Configuration 📅 **Schedule**: (UTC) - Branch creation - At any time (no schedule defined) - Automerge - At any time (no schedule defined) 🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied. ♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox. 🔕 **Ignore**: Close this PR and you won't be reminded about this update again. --- - [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check this box --- This PR was generated by [Mend Renovate](https://mend.io/renovate/). View the [repository job log](https://developer.mend.io/github/authelia/authelia). <!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0NC4xODAuMCIsInVwZGF0ZWRJblZlciI6IjQ0LjE4MC4wIiwidGFyZ2V0QnJhbmNoIjoibWFzdGVyIiwibGFiZWxzIjpbImRlcGVuZGVuY2llcyIsImphdmFzY3JpcHQiXX0=--> Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com> |
||
|
renovate[bot]
|
674bfff3ed |
build(deps): update haproxy:3.4.7-alpine docker digest to 3c8c1df (#13559)
This PR contains the following updates: | Package | Type | Update | Change | |---|---|---|---| | [haproxy](https://hub.docker.com/_/haproxy) ([source](https://redirect.github.com/docker-library/haproxy)) | final | digest | `09ba5c0` → `3c8c1df` | --- ### Configuration 📅 **Schedule**: (UTC) - Branch creation - At any time (no schedule defined) - Automerge - At any time (no schedule defined) 🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied. ♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox. 🔕 **Ignore**: Close this PR and you won't be reminded about this update again. --- - [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check this box --- This PR was generated by [Mend Renovate](https://mend.io/renovate/). View the [repository job log](https://developer.mend.io/github/authelia/authelia). <!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0NC4xNzYuMyIsInVwZGF0ZWRJblZlciI6IjQ0LjE3Ni4zIiwidGFyZ2V0QnJhbmNoIjoibWFzdGVyIiwibGFiZWxzIjpbImRlcGVuZGVuY2llcyIsImRvY2tlciJdfQ==--> Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com> |
||
|
renovate[bot]
|
05d25b9f38 |
build(deps): update alpine:3.24.3 docker digest to be26560 (#13558)
This PR contains the following updates: | Package | Type | Update | Change | |---|---|---|---| | [alpine](https://hub.docker.com/_/alpine) ([source](https://redirect.github.com/alpinelinux/docker-alpine)) | final | digest | `b341357` → `be26560` | --- ### Configuration 📅 **Schedule**: (UTC) - Branch creation - At any time (no schedule defined) - Automerge - At any time (no schedule defined) 🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied. ♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox. 🔕 **Ignore**: Close this PR and you won't be reminded about this update again. --- - [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check this box --- This PR was generated by [Mend Renovate](https://mend.io/renovate/). View the [repository job log](https://developer.mend.io/github/authelia/authelia). <!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0NC4xNzYuMyIsInVwZGF0ZWRJblZlciI6IjQ0LjE3Ni4zIiwidGFyZ2V0QnJhbmNoIjoibWFzdGVyIiwibGFiZWxzIjpbImRlcGVuZGVuY2llcyIsImRvY2tlciJdfQ==--> Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com> |
||
|
renovate[bot]
|
c2d71bbc31 |
build(deps): update golang:1.27.3-alpine docker digest to b8c9b82 (#13557)
This PR contains the following updates: | Package | Type | Update | Change | |---|---|---|---| | [golang](https://hub.docker.com/_/golang) ([source](https://redirect.github.com/docker-library/golang)) | stage | digest | `d530cf6` → `b8c9b82` | | [golang](https://hub.docker.com/_/golang) ([source](https://redirect.github.com/docker-library/golang)) | final | digest | `d530cf6` → `b8c9b82` | --- ### Configuration 📅 **Schedule**: (UTC) - Branch creation - At any time (no schedule defined) - Automerge - At any time (no schedule defined) 🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied. ♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox. 🔕 **Ignore**: Close this PR and you won't be reminded about these updates again. --- - [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check this box --- This PR was generated by [Mend Renovate](https://mend.io/renovate/). View the [repository job log](https://developer.mend.io/github/authelia/authelia). <!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0NC4xNzYuMyIsInVwZGF0ZWRJblZlciI6IjQ0LjE3Ni4zIiwidGFyZ2V0QnJhbmNoIjoibWFzdGVyIiwibGFiZWxzIjpbImRlcGVuZGVuY2llcyIsImRvY2tlciJdfQ==--> Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com> |
||
|
renovate[bot]
|
9866b19a11 |
build(deps): update caddy:2.11.7-builder docker digest to c2fc374 (#13556)
This PR contains the following updates: | Package | Type | Update | Change | |---|---|---|---| | [caddy](https://hub.docker.com/_/caddy) ([source](https://redirect.github.com/caddyserver/caddy-docker)) | stage | digest | `671d2a6` → `c2fc374` | --- ### Configuration 📅 **Schedule**: (UTC) - Branch creation - At any time (no schedule defined) - Automerge - At any time (no schedule defined) 🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied. ♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox. 🔕 **Ignore**: Close this PR and you won't be reminded about this update again. --- - [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check this box --- This PR was generated by [Mend Renovate](https://mend.io/renovate/). View the [repository job log](https://developer.mend.io/github/authelia/authelia). <!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0NC4xNzYuMyIsInVwZGF0ZWRJblZlciI6IjQ0LjE3Ni4zIiwidGFyZ2V0QnJhbmNoIjoibWFzdGVyIiwibGFiZWxzIjpbImRlcGVuZGVuY2llcyIsImRvY2tlciJdfQ==--> Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com> |
||
|
renovate[bot]
|
0c796090f7 |
build(deps): update authelia/base:latest docker digest to 57f8254 (#13553)
This PR contains the following updates: | Package | Type | Update | Change | |---|---|---|---| | authelia/base | final | digest | `fffb998` → `57f8254` | --- ### Configuration 📅 **Schedule**: (UTC) - Branch creation - At any time (no schedule defined) - Automerge - At any time (no schedule defined) 🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied. ♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox. 🔕 **Ignore**: Close this PR and you won't be reminded about this update again. --- - [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check this box --- This PR was generated by [Mend Renovate](https://mend.io/renovate/). View the [repository job log](https://developer.mend.io/github/authelia/authelia). <!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0NC4xNzYuMyIsInVwZGF0ZWRJblZlciI6IjQ0LjE3Ni4zIiwidGFyZ2V0QnJhbmNoIjoibWFzdGVyIiwibGFiZWxzIjpbImRlcGVuZGVuY2llcyIsImRvY2tlciJdfQ==--> Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com> |
||
|
renovate[bot]
|
10463bc35a |
build(deps): update caddy:2.11.7 docker digest to 504a44d (#13554)
This PR contains the following updates: | Package | Type | Update | Change | |---|---|---|---| | [caddy](https://hub.docker.com/_/caddy) ([source](https://redirect.github.com/caddyserver/caddy-docker)) | final | digest | `3095ad2` → `504a44d` | --- ### Configuration 📅 **Schedule**: (UTC) - Branch creation - At any time (no schedule defined) - Automerge - At any time (no schedule defined) 🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied. ♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox. 🔕 **Ignore**: Close this PR and you won't be reminded about this update again. --- - [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check this box --- This PR was generated by [Mend Renovate](https://mend.io/renovate/). View the [repository job log](https://developer.mend.io/github/authelia/authelia). <!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0NC4xNzYuMyIsInVwZGF0ZWRJblZlciI6IjQ0LjE3Ni4zIiwidGFyZ2V0QnJhbmNoIjoibWFzdGVyIiwibGFiZWxzIjpbImRlcGVuZGVuY2llcyIsImRvY2tlciJdfQ==--> Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com> |
||
|
renovate[bot]
|
73321c7b71 |
build(deps): update haproxy:3.4.7-alpine docker digest to 09ba5c0 (#13552)
This PR contains the following updates: | Package | Type | Update | Change | |---|---|---|---| | [haproxy](https://hub.docker.com/_/haproxy) ([source](https://redirect.github.com/docker-library/haproxy)) | final | digest | `251da69` → `09ba5c0` | --- ### Configuration 📅 **Schedule**: (UTC) - Branch creation - At any time (no schedule defined) - Automerge - At any time (no schedule defined) 🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied. ♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox. 🔕 **Ignore**: Close this PR and you won't be reminded about this update again. --- - [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check this box --- This PR was generated by [Mend Renovate](https://mend.io/renovate/). View the [repository job log](https://developer.mend.io/github/authelia/authelia). <!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0NC4xNzEuMiIsInVwZGF0ZWRJblZlciI6IjQ0LjE3MS4yIiwidGFyZ2V0QnJhbmNoIjoibWFzdGVyIiwibGFiZWxzIjpbImRlcGVuZGVuY2llcyIsImRvY2tlciJdfQ==--> Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com> |
||
|
renovate[bot]
|
81bb61eb36 |
build(deps): update golang:1.27.3-alpine docker digest to d530cf6 (#13551)
This PR contains the following updates: | Package | Type | Update | Change | |---|---|---|---| | [golang](https://hub.docker.com/_/golang) ([source](https://redirect.github.com/docker-library/golang)) | stage | digest | `f2c872b` → `d530cf6` | | [golang](https://hub.docker.com/_/golang) ([source](https://redirect.github.com/docker-library/golang)) | final | digest | `f2c872b` → `d530cf6` | --- ### Configuration 📅 **Schedule**: (UTC) - Branch creation - At any time (no schedule defined) - Automerge - At any time (no schedule defined) 🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied. ♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox. 🔕 **Ignore**: Close this PR and you won't be reminded about these updates again. --- - [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check this box --- This PR was generated by [Mend Renovate](https://mend.io/renovate/). View the [repository job log](https://developer.mend.io/github/authelia/authelia). <!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0NC4xNzEuMiIsInVwZGF0ZWRJblZlciI6IjQ0LjE3MS4yIiwidGFyZ2V0QnJhbmNoIjoibWFzdGVyIiwibGFiZWxzIjpbImRlcGVuZGVuY2llcyIsImRvY2tlciJdfQ==--> Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com> |
||
|
renovate[bot]
|
88984929fb |
build(deps): update alpine:3.24.3 docker digest to b341357 (#13549)
This PR contains the following updates: | Package | Type | Update | Change | |---|---|---|---| | [alpine](https://hub.docker.com/_/alpine) ([source](https://redirect.github.com/alpinelinux/docker-alpine)) | final | digest | `1b7232c` → `b341357` | --- ### Configuration 📅 **Schedule**: (UTC) - Branch creation - At any time (no schedule defined) - Automerge - At any time (no schedule defined) 🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied. ♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox. 🔕 **Ignore**: Close this PR and you won't be reminded about this update again. --- - [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check this box --- This PR was generated by [Mend Renovate](https://mend.io/renovate/). View the [repository job log](https://developer.mend.io/github/authelia/authelia). <!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0NC4xNzEuMiIsInVwZGF0ZWRJblZlciI6IjQ0LjE3MS4yIiwidGFyZ2V0QnJhbmNoIjoibWFzdGVyIiwibGFiZWxzIjpbImRlcGVuZGVuY2llcyIsImRvY2tlciJdfQ==--> Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com> |
||
|
renovate[bot]
|
38fae9f3d7 |
build(deps): update caddy:2.11.7-builder docker digest to 671d2a6 (#13550)
This PR contains the following updates: | Package | Type | Update | Change | |---|---|---|---| | [caddy](https://hub.docker.com/_/caddy) ([source](https://redirect.github.com/caddyserver/caddy-docker)) | stage | digest | `8910fe6` → `671d2a6` | --- ### Configuration 📅 **Schedule**: (UTC) - Branch creation - At any time (no schedule defined) - Automerge - At any time (no schedule defined) 🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied. ♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox. 🔕 **Ignore**: Close this PR and you won't be reminded about this update again. --- - [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check this box --- This PR was generated by [Mend Renovate](https://mend.io/renovate/). View the [repository job log](https://developer.mend.io/github/authelia/authelia). <!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0NC4xNzEuMiIsInVwZGF0ZWRJblZlciI6IjQ0LjE3MS4yIiwidGFyZ2V0QnJhbmNoIjoibWFzdGVyIiwibGFiZWxzIjpbImRlcGVuZGVuY2llcyIsImRvY2tlciJdfQ==--> Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com> |
||
|
renovate[bot]andAmir Zarrinkafsh
|
69e13d1e6b |
build(deps): update dependency @eslint-react/eslint-plugin to v5.28.3 (#13545)
This PR contains the following updates: | Package | Change | [Age](https://docs.renovatebot.com/merge-confidence/) | [Confidence](https://docs.renovatebot.com/merge-confidence/) | |---|---|---|---| | [@eslint-react/eslint-plugin](https://redirect.github.com/Rel1cx/eslint-react) ([source](https://redirect.github.com/Rel1cx/eslint-react/tree/HEAD/plugins/eslint-plugin)) | [`5.28.2` → `5.28.3`](https://renovatebot.com/diffs/npm/@eslint-react%2feslint-plugin/5.28.2/5.28.3) |  |  | --- ### Release Notes <details> <summary>Rel1cx/eslint-react (@​eslint-react/eslint-plugin)</summary> ### [`v5.28.3`](https://redirect.github.com/Rel1cx/eslint-react/blob/HEAD/CHANGELOG.md#v5283-2026-10-20) [Compare Source](https://redirect.github.com/Rel1cx/eslint-react/compare/v5.28.2...v5.28.3) ##### ✨ New - Identifier resolution is now bounded by the enclosing component scope, so render-scoped values referenced from nested callbacks (ex: `items.map((item) => <Context.Provider value={foo}>)`) are now detected, values declared outside the component (ex: module-level constants) are treated as stable, and nested components report each value only once, attributed to the innermost component. ([#​2060](https://redirect.github.com/Rel1cx/eslint-react/issues/2060)) Affected rules: - `react-x/no-unstable-context-value` - `react-x/no-unstable-default-props` - Class declarations (ex: `class Foo {}` in a component body) are now recognized as per-render constructions, so using one as a context value or default prop is now reported. ([#​2060](https://redirect.github.com/Rel1cx/eslint-react/issues/2060)) Affected rules: - `react-x/no-unstable-context-value` - `react-x/no-unstable-default-props` ##### 🏗️ Internal - `@eslint-react/var`: `resolve` and `resolveObjectType` now accept a `boundary` option that bounds scope-chain traversal to an enclosing component or hook; `resolveObjectType` also resolves `ClassDeclaration` nodes. ([#​2060](https://redirect.github.com/Rel1cx/eslint-react/issues/2060)) - Bumped `typescript-eslint` to `8.72.0`, `fumadocs-core` and `fumadocs-ui` to `16.17.7`, `fumadocs-mdx` to `15.4.8`, `lucide-react` to `1.60.0`, and `typedoc-plugin-markdown` to `4.14.1`. **Full Changelog**: <https://github.com/Rel1cx/eslint-react/compare/v5.28.2...v5.28.3> </details> --- ### Configuration 📅 **Schedule**: (UTC) - Branch creation - At any time (no schedule defined) - Automerge - At any time (no schedule defined) 🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied. ♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox. 🔕 **Ignore**: Close this PR and you won't be reminded about this update again. --- - [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check this box --- This PR was generated by [Mend Renovate](https://mend.io/renovate/). View the [repository job log](https://developer.mend.io/github/authelia/authelia). <!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0NC4xNzEuMiIsInVwZGF0ZWRJblZlciI6IjQ0LjE3MS4yIiwidGFyZ2V0QnJhbmNoIjoibWFzdGVyIiwibGFiZWxzIjpbImRlcGVuZGVuY2llcyIsImphdmFzY3JpcHQiXX0=--> Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com> Co-authored-by: Amir Zarrinkafsh <3339418+nightah@users.noreply.github.com> |
||
|
renovate[bot]andAmir Zarrinkafsh
|
13d02d15ad |
build(deps): update alpine docker tag to v3.24.3 (#13544)
This PR contains the following updates: | Package | Type | Update | Change | |---|---|---|---| | [alpine](https://hub.docker.com/_/alpine) ([source](https://redirect.github.com/alpinelinux/docker-alpine)) | final | patch | `3.24.2` → `3.24.3` | --- ### Configuration 📅 **Schedule**: (UTC) - Branch creation - At any time (no schedule defined) - Automerge - At any time (no schedule defined) 🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied. ♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox. 🔕 **Ignore**: Close this PR and you won't be reminded about this update again. --- - [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check this box --- This PR was generated by [Mend Renovate](https://mend.io/renovate/). View the [repository job log](https://developer.mend.io/github/authelia/authelia). <!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0NC4xNzEuMiIsInVwZGF0ZWRJblZlciI6IjQ0LjE3MS4yIiwidGFyZ2V0QnJhbmNoIjoibWFzdGVyIiwibGFiZWxzIjpbImRlcGVuZGVuY2llcyIsImRvY2tlciJdfQ==--> Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com> Co-authored-by: Amir Zarrinkafsh <3339418+nightah@users.noreply.github.com> |
||
|
renovate[bot]andAmir Zarrinkafsh
|
024af805f2 |
build(deps): update authelia/base:latest docker digest to fffb998 (#13542)
This PR contains the following updates: | Package | Type | Update | Change | |---|---|---|---| | authelia/base | final | digest | `8b758c7` → `fffb998` | --- ### Configuration 📅 **Schedule**: (UTC) - Branch creation - At any time (no schedule defined) - Automerge - At any time (no schedule defined) 🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied. ♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox. 🔕 **Ignore**: Close this PR and you won't be reminded about this update again. --- - [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check this box --- This PR was generated by [Mend Renovate](https://mend.io/renovate/). View the [repository job log](https://developer.mend.io/github/authelia/authelia). <!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0NC4xNzEuMiIsInVwZGF0ZWRJblZlciI6IjQ0LjE3MS4yIiwidGFyZ2V0QnJhbmNoIjoibWFzdGVyIiwibGFiZWxzIjpbImRlcGVuZGVuY2llcyIsImRvY2tlciJdfQ==--> Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com> Co-authored-by: Amir Zarrinkafsh <3339418+nightah@users.noreply.github.com> |
||
|
renovate[bot]andAmir Zarrinkafsh
|
31d74d4ca9 |
build(deps): update golang docker tag to v1.27.3 (#13541)
This PR contains the following updates: | Package | Type | Update | Change | |---|---|---|---| | [golang](https://hub.docker.com/_/golang) ([source](https://redirect.github.com/docker-library/golang)) | stage | patch | `1.27.2-alpine` → `1.27.3-alpine` | | [golang](https://hub.docker.com/_/golang) ([source](https://redirect.github.com/docker-library/golang)) | final | patch | `1.27.2-alpine` → `1.27.3-alpine` | | [golang](https://hub.docker.com/_/golang) ([source](https://redirect.github.com/docker-library/golang)) | stage | patch | `1.27.2-bookworm` → `1.27.3-bookworm` | --- ### Configuration 📅 **Schedule**: (UTC) - Branch creation - At any time (no schedule defined) - Automerge - At any time (no schedule defined) 🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied. ♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox. 🔕 **Ignore**: Close this PR and you won't be reminded about these updates again. --- - [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check this box --- This PR was generated by [Mend Renovate](https://mend.io/renovate/). View the [repository job log](https://developer.mend.io/github/authelia/authelia). <!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0NC4xNzEuMiIsInVwZGF0ZWRJblZlciI6IjQ0LjE3MS4yIiwidGFyZ2V0QnJhbmNoIjoibWFzdGVyIiwibGFiZWxzIjpbImRlcGVuZGVuY2llcyIsImRvY2tlciJdfQ==--> Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com> Co-authored-by: Amir Zarrinkafsh <3339418+nightah@users.noreply.github.com> |
||
|
renovate[bot]andAmir Zarrinkafsh
|
cf9e2ec13c |
build(deps): update go toolchain directive to v1.27.3 (#13540)
This PR contains the following updates: | Package | Type | Update | Change | |---|---|---|---| | [go](https://go.dev/) ([source](https://redirect.github.com/golang/go)) | toolchain | patch | `1.27.2` → `1.27.3` | --- ### Configuration 📅 **Schedule**: (UTC) - Branch creation - At any time (no schedule defined) - Automerge - At any time (no schedule defined) 🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied. ♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox. 🔕 **Ignore**: Close this PR and you won't be reminded about this update again. --- - [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check this box --- This PR was generated by [Mend Renovate](https://mend.io/renovate/). View the [repository job log](https://developer.mend.io/github/authelia/authelia). <!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0NC4xNzEuMiIsInVwZGF0ZWRJblZlciI6IjQ0LjE3MS4yIiwidGFyZ2V0QnJhbmNoIjoibWFzdGVyIiwibGFiZWxzIjpbImRlcGVuZGVuY2llcyJdfQ==--> Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com> Co-authored-by: Amir Zarrinkafsh <3339418+nightah@users.noreply.github.com> |
||
|
renovate[bot]
|
c0476cab18 |
build(deps): update dependency happy-dom to v21.0.4 (#13548)
This PR contains the following updates: | Package | Change | [Age](https://docs.renovatebot.com/merge-confidence/) | [Confidence](https://docs.renovatebot.com/merge-confidence/) | |---|---|---|---| | [happy-dom](https://redirect.github.com/capricorn86/happy-dom) | [`21.0.3` → `21.0.4`](https://renovatebot.com/diffs/npm/happy-dom/21.0.3/21.0.4) |  |  | --- ### Release Notes <details> <summary>capricorn86/happy-dom (happy-dom)</summary> ### [`v21.0.4`](https://redirect.github.com/capricorn86/happy-dom/releases/tag/v21.0.4) [Compare Source](https://redirect.github.com/capricorn86/happy-dom/compare/v21.0.3...v21.0.4) ##### 👷♂️ Patch fixes - Fixed a code injection vulnerability in the ESM compiler - By **[@​capricorn86](https://redirect.github.com/capricorn86)** - Fixed cross-origin isolation so opaque-origin `data:` iframes cannot access their parent or top window - By **[@​capricorn86](https://redirect.github.com/capricorn86)** </details> --- ### Configuration 📅 **Schedule**: (UTC) - Branch creation - At any time (no schedule defined) - Automerge - At any time (no schedule defined) 🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied. ♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox. 🔕 **Ignore**: Close this PR and you won't be reminded about this update again. --- - [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check this box --- This PR was generated by [Mend Renovate](https://mend.io/renovate/). View the [repository job log](https://developer.mend.io/github/authelia/authelia). <!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0NC4xNzEuMiIsInVwZGF0ZWRJblZlciI6IjQ0LjE3MS4yIiwidGFyZ2V0QnJhbmNoIjoibWFzdGVyIiwibGFiZWxzIjpbImRlcGVuZGVuY2llcyIsImphdmFzY3JpcHQiXX0=--> Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com> |
||
|
renovate[bot]
|
53d45502c2 |
build(deps): update caddy:2.11.7 docker digest to 3095ad2 (#13547)
This PR contains the following updates: | Package | Type | Update | Change | |---|---|---|---| | [caddy](https://hub.docker.com/_/caddy) ([source](https://redirect.github.com/caddyserver/caddy-docker)) | final | digest | `685ae3d` → `3095ad2` | --- ### Configuration 📅 **Schedule**: (UTC) - Branch creation - At any time (no schedule defined) - Automerge - At any time (no schedule defined) 🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied. ♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox. 🔕 **Ignore**: Close this PR and you won't be reminded about this update again. --- - [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check this box --- This PR was generated by [Mend Renovate](https://mend.io/renovate/). View the [repository job log](https://developer.mend.io/github/authelia/authelia). <!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0NC4xNzEuMiIsInVwZGF0ZWRJblZlciI6IjQ0LjE3MS4yIiwidGFyZ2V0QnJhbmNoIjoibWFzdGVyIiwibGFiZWxzIjpbImRlcGVuZGVuY2llcyIsImRvY2tlciJdfQ==--> Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com> |
||
|
renovate[bot]
|
547b405d99 |
build(deps): update node.js to ae8e1c1 (#13543)
This PR contains the following updates: | Package | Type | Update | Change | |---|---|---|---| | [node](https://hub.docker.com/_/node) ([source](https://redirect.github.com/nodejs/node)) | final | digest | `6f08a52` → `ae8e1c1` | | [node](https://hub.docker.com/_/node) ([source](https://redirect.github.com/nodejs/node)) | stage | digest | `6f08a52` → `ae8e1c1` | --- ### Configuration 📅 **Schedule**: (UTC) - Branch creation - At any time (no schedule defined) - Automerge - At any time (no schedule defined) 🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied. ♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox. 🔕 **Ignore**: Close this PR and you won't be reminded about these updates again. --- - [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check this box --- This PR was generated by [Mend Renovate](https://mend.io/renovate/). View the [repository job log](https://developer.mend.io/github/authelia/authelia). <!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0NC4xNzEuMiIsInVwZGF0ZWRJblZlciI6IjQ0LjE3MS4yIiwidGFyZ2V0QnJhbmNoIjoibWFzdGVyIiwibGFiZWxzIjpbImRlcGVuZGVuY2llcyIsImRvY2tlciJdfQ==--> Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com> |
||
|
renovate[bot]
|
e6cd61d33e |
build(deps): update dependency i18next to v26.5.3 (#13538)
This PR contains the following updates: | Package | Change | [Age](https://docs.renovatebot.com/merge-confidence/) | [Confidence](https://docs.renovatebot.com/merge-confidence/) | |---|---|---|---| | [i18next](https://www.i18next.com) ([source](https://redirect.github.com/i18next/i18next)) | [`26.5.2` → `26.5.3`](https://renovatebot.com/diffs/npm/i18next/26.5.2/26.5.3) |  |  | --- ### Release Notes <details> <summary>i18next/i18next (i18next)</summary> ### [`v26.5.3`](https://redirect.github.com/i18next/i18next/blob/HEAD/CHANGELOG.md#2653) [Compare Source](https://redirect.github.com/i18next/i18next/compare/v26.5.2...v26.5.3) - fix(types): with the selector API, a plural key now requires `count` also when the call passes an explicit `ns`. `t(($) => $.item)` already failed without `count`, but `t(($) => $.item, { ns: 'items' })` compiled, although at runtime it looks up `item` instead of `item_one` / `item_other` and returns the key. It now fails the same way, also with `ordinal: true`, `defaultValue`, an `ns` array, a key prefix and `i18n.t`. Calls with `count`, `context`, `returnObjects: true` and arrays of selectors, as well as return types, are unchanged. Thanks [@​nyarthan](https://redirect.github.com/nyarthan) ([#​2452](https://redirect.github.com/i18next/i18next/pull/2452)). </details> --- ### Configuration 📅 **Schedule**: (UTC) - Branch creation - At any time (no schedule defined) - Automerge - At any time (no schedule defined) 🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied. ♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox. 🔕 **Ignore**: Close this PR and you won't be reminded about this update again. --- - [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check this box --- This PR was generated by [Mend Renovate](https://mend.io/renovate/). View the [repository job log](https://developer.mend.io/github/authelia/authelia). <!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0NC4xNzEuMiIsInVwZGF0ZWRJblZlciI6IjQ0LjE3MS4yIiwidGFyZ2V0QnJhbmNoIjoibWFzdGVyIiwibGFiZWxzIjpbImRlcGVuZGVuY2llcyIsImphdmFzY3JpcHQiXX0=--> Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com> |
||
|
renovate[bot]
|
bf68f72c5b |
build(deps): update dependency postcss to v8.5.31 (#13539)
This PR contains the following updates: | Package | Change | [Age](https://docs.renovatebot.com/merge-confidence/) | [Confidence](https://docs.renovatebot.com/merge-confidence/) | |---|---|---|---| | [postcss](https://postcss.org/) ([source](https://redirect.github.com/postcss/postcss)) | [`8.5.30` → `8.5.31`](https://renovatebot.com/diffs/npm/postcss/8.5.30/8.5.31) |  |  | --- ### Release Notes <details> <summary>postcss/postcss (postcss)</summary> ### [`v8.5.31`](https://redirect.github.com/postcss/postcss/blob/HEAD/CHANGELOG.md#8531) [Compare Source](https://redirect.github.com/postcss/postcss/compare/8.5.30...8.5.31) - Fix better source map on `</style>` escaping (by [@​firefoxic](https://redirect.github.com/firefoxic)). </details> --- ### Configuration 📅 **Schedule**: (UTC) - Branch creation - At any time (no schedule defined) - Automerge - At any time (no schedule defined) 🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied. ♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox. 🔕 **Ignore**: Close this PR and you won't be reminded about these updates again. --- - [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check this box --- This PR was generated by [Mend Renovate](https://mend.io/renovate/). View the [repository job log](https://developer.mend.io/github/authelia/authelia). <!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0NC4xNzEuMiIsInVwZGF0ZWRJblZlciI6IjQ0LjE3MS4yIiwidGFyZ2V0QnJhbmNoIjoibWFzdGVyIiwibGFiZWxzIjpbImRlcGVuZGVuY2llcyIsImphdmFzY3JpcHQiXX0=--> Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com> |
||
|
renovate[bot]
|
3b2b92132d |
build(deps): update dependency fast-uri to v4.2.3 (#13537)
This PR contains the following updates: | Package | Change | [Age](https://docs.renovatebot.com/merge-confidence/) | [Confidence](https://docs.renovatebot.com/merge-confidence/) | |---|---|---|---| | [fast-uri](https://redirect.github.com/fastify/fast-uri) | [`4.2.2` → `4.2.3`](https://renovatebot.com/diffs/npm/fast-uri/4.2.2/4.2.3) |  |  | --- ### Release Notes <details> <summary>fastify/fast-uri (fast-uri)</summary> ### [`v4.2.3`](https://redirect.github.com/fastify/fast-uri/releases/tag/v4.2.3) [Compare Source](https://redirect.github.com/fastify/fast-uri/compare/v4.2.2...v4.2.3) #### Security This security release fixes four URI parsing and normalization vulnerabilities in fast-uri 4.x. Applications that process untrusted URI input should upgrade to v4.2.3. - **Medium — URI scheme spoofing through percent-encoded schemes** ([GHSA-w74x-v6f9-j3xg](https://redirect.github.com/fastify/fast-uri/security/advisories/GHSA-w74x-v6f9-j3xg), CVE-2026-110306): percent-encoded scheme input is now rejected instead of being decoded into a live scheme. - **Medium — Host confusion during domain-host canonicalization** ([GHSA-wjr9-j795-jxcr](https://redirect.github.com/fastify/fast-uri/security/advisories/GHSA-wjr9-j795-jxcr), CVE-2026-110180): malformed domain hosts containing ambiguous delimiters or stripped control characters are now rejected instead of being silently rewritten. - **Low — Incorrect relative-reference normalization** ([GHSA-xhq7-xmqj-769h](https://redirect.github.com/fastify/fast-uri/security/advisories/GHSA-xhq7-xmqj-769h), CVE-2026-110095): dot-segment removal now preserves the resolution semantics of relative references. - **Low — Scheme injection in suffix references** ([GHSA-333x-w4r6-6crp](https://redirect.github.com/fastify/fast-uri/security/advisories/GHSA-333x-w4r6-6crp), CVE-2026-110725): first-segment colons in path-only suffix references are now escaped so the output is not reparsed as a scheme. Upgrade with: ```sh npm install fast-uri@4.2.3 ``` Thanks to [@​zekth](https://redirect.github.com/zekth) for reporting the scheme, host, and relative-reference issues, and to [@​UlisesGascon](https://redirect.github.com/UlisesGascon) for finding the suffix-reference issue and reviewing the remediations. #### What's Changed - ci: allow prerelease bump types in the release workflow by [@​mcollina](https://redirect.github.com/mcollina) in [#​230](https://redirect.github.com/fastify/fast-uri/pull/230) **Full Changelog**: <https://github.com/fastify/fast-uri/compare/v4.2.2...v4.2.3> </details> --- ### Configuration 📅 **Schedule**: (UTC) - Branch creation - At any time (no schedule defined) - Automerge - At any time (no schedule defined) 🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied. ♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox. 🔕 **Ignore**: Close this PR and you won't be reminded about this update again. --- - [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check this box --- This PR was generated by [Mend Renovate](https://mend.io/renovate/). View the [repository job log](https://developer.mend.io/github/authelia/authelia). <!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0NC4xNzEuMiIsInVwZGF0ZWRJblZlciI6IjQ0LjE3MS4yIiwidGFyZ2V0QnJhbmNoIjoibWFzdGVyIiwibGFiZWxzIjpbImRlcGVuZGVuY2llcyIsImphdmFzY3JpcHQiXX0=--> Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com> |
||
|
renovate[bot]
|
ed776b2976 |
build(deps): update dependency baseline-browser-mapping to v2.11.30 (#13536)
This PR contains the following updates: | Package | Change | [Age](https://docs.renovatebot.com/merge-confidence/) | [Confidence](https://docs.renovatebot.com/merge-confidence/) | |---|---|---|---| | [baseline-browser-mapping](https://redirect.github.com/web-platform-dx/baseline-browser-mapping) | [`2.11.29` → `2.11.30`](https://renovatebot.com/diffs/npm/baseline-browser-mapping/2.11.29/2.11.30) |  |  | --- ### Release Notes <details> <summary>web-platform-dx/baseline-browser-mapping (baseline-browser-mapping)</summary> ### [`v2.11.30`](https://redirect.github.com/web-platform-dx/baseline-browser-mapping/compare/v2.11.29...v2.11.30) [Compare Source](https://redirect.github.com/web-platform-dx/baseline-browser-mapping/compare/v2.11.29...v2.11.30) </details> --- ### Configuration 📅 **Schedule**: (UTC) - Branch creation - At any time (no schedule defined) - Automerge - At any time (no schedule defined) 🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied. ♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox. 🔕 **Ignore**: Close this PR and you won't be reminded about this update again. --- - [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check this box --- This PR was generated by [Mend Renovate](https://mend.io/renovate/). View the [repository job log](https://developer.mend.io/github/authelia/authelia). <!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0NC4xNzEuMiIsInVwZGF0ZWRJblZlciI6IjQ0LjE3MS4yIiwidGFyZ2V0QnJhbmNoIjoibWFzdGVyIiwibGFiZWxzIjpbImRlcGVuZGVuY2llcyIsImphdmFzY3JpcHQiXX0=--> Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com> |
||
|
renovate[bot]
|
54cd7cb4c3 |
build(deps): update dependency @eslint-react/eslint-plugin to v5.28.2 (#13535)
This PR contains the following updates: | Package | Change | [Age](https://docs.renovatebot.com/merge-confidence/) | [Confidence](https://docs.renovatebot.com/merge-confidence/) | |---|---|---|---| | [@eslint-react/eslint-plugin](https://redirect.github.com/Rel1cx/eslint-react) ([source](https://redirect.github.com/Rel1cx/eslint-react/tree/HEAD/plugins/eslint-plugin)) | [`5.28.1` → `5.28.2`](https://renovatebot.com/diffs/npm/@eslint-react%2feslint-plugin/5.28.1/5.28.2) |  |  | --- ### Release Notes <details> <summary>Rel1cx/eslint-react (@​eslint-react/eslint-plugin)</summary> ### [`v5.28.2`](https://redirect.github.com/Rel1cx/eslint-react/blob/HEAD/CHANGELOG.md#v5282-2026-10-19) [Compare Source](https://redirect.github.com/Rel1cx/eslint-react/compare/v5.28.1...v5.28.2) ##### 🐞 Fixes - Website: fixed a build failure caused by an unquoted `: ` sequence in the YAML frontmatter description of the `react-x/use-memo` doc; the rule scaffold script now emits a YAML-safe quoted description so scaffolded rules cannot reintroduce the issue. ##### 📝 Documentation - Aligned the `react-debug/jsx` rule doc messages with the actual JSON report format. - Corrected the documented minimum ESLint version to `10.0.0` in the READMEs and getting-started guides. - Documented per-layer isolated testing in the fact-based rule implementation patterns guide. - Generalized the `isAPI`/`isAPICall` docs and updated the custom rule samples to use `is.APICall`. ([#​2059](https://redirect.github.com/Rel1cx/eslint-react/issues/2059)) ##### 🏗️ Internal - Added unit tests for the `react-x` immutability rule modules (`collect`, `effects`, `helpers`, `origins`). ([#​2056](https://redirect.github.com/Rel1cx/eslint-react/issues/2056)) - Bumped the `postcss` override to `8.5.31`. **Full Changelog**: <https://github.com/Rel1cx/eslint-react/compare/v5.28.1...v5.28.2> </details> --- ### Configuration 📅 **Schedule**: (UTC) - Branch creation - At any time (no schedule defined) - Automerge - At any time (no schedule defined) 🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied. ♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox. 🔕 **Ignore**: Close this PR and you won't be reminded about this update again. --- - [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check this box --- This PR was generated by [Mend Renovate](https://mend.io/renovate/). View the [repository job log](https://developer.mend.io/github/authelia/authelia). <!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0NC4xNzEuMiIsInVwZGF0ZWRJblZlciI6IjQ0LjE3MS4yIiwidGFyZ2V0QnJhbmNoIjoibWFzdGVyIiwibGFiZWxzIjpbImRlcGVuZGVuY2llcyIsImphdmFzY3JpcHQiXX0=--> Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com> |
||
|
renovate[bot]
|
15dfe2ee8c |
build(deps): update commitlint monorepo to v21.2.4 (#13534)
This PR contains the following updates: | Package | Change | [Age](https://docs.renovatebot.com/merge-confidence/) | [Confidence](https://docs.renovatebot.com/merge-confidence/) | |---|---|---|---| | [@commitlint/cli](https://commitlint.js.org/) ([source](https://redirect.github.com/conventional-changelog/commitlint/tree/HEAD/@commitlint/cli)) | [`21.2.3` → `21.2.4`](https://renovatebot.com/diffs/npm/@commitlint%2fcli/21.2.3/21.2.4) |  |  | | [@commitlint/config-conventional](https://commitlint.js.org/) ([source](https://redirect.github.com/conventional-changelog/commitlint/tree/HEAD/@commitlint/config-conventional)) | [`21.2.3` → `21.2.4`](https://renovatebot.com/diffs/npm/@commitlint%2fconfig-conventional/21.2.3/21.2.4) |  |  | --- ### Release Notes <details> <summary>conventional-changelog/commitlint (@​commitlint/cli)</summary> ### [`v21.2.4`](https://redirect.github.com/conventional-changelog/commitlint/blob/HEAD/@commitlint/cli/CHANGELOG.md#2124-2026-10-18) [Compare Source](https://redirect.github.com/conventional-changelog/commitlint/compare/v21.2.3...v21.2.4) **Note:** Version bump only for package [@​commitlint/cli](https://redirect.github.com/commitlint/cli) </details> <details> <summary>conventional-changelog/commitlint (@​commitlint/config-conventional)</summary> ### [`v21.2.4`](https://redirect.github.com/conventional-changelog/commitlint/blob/HEAD/@commitlint/config-conventional/CHANGELOG.md#2124-2026-10-18) [Compare Source](https://redirect.github.com/conventional-changelog/commitlint/compare/v21.2.3...v21.2.4) **Note:** Version bump only for package [@​commitlint/config-conventional](https://redirect.github.com/commitlint/config-conventional) </details> --- ### Configuration 📅 **Schedule**: (UTC) - Branch creation - At any time (no schedule defined) - Automerge - At any time (no schedule defined) 🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied. ♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox. 🔕 **Ignore**: Close this PR and you won't be reminded about these updates again. --- - [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check this box --- This PR was generated by [Mend Renovate](https://mend.io/renovate/). View the [repository job log](https://developer.mend.io/github/authelia/authelia). <!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0NC4xNzEuMiIsInVwZGF0ZWRJblZlciI6IjQ0LjE3MS4yIiwidGFyZ2V0QnJhbmNoIjoibWFzdGVyIiwibGFiZWxzIjpbImRlcGVuZGVuY2llcyIsImphdmFzY3JpcHQiXX0=--> Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com> |
||
|
renovate[bot]
|
478aa42424 |
build(deps): update caddy:2.11.7-builder docker digest to 8910fe6 (#13533)
This PR contains the following updates: | Package | Type | Update | Change | |---|---|---|---| | [caddy](https://hub.docker.com/_/caddy) ([source](https://redirect.github.com/caddyserver/caddy-docker)) | stage | digest | `a2535ba` → `8910fe6` | --- ### Configuration 📅 **Schedule**: (UTC) - Branch creation - At any time (no schedule defined) - Automerge - At any time (no schedule defined) 🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied. ♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox. 🔕 **Ignore**: Close this PR and you won't be reminded about this update again. --- - [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check this box --- This PR was generated by [Mend Renovate](https://mend.io/renovate/). View the [repository job log](https://developer.mend.io/github/authelia/authelia). <!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0NC4xNzEuMiIsInVwZGF0ZWRJblZlciI6IjQ0LjE3MS4yIiwidGFyZ2V0QnJhbmNoIjoibWFzdGVyIiwibGFiZWxzIjpbImRlcGVuZGVuY2llcyIsImRvY2tlciJdfQ==--> Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com> |
||
|
renovate[bot]
|
2cf29d4a07 |
build(deps): update authelia/base:latest docker digest to 8b758c7 (#13532)
This PR contains the following updates: | Package | Type | Update | Change | |---|---|---|---| | authelia/base | final | digest | `ad4e6b1` → `8b758c7` | --- ### Configuration 📅 **Schedule**: (UTC) - Branch creation - At any time (no schedule defined) - Automerge - At any time (no schedule defined) 🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied. ♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox. 🔕 **Ignore**: Close this PR and you won't be reminded about this update again. --- - [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check this box --- This PR was generated by [Mend Renovate](https://mend.io/renovate/). View the [repository job log](https://developer.mend.io/github/authelia/authelia). <!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0NC4xNzEuMiIsInVwZGF0ZWRJblZlciI6IjQ0LjE3MS4yIiwidGFyZ2V0QnJhbmNoIjoibWFzdGVyIiwibGFiZWxzIjpbImRlcGVuZGVuY2llcyIsImRvY2tlciJdfQ==--> Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com> |
||
|
renovate[bot]
|
0d13e79001 |
build(deps): update caddy:2.11.7-builder docker digest to a2535ba (#13530)
This PR contains the following updates: | Package | Type | Update | Change | |---|---|---|---| | [caddy](https://hub.docker.com/_/caddy) ([source](https://redirect.github.com/caddyserver/caddy-docker)) | stage | digest | `d842fac` → `a2535ba` | --- ### Configuration 📅 **Schedule**: (UTC) - Branch creation - At any time (no schedule defined) - Automerge - At any time (no schedule defined) 🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied. ♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox. 🔕 **Ignore**: Close this PR and you won't be reminded about this update again. --- - [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check this box --- This PR was generated by [Mend Renovate](https://mend.io/renovate/). View the [repository job log](https://developer.mend.io/github/authelia/authelia). <!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0NC4xNzEuMSIsInVwZGF0ZWRJblZlciI6IjQ0LjE3MS4xIiwidGFyZ2V0QnJhbmNoIjoibWFzdGVyIiwibGFiZWxzIjpbImRlcGVuZGVuY2llcyIsImRvY2tlciJdfQ==--> Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com> |
||
|
renovate[bot]
|
25b99c3382 |
build(deps): update authelia/base:latest docker digest to ad4e6b1 (#13529)
This PR contains the following updates: | Package | Type | Update | Change | |---|---|---|---| | authelia/base | final | digest | `404598a` → `ad4e6b1` | --- ### Configuration 📅 **Schedule**: (UTC) - Branch creation - At any time (no schedule defined) - Automerge - At any time (no schedule defined) 🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied. ♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox. 🔕 **Ignore**: Close this PR and you won't be reminded about this update again. --- - [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check this box --- This PR was generated by [Mend Renovate](https://mend.io/renovate/). View the [repository job log](https://developer.mend.io/github/authelia/authelia). <!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0NC4xNzEuMSIsInVwZGF0ZWRJblZlciI6IjQ0LjE3MS4xIiwidGFyZ2V0QnJhbmNoIjoibWFzdGVyIiwibGFiZWxzIjpbImRlcGVuZGVuY2llcyIsImRvY2tlciJdfQ==--> Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com> |
||
|
renovate[bot]
|
7f005fcd90 |
build(deps): update module github.com/valyala/fasthttp to v1.76.0 (#13526)
This PR contains the following updates: | Package | Change | [Age](https://docs.renovatebot.com/merge-confidence/) | [Confidence](https://docs.renovatebot.com/merge-confidence/) | |---|---|---|---| | [github.com/valyala/fasthttp](https://redirect.github.com/valyala/fasthttp) | `v1.75.0` → `v1.76.0` |  |  | --- ### Release Notes <details> <summary>valyala/fasthttp (github.com/valyala/fasthttp)</summary> ### [`v1.76.0`](https://redirect.github.com/valyala/fasthttp/releases/tag/v1.76.0) [Compare Source](https://redirect.github.com/valyala/fasthttp/compare/v1.75.0...v1.76.0) `v1.76.0` strengthens HTTP message framing, static-file isolation, and server connection handling. It also improves HTTP compatibility, avoids quadratic work when parsing large trailer sets, and adds configurable TCP keep-alives to `TCPDialer`. #### Security fixes and hardening - **Multipart parsing consumes the entire declared body.** Bytes after the closing multipart boundary are drained before the connection is reused, preventing a multipart epilogue from being interpreted as another request. [#​2336](https://redirect.github.com/valyala/fasthttp/pull/2336) - **Outgoing messages preserve framing.** Raw `Content-Length` headers are synchronized with the outgoing body, duplicate or conflicting framing headers are rejected, and fixed-length request and response streams cannot write beyond their declared size. `FS` and `SendFile` also stop at the advertised `Content-Length` when a file grows during serving. [#​2470](https://redirect.github.com/valyala/fasthttp/pull/2470), [#​2462](https://redirect.github.com/valyala/fasthttp/pull/2462) - **Requests with both `Content-Length` and `Transfer-Encoding` close the connection.** The connection is no longer reused after a request containing both framing headers. [#​2476](https://redirect.github.com/valyala/fasthttp/pull/2476) - **Virtual-host file serving preserves directory isolation.** `NewVHostPathRewriter` avoids decoding the host and path twice and handles invalid hosts safely, preventing crafted requests from escaping the virtual-host directory and accessing files directly under `FS.Root`. This affects `FS` handlers using `NewVHostPathRewriter`. [#​2487](https://redirect.github.com/valyala/fasthttp/pull/2487) - **Rejected TLS connections no longer block the accept loop.** Connections rejected by `MaxConnsPerIP` or `Concurrency` are closed without attempting an HTTP error response, which could otherwise trigger a TLS handshake and stall while waiting for a `ClientHello`. IPv6 clients are now also counted against `MaxConnsPerIP`. [#​2486](https://redirect.github.com/valyala/fasthttp/pull/2486), [#​2468](https://redirect.github.com/valyala/fasthttp/pull/2468) #### Performance improvements - **Trailer parsing avoids quadratic work.** Large sets of trailer names use indexed membership checks instead of repeatedly scanning all previously recorded names. This reduces CPU amplification from crafted `Trailer` headers and chunked trailer sections while preserving trailer order. [#​2465](https://redirect.github.com/valyala/fasthttp/pull/2465) #### HTTP compatibility and features - **Static files handle range and conditional requests more accurately.** Unsupported range units and multiple ranges are ignored instead of returning `416`; invalid single byte ranges still return `416`. `Range` is also ignored when `If-Range` does not match, and both `Range` and `If-Modified-Since` are ignored for methods other than GET and HEAD. [#​2467](https://redirect.github.com/valyala/fasthttp/pull/2467), [#​2473](https://redirect.github.com/valyala/fasthttp/pull/2473), [#​2474](https://redirect.github.com/valyala/fasthttp/pull/2474), [#​2475](https://redirect.github.com/valyala/fasthttp/pull/2475) - **Pipeline clients handle HEAD responses without reading a body.** `PipelineClient` skips the response body for HEAD requests. [#​2469](https://redirect.github.com/valyala/fasthttp/pull/2469) - **HTTP parsing accepts valid legacy formats and matches tokens correctly.** `ParseHTTPDate` accepts obsolete HTTP-date formats, cookies with an invalid `Expires` attribute remain parseable, `Expect: 100-continue` is matched case-insensitively, and `Accept-Encoding` matches complete tokens. Asterisk-form request targets are rejected for methods other than OPTIONS. [#​2466](https://redirect.github.com/valyala/fasthttp/pull/2466), [#​2481](https://redirect.github.com/valyala/fasthttp/pull/2481), [#​2482](https://redirect.github.com/valyala/fasthttp/pull/2482), [#​2479](https://redirect.github.com/valyala/fasthttp/pull/2479), [#​2463](https://redirect.github.com/valyala/fasthttp/pull/2463) - **TCP keep-alives are configurable.** The new `TCPDialer.KeepAlive` field sets the keep-alive period for connections created by the dialer; a negative value disables keep-alives. [#​2484](https://redirect.github.com/valyala/fasthttp/pull/2484) #### What's Changed ##### Security and hardening - consume the rest of the declared body in readMultipartForm by [@​alhudz](https://redirect.github.com/alhudz) in [#​2336](https://redirect.github.com/valyala/fasthttp/pull/2336) - fix: validate outgoing request framing by [@​erikdubbelboer](https://redirect.github.com/erikdubbelboer) in [#​2470](https://redirect.github.com/valyala/fasthttp/pull/2470) - stop FS and SendFile at Content-Length when the file has grown by [@​alhudz](https://redirect.github.com/alhudz) in [#​2462](https://redirect.github.com/valyala/fasthttp/pull/2462) - fix: close the connection after a request with both Content-Length and Transfer-Encoding by [@​LuisFigueroaG](https://redirect.github.com/LuisFigueroaG) in [#​2476](https://redirect.github.com/valyala/fasthttp/pull/2476) - fix(fs): preserve vhost isolation during path rewriting by [@​koyokr](https://redirect.github.com/koyokr) in [#​2487](https://redirect.github.com/valyala/fasthttp/pull/2487) - Fix TLS connection rejection blocking the accept loop by [@​erikdubbelboer](https://redirect.github.com/erikdubbelboer) in [#​2486](https://redirect.github.com/valyala/fasthttp/pull/2486) - count IPv6 clients against MaxConnsPerIP by [@​alhudz](https://redirect.github.com/alhudz) in [#​2468](https://redirect.github.com/valyala/fasthttp/pull/2468) ##### Performance - make addTrailerKey linear in the size of the trailer set by [@​alhudz](https://redirect.github.com/alhudz) in [#​2465](https://redirect.github.com/valyala/fasthttp/pull/2465) ##### Features - feat: add KeepAlive option to TCPDialer by [@​littfed](https://redirect.github.com/littfed) in [#​2484](https://redirect.github.com/valyala/fasthttp/pull/2484) ##### Fixes - fix(header): reject asterisk-form request-target for non-OPTIONS methods by [@​aadieng100](https://redirect.github.com/aadieng100) in [#​2463](https://redirect.github.com/valyala/fasthttp/pull/2463) - fix: accept the obsolete HTTP-date formats in ParseHTTPDate by [@​LuisFigueroaG](https://redirect.github.com/LuisFigueroaG) in [#​2466](https://redirect.github.com/valyala/fasthttp/pull/2466) - fix(fs): ignore Range headers FS can't serve instead of replying 416 by [@​LuisFigueroaG](https://redirect.github.com/LuisFigueroaG) in [#​2467](https://redirect.github.com/valyala/fasthttp/pull/2467) - skip the response body for HEAD requests in PipelineClient by [@​alhudz](https://redirect.github.com/alhudz) in [#​2469](https://redirect.github.com/valyala/fasthttp/pull/2469) - fix(fs): ignore If-Modified-Since for methods other than GET and HEAD by [@​LuisFigueroaG](https://redirect.github.com/LuisFigueroaG) in [#​2474](https://redirect.github.com/valyala/fasthttp/pull/2474) - fix(fs): ignore Range when the If-Range validator doesn't match by [@​LuisFigueroaG](https://redirect.github.com/LuisFigueroaG) in [#​2473](https://redirect.github.com/valyala/fasthttp/pull/2473) - fix(fs): ignore Range for methods other than GET and HEAD by [@​LuisFigueroaG](https://redirect.github.com/LuisFigueroaG) in [#​2475](https://redirect.github.com/valyala/fasthttp/pull/2475) - fix(cookie): ignore an invalid Expires attribute instead of failing to parse by [@​LuisFigueroaG](https://redirect.github.com/LuisFigueroaG) in [#​2481](https://redirect.github.com/valyala/fasthttp/pull/2481) - fix: match the Expect: 100-continue value case-insensitively by [@​LuisFigueroaG](https://redirect.github.com/LuisFigueroaG) in [#​2482](https://redirect.github.com/valyala/fasthttp/pull/2482) - fix: match complete Accept-Encoding tokens by [@​jabrailkhalil](https://redirect.github.com/jabrailkhalil) in [#​2479](https://redirect.github.com/valyala/fasthttp/pull/2479) ##### Documentation - docs: clarify RequestURI host behavior by [@​oozan](https://redirect.github.com/oozan) in [#​2355](https://redirect.github.com/valyala/fasthttp/pull/2355) ##### Dependency updates - chore(deps): bump github.com/molecule-man/go-brrr from 1.1.1 to 1.2.0 by [@​dependabot](https://redirect.github.com/dependabot)\[bot] in [#​2464](https://redirect.github.com/valyala/fasthttp/pull/2464) - chore(deps): bump github.com/molecule-man/go-brrr from 1.2.0 to 1.3.0 by [@​dependabot](https://redirect.github.com/dependabot)\[bot] in [#​2483](https://redirect.github.com/valyala/fasthttp/pull/2483) - chore(deps): bump golang.org/x/sys from 0.48.0 to 0.49.0 by [@​dependabot](https://redirect.github.com/dependabot)\[bot] in [#​2477](https://redirect.github.com/valyala/fasthttp/pull/2477) - chore(deps): bump golang.org/x/net from 0.59.0 to 0.61.0 by [@​dependabot](https://redirect.github.com/dependabot)\[bot] in [#​2478](https://redirect.github.com/valyala/fasthttp/pull/2478) - chore(deps): bump github.com/klauspost/compress from 1.20.1 to 1.20.3 by [@​dependabot](https://redirect.github.com/dependabot)\[bot] in [#​2485](https://redirect.github.com/valyala/fasthttp/pull/2485) #### New Contributors - [@​aadieng100](https://redirect.github.com/aadieng100) made their first contribution in [#​2463](https://redirect.github.com/valyala/fasthttp/pull/2463) - [@​LuisFigueroaG](https://redirect.github.com/LuisFigueroaG) made their first contribution in [#​2466](https://redirect.github.com/valyala/fasthttp/pull/2466) - [@​oozan](https://redirect.github.com/oozan) made their first contribution in [#​2355](https://redirect.github.com/valyala/fasthttp/pull/2355) - [@​jabrailkhalil](https://redirect.github.com/jabrailkhalil) made their first contribution in [#​2479](https://redirect.github.com/valyala/fasthttp/pull/2479) - [@​koyokr](https://redirect.github.com/koyokr) made their first contribution in [#​2487](https://redirect.github.com/valyala/fasthttp/pull/2487) **Full Changelog**: <https://github.com/valyala/fasthttp/compare/v1.75.0...v1.76.0> </details> --- ### Configuration 📅 **Schedule**: (UTC) - Branch creation - At any time (no schedule defined) - Automerge - At any time (no schedule defined) 🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied. ♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox. 🔕 **Ignore**: Close this PR and you won't be reminded about this update again. --- - [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check this box --- This PR was generated by [Mend Renovate](https://mend.io/renovate/). View the [repository job log](https://developer.mend.io/github/authelia/authelia). <!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0NC4xNjQuMSIsInVwZGF0ZWRJblZlciI6IjQ0LjE2NC4xIiwidGFyZ2V0QnJhbmNoIjoibWFzdGVyIiwibGFiZWxzIjpbImRlcGVuZGVuY2llcyIsImdvIl19--> Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com> |
||
|
renovate[bot]
|
cba3340141 |
build(deps): update dependency react-i18next to v17.1.0 (#13525)
This PR contains the following updates: | Package | Change | [Age](https://docs.renovatebot.com/merge-confidence/) | [Confidence](https://docs.renovatebot.com/merge-confidence/) | |---|---|---|---| | [react-i18next](https://redirect.github.com/i18next/react-i18next) | [`17.0.21` → `17.1.0`](https://renovatebot.com/diffs/npm/react-i18next/17.0.21/17.1.0) |  |  | --- ### Release Notes <details> <summary>i18next/react-i18next (react-i18next)</summary> ### [`v17.1.0`](https://redirect.github.com/i18next/react-i18next/blob/HEAD/CHANGELOG.md#1710) [Compare Source](https://redirect.github.com/i18next/react-i18next/compare/v17.0.21...v17.1.0) - feat(types): with i18next's new `parseInterpolation: 'icu'` (or `'mf2'`) type option (i18next v26.5.0), the `values` of `IcuTrans` and `IcuTransWithoutContext` are typed from the message of `i18nKey`, like the options of `t()`: a misspelled argument, a value of the wrong type or a value meant for another key is a type error. `values` was `Record<string, any>` before, and still is with any other `parseInterpolation` setting. `values` stays optional, as on `Trans`. `useTranslation`'s `t` and `Trans` `values` get the checks from i18next's types without changes here. - fix(types): `IcuTrans` and `IcuTransWithoutContext` now infer the literal `i18nKey` (`const` type parameter, as `Trans` does), so props that depend on the key are checked against that key instead of all keys of the namespace. </details> --- ### Configuration 📅 **Schedule**: (UTC) - Branch creation - At any time (no schedule defined) - Automerge - At any time (no schedule defined) 🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied. ♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox. 🔕 **Ignore**: Close this PR and you won't be reminded about this update again. --- - [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check this box --- This PR was generated by [Mend Renovate](https://mend.io/renovate/). View the [repository job log](https://developer.mend.io/github/authelia/authelia). <!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0NC4xNjQuMSIsInVwZGF0ZWRJblZlciI6IjQ0LjE2NC4xIiwidGFyZ2V0QnJhbmNoIjoibWFzdGVyIiwibGFiZWxzIjpbImRlcGVuZGVuY2llcyIsImphdmFzY3JpcHQiXX0=--> Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com> |
||
|
renovate[bot]
|
e14db7d79c |
build(deps): update dependency i18next to v26.5.2 (#13524)
This PR contains the following updates: | Package | Change | [Age](https://docs.renovatebot.com/merge-confidence/) | [Confidence](https://docs.renovatebot.com/merge-confidence/) | |---|---|---|---| | [i18next](https://www.i18next.com) ([source](https://redirect.github.com/i18next/i18next)) | [`26.4.7` → `26.5.2`](https://renovatebot.com/diffs/npm/i18next/26.4.7/26.5.2) |  |  | --- ### Release Notes <details> <summary>i18next/i18next (i18next)</summary> ### [`v26.5.2`](https://redirect.github.com/i18next/i18next/blob/HEAD/CHANGELOG.md#2652) [Compare Source](https://redirect.github.com/i18next/i18next/compare/v26.5.1...v26.5.2) - fix(types): on TypeScript 7, a `t()` call with a missing, misspelled or wrongly typed option now reports that option again (`Property 'album' is missing`, `Type 'string' is not assignable to type 'number'`), as TypeScript 5 and 6 do. TypeScript 7 elaborated the error against the default-value signature instead and ended in `'{ count: 3; albm: "Summer"; }' is not assignable to type 'string'`: on a failed call TypeScript explains the last of the equally matching signatures, and TypeScript 7 sorts the 3-element `[key, defaultValue, options?]` last. It is now written as two signatures, `[key, defaultValue]` and `[key, defaultValue, options]`. This affects the default key checks with i18next `{{name}}` messages as well as `parseInterpolation: 'icu'` and `'mf2'`. Which calls compile, their return types and the error positions are unchanged on TypeScript 5.9, 6 and 7. ### [`v26.5.1`](https://redirect.github.com/i18next/i18next/blob/HEAD/CHANGELOG.md#2651) [Compare Source](https://redirect.github.com/i18next/i18next/compare/v26.5.0...v26.5.1) - perf(types): type-checking `t()` calls against a large namespace is no longer quadratic in the number of keys. TypeScript does not cache `keyof` of an object type, and the types rebuilt the union of all keys of a namespace once per key while building the key union, and again in every `t()` call to look up the return type. Both now use a cached key union, and a literal key is looked up directly instead of being intersected with every key. With 5,000 keys in one namespace and one call per key, the check time went from 14.8s to 1.1s (TypeScript 6); with 1,000 keys from 0.75s to 0.27s. Keys, return types and errors are unchanged. - perf(types): the selector API (`enableSelector: true` / `'strict'`) with `context` is no longer quadratic in the size of an object. To decide which keys a context keeps, the types scanned all keys of the object once for every key, also when TypeScript checks the selector with `context` widened to `string`. With 1,000 keys plus one context variant each, a namespace took 18.7s and failed with "Type instantiation is excessively deep and possibly infinite" (TS2589); 2,500 and more ran out of memory. The context variants of an object are now collected once, in one pass over its keys: 1,000 keys check in 0.69s, 5,000 in 3.1s. Long keys (whole sentences with `keySeparator: false`) work as before. Selected values and errors are unchanged. ### [`v26.5.0`](https://redirect.github.com/i18next/i18next/blob/HEAD/CHANGELOG.md#2650) [Compare Source](https://redirect.github.com/i18next/i18next/compare/v26.4.7...v26.5.0) - feat(types): `parseInterpolation: 'icu'` and `parseInterpolation: 'mf2'` type `t()` options from the message's ICU MessageFormat arguments (i18next-icu) or MessageFormat 2 variables (i18next-mf2), so ICU and MF2 users no longer need `parseInterpolation: false` and lose argument checking. Missing, misspelled and wrongly typed arguments fail, and so does leaving out the options for a message with arguments (`t('greeting')`); that error names the missing arguments. Opt-in, default `true` is unchanged. - ICU: `{name}` takes `string | number`, `{n, number}`, `plural` and `selectordinal` take `number`, `{d, date}` and `{t, time}` take `Date`, `select` takes its case keys or any string (for `other`), and arguments nested in cases are required too. `#` and tags are not arguments, apostrophe quoting is read like intl-messageformat does. - MF2: `{$name}` takes `string | number`, a variable annotated with `:number`, `:integer`, `:currency`, `:percent` or `:unit` (inline or through `.input` / `.local`) takes `number`, `:datetime`, `:date` and `:time` take `Date`, `:string` takes `string`, option and markup variables (`minimumFractionDigits=$digits`, `{#link href=$url}`) are required too, `.local` variables are not arguments, and `|quoted literals|` and `\{` escapes are skipped. - `interpolationFormatTypeMap` overrides a type by ICU format or MF2 function name, e.g. `date: Date | number` or a custom `uppercase: string`. - Applies to `t()`, `getFixedT()`, `i18n.t`, key prefixes, namespaces, the selector API and react-i18next's `Trans` `values`. Messages need literal types, as the resources file from i18next-cli's `types` command has them. - Type-check cost with 1,000 messages and one call each: 1.35s instead of 0.86s with `false` (TypeScript 6), 0.5s instead of 0.26s with TypeScript 7. Messages that no call uses cost nothing. - fix(types): with the default (non-strict) key checks, an options object with a missing or misspelled interpolation variable now reports the missing variable (`Property 'name' is missing`) instead of `'{ nmae: string }' is not assignable to type 'string'` from the default-value overload. </details> --- ### Configuration 📅 **Schedule**: (UTC) - Branch creation - At any time (no schedule defined) - Automerge - At any time (no schedule defined) 🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied. ♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox. 🔕 **Ignore**: Close this PR and you won't be reminded about this update again. --- - [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check this box --- This PR was generated by [Mend Renovate](https://mend.io/renovate/). View the [repository job log](https://developer.mend.io/github/authelia/authelia). <!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0NC4xNjQuMSIsInVwZGF0ZWRJblZlciI6IjQ0LjE2NC4xIiwidGFyZ2V0QnJhbmNoIjoibWFzdGVyIiwibGFiZWxzIjpbImRlcGVuZGVuY2llcyIsImphdmFzY3JpcHQiXX0=--> Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com> |
||
|
renovate[bot]
|
6c707c5098 |
build(deps): update dependency @eslint-react/eslint-plugin to v5.28.1 (#13521)
This PR contains the following updates: | Package | Change | [Age](https://docs.renovatebot.com/merge-confidence/) | [Confidence](https://docs.renovatebot.com/merge-confidence/) | |---|---|---|---| | [@eslint-react/eslint-plugin](https://redirect.github.com/Rel1cx/eslint-react) ([source](https://redirect.github.com/Rel1cx/eslint-react/tree/HEAD/plugins/eslint-plugin)) | [`5.28.0` → `5.28.1`](https://renovatebot.com/diffs/npm/@eslint-react%2feslint-plugin/5.28.0/5.28.1) |  |  | --- ### Release Notes <details> <summary>Rel1cx/eslint-react (@​eslint-react/eslint-plugin)</summary> ### [`v5.28.1`](https://redirect.github.com/Rel1cx/eslint-react/blob/HEAD/CHANGELOG.md#v5281-2026-10-17) [Compare Source](https://redirect.github.com/Rel1cx/eslint-react/compare/v5.28.0...v5.28.1) ##### 🐞 Fixes - `react-dom/no-unknown-property`: fixed a false positive where the React camelCase SVG prop `renderingIntent` was reported as an unknown property, including on code produced by this rule's own autofix for `rendering-intent`. ([#​2055](https://redirect.github.com/Rel1cx/eslint-react/issues/2055)) - `react-jsx/no-useless-fragment`: the auto-fixer no longer unwraps fragments outside JSX whose children are all whitespace (ex: `const x = <> </>;` or `return <>\n</>` with `allowExpressions: false`); the previous fix produced syntactically invalid JavaScript such as `const x = ;`. These fragments are still reported, just without a fix. ([#​2055](https://redirect.github.com/Rel1cx/eslint-react/issues/2055)) ##### 📝 Documentation - Aligned rule docs, comments, and diagnostic messages with actual behavior across the plugins. ([#​2055](https://redirect.github.com/Rel1cx/eslint-react/issues/2055)) ##### 🏗️ Internal - Bumped `eslint` to `10.13.0`, `pnpm` to `12.14.0`, `tsl-dx` to `0.15.0`, `@effect/language-service` to `0.87.5`, and `lucide-react` to `1.59.0`. - Added a TanStack Start example project. **Full Changelog**: <https://github.com/Rel1cx/eslint-react/compare/v5.28.0...v5.28.1> </details> --- ### Configuration 📅 **Schedule**: (UTC) - Branch creation - At any time (no schedule defined) - Automerge - At any time (no schedule defined) 🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied. ♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox. 🔕 **Ignore**: Close this PR and you won't be reminded about this update again. --- - [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check this box --- This PR was generated by [Mend Renovate](https://mend.io/renovate/). View the [repository job log](https://developer.mend.io/github/authelia/authelia). <!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0NC4xNjQuMSIsInVwZGF0ZWRJblZlciI6IjQ0LjE2NC4xIiwidGFyZ2V0QnJhbmNoIjoibWFzdGVyIiwibGFiZWxzIjpbImRlcGVuZGVuY2llcyIsImphdmFzY3JpcHQiXX0=--> Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com> |
||
|
renovate[bot]
|
4c60c7f972 |
build(deps): update dependency i18next-http-backend to v4.0.4 (#13522)
This PR contains the following updates: | Package | Change | [Age](https://docs.renovatebot.com/merge-confidence/) | [Confidence](https://docs.renovatebot.com/merge-confidence/) | |---|---|---|---| | [i18next-http-backend](https://redirect.github.com/i18next/i18next-http-backend) | [`4.0.3` → `4.0.4`](https://renovatebot.com/diffs/npm/i18next-http-backend/4.0.3/4.0.4) |  |  | --- ### Release Notes <details> <summary>i18next/i18next-http-backend (i18next-http-backend)</summary> ### [`v4.0.4`](https://redirect.github.com/i18next/i18next-http-backend/blob/HEAD/CHANGELOG.md#404) [Compare Source](https://redirect.github.com/i18next/i18next-http-backend/compare/v4.0.3...v4.0.4) Security release. See advisory [GHSA-3cmx-xjww-583x](https://redirect.github.com/i18next/i18next-http-backend/security/advisories/GHSA-3cmx-xjww-583x). - security: also reject `&`, `=` and `;` in `lng` and `ns` values. With a query-shaped `loadPath` / `addPath` template such as `/locales/resources.json?lng={{lng}}&ns={{ns}}` (the multiload shape the README documents), a value like `de&ns=private&admin=true` added or overrode query parameters on the request (HTTP parameter pollution). The 3.0.5 fix only rejected `?`, which covers the path position. The default `/locales/{{lng}}/{{ns}}.json` and other path-only templates were not affected. No language code or usable namespace name contains these characters, and `+`-joined multiload values such as `de+en` keep working. </details> --- ### Configuration 📅 **Schedule**: (UTC) - Branch creation - At any time (no schedule defined) - Automerge - At any time (no schedule defined) 🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied. ♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox. 🔕 **Ignore**: Close this PR and you won't be reminded about this update again. --- - [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check this box --- This PR was generated by [Mend Renovate](https://mend.io/renovate/). View the [repository job log](https://developer.mend.io/github/authelia/authelia). <!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0NC4xNjQuMSIsInVwZGF0ZWRJblZlciI6IjQ0LjE2NC4xIiwidGFyZ2V0QnJhbmNoIjoibWFzdGVyIiwibGFiZWxzIjpbImRlcGVuZGVuY2llcyIsImphdmFzY3JpcHQiXX0=--> Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com> |
||
|
renovate[bot]
|
6e71c39b6c |
build(deps): update dependency react-i18next to v17.0.21 (#13523)
This PR contains the following updates: | Package | Change | [Age](https://docs.renovatebot.com/merge-confidence/) | [Confidence](https://docs.renovatebot.com/merge-confidence/) | |---|---|---|---| | [react-i18next](https://redirect.github.com/i18next/react-i18next) | [`17.0.20` → `17.0.21`](https://renovatebot.com/diffs/npm/react-i18next/17.0.20/17.0.21) |  |  | --- ### Release Notes <details> <summary>i18next/react-i18next (react-i18next)</summary> ### [`v17.0.21`](https://redirect.github.com/i18next/react-i18next/blob/HEAD/CHANGELOG.md#17021) [Compare Source](https://redirect.github.com/i18next/react-i18next/compare/v17.0.20...v17.0.21) - fix(IcuTrans): explicit `values` now win over `interpolation.defaultVariables`, as they do in `t()`. `IcuTrans` merged them the other way round, so `<IcuTrans values={{ user: 'John Doe' }} />` rendered the configured default variable `user` instead of `John Doe`. `Trans` had the same inverted merge and is fixed too. Compatibility note: only names that are set both in `values` and in `defaultVariables` render differently. - feat: new entry point `react-i18next/IcuTransWithoutContext` (with types) for React Server Components. Importing `IcuTransWithoutContext` from `react-i18next` in a Server Component could fail the build with `createContext is not a function`, because the main entry creates the React context when it is loaded. Like `react-i18next/TransWithoutContext`, the new entry point does not. - fix(build): the ESM build's `dist/es/package.json` now declares `"sideEffects": false`, like the root `package.json` already did. Bundlers use the nearest `package.json`, so the ESM build counted as having side effects and unused exports were kept: an app that only uses `Trans` still bundled `IcuTrans` with its HTML entity decoder, `useTranslation` and `use-sync-external-store`. With esbuild, a `Trans`-only bundle (React and i18next external) goes from 20.9 KB to 11.6 KB minified, 8.3 KB to 5.0 KB gzipped. - docs: the `icu.macro` Babel macro is now marked as deprecated in favour of using `IcuTrans` directly. It fails on Babel 8 (`t.jSXIdentifier is not a function`), `<Plural count={count}>` renders the raw ICU message, and a React `key` on `<Plural>`/`<Select>` becomes an ICU case. It keeps working on Babel 7 and is not removed. The `IcuTrans` docs page has a corrected example and props table and covers Server Components. </details> --- ### Configuration 📅 **Schedule**: (UTC) - Branch creation - At any time (no schedule defined) - Automerge - At any time (no schedule defined) 🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied. ♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox. 🔕 **Ignore**: Close this PR and you won't be reminded about this update again. --- - [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check this box --- This PR was generated by [Mend Renovate](https://mend.io/renovate/). View the [repository job log](https://developer.mend.io/github/authelia/authelia). <!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0NC4xNjQuMSIsInVwZGF0ZWRJblZlciI6IjQ0LjE2NC4xIiwidGFyZ2V0QnJhbmNoIjoibWFzdGVyIiwibGFiZWxzIjpbImRlcGVuZGVuY2llcyIsImphdmFzY3JpcHQiXX0=--> Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com> |
||
|
renovate[bot]
|
cda122b2c0 |
build(deps): update authelia/base:latest docker digest to 404598a (#13520)
This PR contains the following updates: | Package | Type | Update | Change | |---|---|---|---| | authelia/base | final | digest | `bfbb14f` → `404598a` | --- ### Configuration 📅 **Schedule**: (UTC) - Branch creation - At any time (no schedule defined) - Automerge - At any time (no schedule defined) 🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied. ♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox. 🔕 **Ignore**: Close this PR and you won't be reminded about this update again. --- - [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check this box --- This PR was generated by [Mend Renovate](https://mend.io/renovate/). View the [repository job log](https://developer.mend.io/github/authelia/authelia). <!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0NC4xNjQuMSIsInVwZGF0ZWRJblZlciI6IjQ0LjE2NC4xIiwidGFyZ2V0QnJhbmNoIjoibWFzdGVyIiwibGFiZWxzIjpbImRlcGVuZGVuY2llcyIsImRvY2tlciJdfQ==--> Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com> |
||
|
renovate[bot]andAmir Zarrinkafsh
|
7844791b81 |
build(deps): update react-email monorepo to v6.11.3 (#13514)
This PR contains the following updates: | Package | Change | [Age](https://docs.renovatebot.com/merge-confidence/) | [Confidence](https://docs.renovatebot.com/merge-confidence/) | |---|---|---|---| | [@react-email/ui](https://redirect.github.com/resend/react-email) ([source](https://redirect.github.com/resend/react-email/tree/HEAD/packages/ui)) | [`6.11.2` → `6.11.3`](https://renovatebot.com/diffs/npm/@react-email%2fui/6.11.2/6.11.3) |  |  | | [react-email](https://redirect.github.com/resend/react-email) ([source](https://redirect.github.com/resend/react-email/tree/HEAD/packages/react-email)) | [`6.11.2` → `6.11.3`](https://renovatebot.com/diffs/npm/react-email/6.11.2/6.11.3) |  |  | --- ### Release Notes <details> <summary>resend/react-email (@​react-email/ui)</summary> ### [`v6.11.3`](https://redirect.github.com/resend/react-email/blob/HEAD/packages/ui/CHANGELOG.md#6113) [Compare Source](https://redirect.github.com/resend/react-email/compare/@react-email/ui@6.11.2...@react-email/ui@6.11.3) ##### Patch Changes - [`88562d0`](https://redirect.github.com/resend/react-email/commit/88562d0): The compatibility check now applies `--esbuild-plugins` when it bundles a template that passes `config`, `theme` or `utility` to `<Tailwind>`, so templates whose imports need a plugin no longer log a build error. - [`7f545c6`](https://redirect.github.com/resend/react-email/commit/7f545c6): Bump `next` to 16.4.1 so the prebuilt preview server works in projects on Next.js 16.4. Next 16.4 loads a `server/preview-props.json` manifest that a 16.3 build doesn't emit, so `email dev` failed with `ENOENT` when `next` was deduped to 16.4. </details> <details> <summary>resend/react-email (react-email)</summary> ### [`v6.11.3`](https://redirect.github.com/resend/react-email/blob/HEAD/packages/react-email/CHANGELOG.md#6113) [Compare Source](https://redirect.github.com/resend/react-email/compare/react-email@6.11.2...react-email@6.11.3) ##### Patch Changes - Updated dependencies \[[`f356e81`](https://redirect.github.com/resend/react-email/commit/f356e81)] - [@​react-email/render](https://redirect.github.com/react-email/render)@2.1.1 </details> --- ### Configuration 📅 **Schedule**: (UTC) - Branch creation - At any time (no schedule defined) - Automerge - At any time (no schedule defined) 🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied. ♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox. 🔕 **Ignore**: Close this PR and you won't be reminded about these updates again. --- - [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check this box --- This PR was generated by [Mend Renovate](https://mend.io/renovate/). View the [repository job log](https://developer.mend.io/github/authelia/authelia). <!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0NC4xNjQuMSIsInVwZGF0ZWRJblZlciI6IjQ0LjE2NC4xIiwidGFyZ2V0QnJhbmNoIjoibWFzdGVyIiwibGFiZWxzIjpbImRlcGVuZGVuY2llcyIsImphdmFzY3JpcHQiXX0=--> --------- Signed-off-by: Amir Zarrinkafsh <3339418+nightah@users.noreply.github.com> Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com> Co-authored-by: Amir Zarrinkafsh <3339418+nightah@users.noreply.github.com> |
||
|
renovate[bot]
|
eeb3f1deef |
build(deps): update module github.com/knadh/koanf/v2 to v2.4.1 (#13517)
This PR contains the following updates: | Package | Change | [Age](https://docs.renovatebot.com/merge-confidence/) | [Confidence](https://docs.renovatebot.com/merge-confidence/) | |---|---|---|---| | [github.com/knadh/koanf/v2](https://redirect.github.com/knadh/koanf) | `v2.4.0` → `v2.4.1` |  |  | --- ### Release Notes <details> <summary>knadh/koanf (github.com/knadh/koanf/v2)</summary> ### [`v2.4.1`](https://redirect.github.com/knadh/koanf/releases/tag/v2.4.1) [Compare Source](https://redirect.github.com/knadh/koanf/compare/v2.4.0...v2.4.1) #### What's Changed - Fix HCL flattenSlices skipping blocks inside repeated blocks by [@​ybai08](https://redirect.github.com/ybai08) in [#​458](https://redirect.github.com/knadh/koanf/pull/458) - Fix k8smount dropping keys mounted at nested paths by [@​ybai08](https://redirect.github.com/ybai08) in [#​457](https://redirect.github.com/knadh/koanf/pull/457) - Fix duration unmarshalling from defined string types by [@​sagar5412](https://redirect.github.com/sagar5412) in [#​459](https://redirect.github.com/knadh/koanf/pull/459) #### New Contributors - [@​ybai08](https://redirect.github.com/ybai08) made their first contribution in [#​458](https://redirect.github.com/knadh/koanf/pull/458) - [@​sagar5412](https://redirect.github.com/sagar5412) made their first contribution in [#​459](https://redirect.github.com/knadh/koanf/pull/459) **Full Changelog**: <https://github.com/knadh/koanf/compare/v2.4.0...v2.4.1> </details> --- ### Configuration 📅 **Schedule**: (UTC) - Branch creation - At any time (no schedule defined) - Automerge - At any time (no schedule defined) 🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied. ♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox. 🔕 **Ignore**: Close this PR and you won't be reminded about this update again. --- - [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check this box --- This PR was generated by [Mend Renovate](https://mend.io/renovate/). View the [repository job log](https://developer.mend.io/github/authelia/authelia). <!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0NC4xNjQuMSIsInVwZGF0ZWRJblZlciI6IjQ0LjE2NC4xIiwidGFyZ2V0QnJhbmNoIjoibWFzdGVyIiwibGFiZWxzIjpbImRlcGVuZGVuY2llcyIsImdvIl19--> Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com> |
||
|
renovate[bot]
|
11141f75c7 |
build(deps): update dependency lucide-react to v1.59.0 (#13518)
This PR contains the following updates: | Package | Change | [Age](https://docs.renovatebot.com/merge-confidence/) | [Confidence](https://docs.renovatebot.com/merge-confidence/) | |---|---|---|---| | [lucide-react](https://lucide.dev) ([source](https://redirect.github.com/lucide-icons/lucide/tree/HEAD/packages/lucide-react)) | [`1.58.0` → `1.59.0`](https://renovatebot.com/diffs/npm/lucide-react/1.58.0/1.59.0) |  |  | --- ### Release Notes <details> <summary>lucide-icons/lucide (lucide-react)</summary> ### [`v1.59.0`](https://redirect.github.com/lucide-icons/lucide/releases/tag/1.59.0): Version 1.59.0 [Compare Source](https://redirect.github.com/lucide-icons/lucide/compare/1.58.0...1.59.0) #### What's Changed - feat(docs): Adds search field to docs pages by [@​ericfennis](https://redirect.github.com/ericfennis) in [#​5012](https://redirect.github.com/lucide-icons/lucide/pull/5012) - fix(icons): changed `chess-queen` icon by [@​karsa-mistmere](https://redirect.github.com/karsa-mistmere) in [#​4613](https://redirect.github.com/lucide-icons/lucide/pull/4613) **Full Changelog**: <https://github.com/lucide-icons/lucide/compare/1.58.0...1.59.0> </details> --- ### Configuration 📅 **Schedule**: (UTC) - Branch creation - At any time (no schedule defined) - Automerge - At any time (no schedule defined) 🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied. ♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox. 🔕 **Ignore**: Close this PR and you won't be reminded about this update again. --- - [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check this box --- This PR was generated by [Mend Renovate](https://mend.io/renovate/). View the [repository job log](https://developer.mend.io/github/authelia/authelia). <!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0NC4xNjQuMSIsInVwZGF0ZWRJblZlciI6IjQ0LjE2NC4xIiwidGFyZ2V0QnJhbmNoIjoibWFzdGVyIiwibGFiZWxzIjpbImRlcGVuZGVuY2llcyIsImphdmFzY3JpcHQiXX0=--> Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com> |
||
|
renovate[bot]
|
df98259d90 |
build(deps): update dependency cn to v0.5.0 (#13515)
This PR contains the following updates: | Package | Change | [Age](https://docs.renovatebot.com/merge-confidence/) | [Confidence](https://docs.renovatebot.com/merge-confidence/) | |---|---|---|---| | [cn](https://redirect.github.com/shadcn-ui/cn) ([source](https://redirect.github.com/shadcn-ui/cn/tree/HEAD/packages/cn)) | [`0.4.0` → `0.5.0`](https://renovatebot.com/diffs/npm/cn/0.4.0/0.5.0) |  |  | --- ### Release Notes <details> <summary>shadcn-ui/cn (cn)</summary> ### [`v0.5.0`](https://redirect.github.com/shadcn-ui/cn/blob/HEAD/packages/cn/CHANGELOG.md#050) [Compare Source](https://redirect.github.com/shadcn-ui/cn/compare/cn@0.4.0...cn@0.5.0) ##### Minor Changes - [#​157](https://redirect.github.com/shadcn-ui/cn/pull/157) [`663adea`](https://redirect.github.com/shadcn-ui/cn/commit/663adeaa0ac37af101aa7790f2ce44df4a7e5043) Thanks [@​shadcn](https://redirect.github.com/shadcn)! - Drop Node 20, which reached end of life, and require Node 22 or later. - [#​164](https://redirect.github.com/shadcn-ui/cn/pull/164) [`64aa1d0`](https://redirect.github.com/shadcn-ui/cn/commit/64aa1d0b6c708f1a23e53ade4db6c8c278eceb75) Thanks [@​shadcn](https://redirect.github.com/shadcn)! - `cn build` now follows package `@import`s, reads `@theme` declarations after nested blocks such as `@keyframes`, and drops names declared before a `--*: initial` reset. </details> --- ### Configuration 📅 **Schedule**: (UTC) - Branch creation - At any time (no schedule defined) - Automerge - At any time (no schedule defined) 🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied. ♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox. 🔕 **Ignore**: Close this PR and you won't be reminded about this update again. --- - [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check this box --- This PR was generated by [Mend Renovate](https://mend.io/renovate/). View the [repository job log](https://developer.mend.io/github/authelia/authelia). <!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0NC4xNjQuMSIsInVwZGF0ZWRJblZlciI6IjQ0LjE2NC4xIiwidGFyZ2V0QnJhbmNoIjoibWFzdGVyIiwibGFiZWxzIjpbImRlcGVuZGVuY2llcyIsImphdmFzY3JpcHQiXX0=--> Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com> |
||
|
renovate[bot]
|
cc847db0eb |
build(deps): update dependency eslint to v10.13.0 (#13516)
This PR contains the following updates: | Package | Change | [Age](https://docs.renovatebot.com/merge-confidence/) | [Confidence](https://docs.renovatebot.com/merge-confidence/) | |---|---|---|---| | [eslint](https://eslint.org) ([source](https://redirect.github.com/eslint/eslint)) | [`10.12.0` → `10.13.0`](https://renovatebot.com/diffs/npm/eslint/10.12.0/10.13.0) |  |  | --- ### Release Notes <details> <summary>eslint/eslint (eslint)</summary> ### [`v10.13.0`](https://redirect.github.com/eslint/eslint/releases/tag/v10.13.0) [Compare Source](https://redirect.github.com/eslint/eslint/compare/v10.12.0...v10.13.0) #### Features - [`48d5cc4`](https://redirect.github.com/eslint/eslint/commit/48d5cc47e43478670ccf95a74f7a73e8408152b5) feat: report references inside IIFEs in `no-use-before-define` ([#​21238](https://redirect.github.com/eslint/eslint/issues/21238)) (Irfan fandi) - [`a39d9fb`](https://redirect.github.com/eslint/eslint/commit/a39d9fb1fdb5db546f6407580cac531ba3370450) feat: add `globalThis` to `no-obj-calls` ([#​21382](https://redirect.github.com/eslint/eslint/issues/21382)) (synthex-byte) - [`66ac583`](https://redirect.github.com/eslint/eslint/commit/66ac58383e076940c11a5d7213ad079028d1140e) feat: check `yield*` expressions in `no-unsafe-optional-chaining` ([#​21399](https://redirect.github.com/eslint/eslint/issues/21399)) (xbinaryx) #### Bug Fixes - [`87bd2ce`](https://redirect.github.com/eslint/eslint/commit/87bd2cef7b2309739c29598fb2be335f4bed71a3) fix: avoid redeclared `let` when `no-var` and `one-var` fix together ([#​21389](https://redirect.github.com/eslint/eslint/issues/21389)) (Daniel Pinto) #### Documentation - [`4783a68`](https://redirect.github.com/eslint/eslint/commit/4783a6806fb73ea4843ac46c6ae3d8285f56c288) docs: Update README (GitHub Actions Bot) - [`43f0ac9`](https://redirect.github.com/eslint/eslint/commit/43f0ac90e7858a834a0e68309e6397fb4cfa72dd) docs: clarify parameter description in `getText` ([#​21287](https://redirect.github.com/eslint/eslint/issues/21287)) (lumir) #### Chores - [`b59d889`](https://redirect.github.com/eslint/eslint/commit/b59d889c7c18d8c73144e6ba46e9e7f3e7da0196) chore: update github/codeql-action action to v4.38.3 ([#​21412](https://redirect.github.com/eslint/eslint/issues/21412)) (renovate\[bot]) - [`95e51a0`](https://redirect.github.com/eslint/eslint/commit/95e51a0518b15015304eca9844b3f64c1fc167ca) ci: re-enable `@typescript-eslint/typescript-eslint` in ecosystem tests ([#​21410](https://redirect.github.com/eslint/eslint/issues/21410)) (Francesco Trotta) - [`317fcb3`](https://redirect.github.com/eslint/eslint/commit/317fcb365f19e912a60d171a9d5a8d1f16fe4660) chore: update ecosystem plugins ([#​21409](https://redirect.github.com/eslint/eslint/issues/21409)) (ESLint Bot) - [`b92decf`](https://redirect.github.com/eslint/eslint/commit/b92decf8ead7cc4082a18a4a0ab28f3c7c589887) perf: skip no-redeclare scan for single-declaration variables ([#​21365](https://redirect.github.com/eslint/eslint/issues/21365)) (James Ross) - [`47b7063`](https://redirect.github.com/eslint/eslint/commit/47b7063b3f3f7bc7a5bcb87c082577e4e8b96e24) chore: update dependency [@​eslint/json](https://redirect.github.com/eslint/json) to ^2.1.1 ([#​21398](https://redirect.github.com/eslint/eslint/issues/21398)) (renovate\[bot]) - [`e5aea41`](https://redirect.github.com/eslint/eslint/commit/e5aea414cc00555ecd43f6e608bf80e0f9a6d4d6) chore: update ecosystem plugins ([#​21390](https://redirect.github.com/eslint/eslint/issues/21390)) (ESLint Bot) </details> --- ### Configuration 📅 **Schedule**: (UTC) - Branch creation - At any time (no schedule defined) - Automerge - At any time (no schedule defined) 🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied. ♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox. 🔕 **Ignore**: Close this PR and you won't be reminded about this update again. --- - [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check this box --- This PR was generated by [Mend Renovate](https://mend.io/renovate/). View the [repository job log](https://developer.mend.io/github/authelia/authelia). <!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0NC4xNjQuMSIsInVwZGF0ZWRJblZlciI6IjQ0LjE2NC4xIiwidGFyZ2V0QnJhbmNoIjoibWFzdGVyIiwibGFiZWxzIjpbImRlcGVuZGVuY2llcyIsImphdmFzY3JpcHQiXX0=--> Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com> |
||
|
renovate[bot]
|
6cf4cade73 |
build(deps): update pnpm/get.pnpm.io digest to b7cf47f (#13513)
This PR contains the following updates: | Package | Update | Change | |---|---|---| | pnpm/get.pnpm.io | digest | `29fc846` → `b7cf47f` | --- ### Configuration 📅 **Schedule**: (UTC) - Branch creation - At any time (no schedule defined) - Automerge - At any time (no schedule defined) 🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied. ♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox. 🔕 **Ignore**: Close this PR and you won't be reminded about this update again. --- - [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check this box --- This PR was generated by [Mend Renovate](https://mend.io/renovate/). View the [repository job log](https://developer.mend.io/github/authelia/authelia). <!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0NC4xNjQuMSIsInVwZGF0ZWRJblZlciI6IjQ0LjE2NC4xIiwidGFyZ2V0QnJhbmNoIjoibWFzdGVyIiwibGFiZWxzIjpbImRlcGVuZGVuY2llcyJdfQ==--> Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com> |
||
|
renovate[bot]
|
fd0820fa3b |
build(deps): update dependency react-i18next to v17.0.20 (#13512)
This PR contains the following updates: | Package | Change | [Age](https://docs.renovatebot.com/merge-confidence/) | [Confidence](https://docs.renovatebot.com/merge-confidence/) | |---|---|---|---| | [react-i18next](https://redirect.github.com/i18next/react-i18next) | [`17.0.19` → `17.0.20`](https://renovatebot.com/diffs/npm/react-i18next/17.0.19/17.0.20) |  |  | --- ### Release Notes <details> <summary>i18next/react-i18next (react-i18next)</summary> ### [`v17.0.20`](https://redirect.github.com/i18next/react-i18next/blob/HEAD/CHANGELOG.md#17020) [Compare Source](https://redirect.github.com/i18next/react-i18next/compare/v17.0.19...v17.0.20) - fix: `useTranslation` no longer suspends when a missing namespace is loaded by a synchronous backend. With `useSuspense` (the default), a namespace that wasn't in the store yet always made the component throw the loading promise, even when the backend had already delivered the resources while that promise was being created. React then showed the `Suspense` fallback and rendered again right away, which appears as a fallback flash (a white flash in React Native) and costs performance. The hook now starts the load first, checks the store again and only suspends if the namespace is still missing. This helps every backend that calls back synchronously, for example `i18next-resources-to-backend` with a static resources object or a loader that returns the data directly. Async backends, and an instance that isn't initialized yet, still suspend as before. Thanks [@​oblador](https://redirect.github.com/oblador) ([#​1937](https://redirect.github.com/i18next/react-i18next/pull/1937)). </details> --- ### Configuration 📅 **Schedule**: (UTC) - Branch creation - At any time (no schedule defined) - Automerge - At any time (no schedule defined) 🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied. ♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox. 🔕 **Ignore**: Close this PR and you won't be reminded about this update again. --- - [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check this box --- This PR was generated by [Mend Renovate](https://mend.io/renovate/). View the [repository job log](https://developer.mend.io/github/authelia/authelia). <!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0NC4xNjQuMSIsInVwZGF0ZWRJblZlciI6IjQ0LjE2NC4xIiwidGFyZ2V0QnJhbmNoIjoibWFzdGVyIiwibGFiZWxzIjpbImRlcGVuZGVuY2llcyIsImphdmFzY3JpcHQiXX0=--> Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com> |
||
|
renovate[bot]
|
1bce0eef7d |
build(deps): update authelia/base:latest docker digest to bfbb14f (#13511)
This PR contains the following updates: | Package | Type | Update | Change | |---|---|---|---| | authelia/base | final | digest | `c9cedf4` → `bfbb14f` | --- ### Configuration 📅 **Schedule**: (UTC) - Branch creation - At any time (no schedule defined) - Automerge - At any time (no schedule defined) 🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied. ♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox. 🔕 **Ignore**: Close this PR and you won't be reminded about this update again. --- - [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check this box --- This PR was generated by [Mend Renovate](https://mend.io/renovate/). View the [repository job log](https://developer.mend.io/github/authelia/authelia). <!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0NC4xNjQuMSIsInVwZGF0ZWRJblZlciI6IjQ0LjE2NC4xIiwidGFyZ2V0QnJhbmNoIjoibWFzdGVyIiwibGFiZWxzIjpbImRlcGVuZGVuY2llcyIsImRvY2tlciJdfQ==--> Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com> |
||
|
renovate[bot]
|
e8f58adc60 |
build(deps): update module github.com/knadh/koanf/v2 to v2.4.0 (#13509)
This PR contains the following updates: | Package | Change | [Age](https://docs.renovatebot.com/merge-confidence/) | [Confidence](https://docs.renovatebot.com/merge-confidence/) | |---|---|---|---| | [github.com/knadh/koanf/v2](https://redirect.github.com/knadh/koanf) | `v2.3.8` → `v2.4.0` |  |  | --- ### Release Notes <details> <summary>knadh/koanf (github.com/knadh/koanf/v2)</summary> ### [`v2.4.0`](https://redirect.github.com/knadh/koanf/compare/v2.3.8...v2.4.0) [Compare Source](https://redirect.github.com/knadh/koanf/compare/v2.3.8...v2.4.0) </details> --- ### Configuration 📅 **Schedule**: (UTC) - Branch creation - At any time (no schedule defined) - Automerge - At any time (no schedule defined) 🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied. ♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox. 🔕 **Ignore**: Close this PR and you won't be reminded about this update again. --- - [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check this box --- This PR was generated by [Mend Renovate](https://mend.io/renovate/). View the [repository job log](https://developer.mend.io/github/authelia/authelia). <!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0NC4xNjQuMSIsInVwZGF0ZWRJblZlciI6IjQ0LjE2NC4xIiwidGFyZ2V0QnJhbmNoIjoibWFzdGVyIiwibGFiZWxzIjpbImRlcGVuZGVuY2llcyIsImdvIl19--> Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com> |
||
|
renovate[bot]
|
92322fb848 |
build(deps): update maven:3.10.0-eclipse-temurin-21 docker digest to d23342b (#13503)
This PR contains the following updates: | Package | Type | Update | Change | |---|---|---|---| | [maven](https://hub.docker.com/_/maven) ([source](https://redirect.github.com/carlossg/docker-maven)) | stage | digest | `2efc28d` → `d23342b` | --- ### Configuration 📅 **Schedule**: (UTC) - Branch creation - At any time (no schedule defined) - Automerge - At any time (no schedule defined) 🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied. ♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox. 🔕 **Ignore**: Close this PR and you won't be reminded about this update again. --- - [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check this box --- This PR was generated by [Mend Renovate](https://mend.io/renovate/). View the [repository job log](https://developer.mend.io/github/authelia/authelia). <!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0NC4xNjQuMSIsInVwZGF0ZWRJblZlciI6IjQ0LjE2NC4xIiwidGFyZ2V0QnJhbmNoIjoibWFzdGVyIiwibGFiZWxzIjpbImRlcGVuZGVuY2llcyIsImRvY2tlciJdfQ==--> Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com> |
||
|
renovate[bot]
|
285bd8be98 |
build(deps): update dependency react-i18next to v17.0.19 (#13504)
This PR contains the following updates: | Package | Change | [Age](https://docs.renovatebot.com/merge-confidence/) | [Confidence](https://docs.renovatebot.com/merge-confidence/) | |---|---|---|---| | [react-i18next](https://redirect.github.com/i18next/react-i18next) | [`17.0.18` → `17.0.19`](https://renovatebot.com/diffs/npm/react-i18next/17.0.18/17.0.19) |  |  | --- ### Release Notes <details> <summary>i18next/react-i18next (react-i18next)</summary> ### [`v17.0.19`](https://redirect.github.com/i18next/react-i18next/blob/HEAD/CHANGELOG.md#17019) [Compare Source](https://redirect.github.com/i18next/react-i18next/compare/v17.0.18...v17.0.19) - fix: `useTranslation` with an inline selector `keyPrefix` (`useTranslation('ns', { keyPrefix: ($) => $.role })`) returned a new `t` on every render, so every effect, `useCallback` and `useMemo` depending on `t` ran again each time. The cached `t` was compared against the `keyPrefix` function itself, and an inline arrow is a new function on every render. It is now compared against the key the selector resolves to (with the same options and namespace list `getFixedT` resolves it with), so `t` keeps its identity as long as the resolved prefix does, just like a string `keyPrefix`. A selector that resolves to a different key still gets a new `t`, and i18next still resolves the selector on each `t` call as before. Fixes [#​1936](https://redirect.github.com/i18next/react-i18next/issues/1936). - fix: `useTranslation` kept returning the previous `t` when only the namespace (`useTranslation('a')` → `useTranslation('b')`) or only the i18n instance (another instance with the same language, via props or `I18nextProvider`) changed on a mounted component. That `t` kept resolving against the old namespace or instance until something else (the language, the ready state, a bound i18n event) produced a new one. Both are now part of the check that decides whether the cached `t` can be reused. </details> --- ### Configuration 📅 **Schedule**: (UTC) - Branch creation - At any time (no schedule defined) - Automerge - At any time (no schedule defined) 🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied. ♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox. 🔕 **Ignore**: Close this PR and you won't be reminded about this update again. --- - [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check this box --- This PR was generated by [Mend Renovate](https://mend.io/renovate/). View the [repository job log](https://developer.mend.io/github/authelia/authelia). <!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0NC4xNjQuMSIsInVwZGF0ZWRJblZlciI6IjQ0LjE2NC4xIiwidGFyZ2V0QnJhbmNoIjoibWFzdGVyIiwibGFiZWxzIjpbImRlcGVuZGVuY2llcyIsImphdmFzY3JpcHQiXX0=--> Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com> |
||
|
renovate[bot]
|
48b5945729 |
build(deps): update dependency lucide-react to v1.58.0 (#13507)
This PR contains the following updates: | Package | Change | [Age](https://docs.renovatebot.com/merge-confidence/) | [Confidence](https://docs.renovatebot.com/merge-confidence/) | |---|---|---|---| | [lucide-react](https://lucide.dev) ([source](https://redirect.github.com/lucide-icons/lucide/tree/HEAD/packages/lucide-react)) | [`1.57.0` → `1.58.0`](https://renovatebot.com/diffs/npm/lucide-react/1.57.0/1.58.0) |  |  | --- ### Release Notes <details> <summary>lucide-icons/lucide (lucide-react)</summary> ### [`v1.58.0`](https://redirect.github.com/lucide-icons/lucide/releases/tag/1.58.0): Version 1.58.0 [Compare Source](https://redirect.github.com/lucide-icons/lucide/compare/1.57.0...1.58.0) #### What's Changed - feat(docs): add third-party package lucide-jte by [@​sgruendel](https://redirect.github.com/sgruendel) in [#​5000](https://redirect.github.com/lucide-icons/lucide/pull/5000) - chore(integration-tests): Add Svelte integration tests for `@ucide/svelte` by [@​ericfennis](https://redirect.github.com/ericfennis) in [#​5005](https://redirect.github.com/lucide-icons/lucide/pull/5005) - chore(deps-dev): bump the angular-deps group across 1 directory with 10 updates by [@​dependabot](https://redirect.github.com/dependabot)\[bot] in [#​5004](https://redirect.github.com/lucide-icons/lucide/pull/5004) - fix(site): Fix homepage animation by [@​ericfennis](https://redirect.github.com/ericfennis) in [#​5015](https://redirect.github.com/lucide-icons/lucide/pull/5015) - feat(ci): auto-generate PR titles from added file paths by [@​ericfennis](https://redirect.github.com/ericfennis) with [@​Copilot](https://redirect.github.com/Copilot) in [#​4790](https://redirect.github.com/lucide-icons/lucide/pull/4790) - fix(icons): changed `barrel` icon by [@​karsa-mistmere](https://redirect.github.com/karsa-mistmere) in [#​4639](https://redirect.github.com/lucide-icons/lucide/pull/4639) - ci(dev): fix "Generate PR Title" job by using REST API for changed files by [@​ericfennis](https://redirect.github.com/ericfennis) with [@​Copilot](https://redirect.github.com/Copilot) in [#​5017](https://redirect.github.com/lucide-icons/lucide/pull/5017) - feat(icons): added `certificate` icon by [@​rrod497](https://redirect.github.com/rrod497) in [#​4327](https://redirect.github.com/lucide-icons/lucide/pull/4327) - fix(icons): update music icons by [@​jamiemlaw](https://redirect.github.com/jamiemlaw) in [#​4072](https://redirect.github.com/lucide-icons/lucide/pull/4072) #### New Contributors - [@​sgruendel](https://redirect.github.com/sgruendel) made their first contribution in [#​5000](https://redirect.github.com/lucide-icons/lucide/pull/5000) **Full Changelog**: <https://github.com/lucide-icons/lucide/compare/1.57.0...1.58.0> </details> --- ### Configuration 📅 **Schedule**: (UTC) - Branch creation - At any time (no schedule defined) - Automerge - At any time (no schedule defined) 🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied. ♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox. 🔕 **Ignore**: Close this PR and you won't be reminded about this update again. --- - [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check this box --- This PR was generated by [Mend Renovate](https://mend.io/renovate/). View the [repository job log](https://developer.mend.io/github/authelia/authelia). <!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0NC4xNjQuMSIsInVwZGF0ZWRJblZlciI6IjQ0LjE2NC4xIiwidGFyZ2V0QnJhbmNoIjoibWFzdGVyIiwibGFiZWxzIjpbImRlcGVuZGVuY2llcyIsImphdmFzY3JpcHQiXX0=--> Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com> |
||
|
renovate[bot]
|
b0ac0d2b9f |
build(deps): update dependency @eslint-react/eslint-plugin to v5.28.0 (#13506)
This PR contains the following updates: | Package | Change | [Age](https://docs.renovatebot.com/merge-confidence/) | [Confidence](https://docs.renovatebot.com/merge-confidence/) | |---|---|---|---| | [@eslint-react/eslint-plugin](https://redirect.github.com/Rel1cx/eslint-react) ([source](https://redirect.github.com/Rel1cx/eslint-react/tree/HEAD/plugins/eslint-plugin)) | [`5.27.3` → `5.28.0`](https://renovatebot.com/diffs/npm/@eslint-react%2feslint-plugin/5.27.3/5.28.0) |  |  | --- ### Release Notes <details> <summary>Rel1cx/eslint-react (@​eslint-react/eslint-plugin)</summary> ### [`v5.28.0`](https://redirect.github.com/Rel1cx/eslint-react/blob/HEAD/CHANGELOG.md#v5280-2026-10-16) [Compare Source](https://redirect.github.com/Rel1cx/eslint-react/compare/v5.27.4...v5.28.0) ##### ✨ New - `@eslint-react/eslint-plugin`: the general-purpose presets now enable JSX syntax support via `languageOptions.parserOptions.ecmaFeatures.jsx: true`, so you no longer need to configure it yourself. ([#​2049](https://redirect.github.com/Rel1cx/eslint-react/issues/2049)) Affected presets: - `recommended` - `recommended-typescript` - `recommended-type-checked` - `strict` - `strict-typescript` - `strict-type-checked` ##### 🏗️ Internal - Bumped `fumadocs-core` and `fumadocs-ui` to `16.17.5`, and `lucide-react` to `1.58.0`. **Full Changelog**: <https://github.com/Rel1cx/eslint-react/compare/v5.27.4...v5.28.0> ### [`v5.27.4`](https://redirect.github.com/Rel1cx/eslint-react/blob/HEAD/CHANGELOG.md#v5274-2026-10-16) [Compare Source](https://redirect.github.com/Rel1cx/eslint-react/compare/v5.27.3...v5.27.4) ##### 🐞 Fixes - `@eslint-react/jsx`: `resolveAttributeValue` now handles a parser-tolerated `JSXFragment` in attribute value position (ex: `<a href=<></> />`), reporting it as kind `"element"` instead of falling through to `undefined`; as a result, `react-dom/no-missing-iframe-sandbox` now reports `<iframe sandbox=<></> />` instead of silently skipping it. ([#​2048](https://redirect.github.com/Rel1cx/eslint-react/issues/2048)) **Full Changelog**: <https://github.com/Rel1cx/eslint-react/compare/v5.27.3...v5.27.4> </details> --- ### Configuration 📅 **Schedule**: (UTC) - Branch creation - At any time (no schedule defined) - Automerge - At any time (no schedule defined) 🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied. ♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox. 🔕 **Ignore**: Close this PR and you won't be reminded about this update again. --- - [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check this box --- This PR was generated by [Mend Renovate](https://mend.io/renovate/). View the [repository job log](https://developer.mend.io/github/authelia/authelia). <!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0NC4xNjQuMSIsInVwZGF0ZWRJblZlciI6IjQ0LjE2NC4xIiwidGFyZ2V0QnJhbmNoIjoibWFzdGVyIiwibGFiZWxzIjpbImRlcGVuZGVuY2llcyIsImphdmFzY3JpcHQiXX0=--> Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com> |
||
|
renovate[bot]
|
43469fcd71 |
build(deps): update dependency @eslint-react/eslint-plugin to v5.27.3 (#13501)
This PR contains the following updates: | Package | Change | [Age](https://docs.renovatebot.com/merge-confidence/) | [Confidence](https://docs.renovatebot.com/merge-confidence/) | |---|---|---|---| | [@eslint-react/eslint-plugin](https://redirect.github.com/Rel1cx/eslint-react) ([source](https://redirect.github.com/Rel1cx/eslint-react/tree/HEAD/plugins/eslint-plugin)) | [`5.27.2` → `5.27.3`](https://renovatebot.com/diffs/npm/@eslint-react%2feslint-plugin/5.27.2/5.27.3) |  |  | --- ### Release Notes <details> <summary>Rel1cx/eslint-react (@​eslint-react/eslint-plugin)</summary> ### [`v5.27.3`](https://redirect.github.com/Rel1cx/eslint-react/blob/HEAD/CHANGELOG.md#v5273-2026-10-16) [Compare Source](https://redirect.github.com/Rel1cx/eslint-react/compare/v5.27.2...v5.27.3) ##### 🐞 Fixes - `react-jsx/no-key-after-spread`: the fast-path text check now matches `key` assignments with whitespace around `=` (ex: `<div {...props} key = {id} />` or a newline before `=`), so such elements are no longer silently skipped. ([#​2043](https://redirect.github.com/Rel1cx/eslint-react/issues/2043)) Thanks to [@​amir-rahmanii](https://redirect.github.com/amir-rahmanii)! - `react-jsx/no-children-prop`: a `children` prop alongside nested children content (ex: `<div children="x">y</div>`, `createElement("div", { children: "x" }, "y")`) is no longer reported by this rule — that conflict case belongs to `react-jsx/no-children-prop-with-children` — removing the unsafe merge suggestion and the duplicate diagnostics. ([#​2044](https://redirect.github.com/Rel1cx/eslint-react/issues/2044)) Thanks to [@​amir-rahmanii](https://redirect.github.com/amir-rahmanii)! - `react-jsx/no-children-prop-with-children`: empty expression containers (ex: `{}`, `{/* comment */}`) are no longer treated as meaningful children, so `<div children="x">{/* comment */}</div>` is no longer reported. ([#​2045](https://redirect.github.com/Rel1cx/eslint-react/issues/2045)) Thanks to [@​amir-rahmanii](https://redirect.github.com/amir-rahmanii)! ##### 📝 Documentation - `react-naming-convention/ref-name`: corrected the `additionalRefHooks` example to use the `/pattern/flags` RegExp string form; a bare `(a|b)` string is treated as exact equality and never matches. ([#​2042](https://redirect.github.com/Rel1cx/eslint-react/issues/2042)) Thanks to [@​amir-rahmanii](https://redirect.github.com/amir-rahmanii)! - The settings docs examples for the additional hooks settings now use full RegExp strings. ([#​2047](https://redirect.github.com/Rel1cx/eslint-react/issues/2047)) ##### 🏗️ Internal - `@eslint-react/jsx`: `hasChildren` now treats empty expression containers as non-meaningful, aligned with `getChildren`. ([#​2045](https://redirect.github.com/Rel1cx/eslint-react/issues/2045)) - `react-x`: refactored the internals of `set-state-in-effect`, `set-state-in-render`, and `static-components` for readability; no behavior change. ([#​2041](https://redirect.github.com/Rel1cx/eslint-react/issues/2041)) - Bumped `vitest` to `5.0.5`, `next` to `16.4.2`, `fumadocs-core` and `fumadocs-ui` to `16.17.4`, and `undici` to `8.12.2`. **Full Changelog**: <https://github.com/Rel1cx/eslint-react/compare/v5.27.2...v5.27.3> </details> --- ### Configuration 📅 **Schedule**: (UTC) - Branch creation - At any time (no schedule defined) - Automerge - At any time (no schedule defined) 🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied. ♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox. 🔕 **Ignore**: Close this PR and you won't be reminded about this update again. --- - [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check this box --- This PR was generated by [Mend Renovate](https://mend.io/renovate/). View the [repository job log](https://developer.mend.io/github/authelia/authelia). <!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0NC4xNjQuMSIsInVwZGF0ZWRJblZlciI6IjQ0LjE2NC4xIiwidGFyZ2V0QnJhbmNoIjoibWFzdGVyIiwibGFiZWxzIjpbImRlcGVuZGVuY2llcyIsImphdmFzY3JpcHQiXX0=--> Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com> |
||
|
renovate[bot]
|
3999636391 |
build(deps): update dependency i18next to v26.4.7 (#13502)
This PR contains the following updates: | Package | Change | [Age](https://docs.renovatebot.com/merge-confidence/) | [Confidence](https://docs.renovatebot.com/merge-confidence/) | |---|---|---|---| | [i18next](https://www.i18next.com) ([source](https://redirect.github.com/i18next/i18next)) | [`26.4.6` → `26.4.7`](https://renovatebot.com/diffs/npm/i18next/26.4.6/26.4.7) |  |  | --- ### Release Notes <details> <summary>i18next/i18next (i18next)</summary> ### [`v26.4.7`](https://redirect.github.com/i18next/i18next/blob/HEAD/CHANGELOG.md#2647) [Compare Source](https://redirect.github.com/i18next/i18next/compare/v26.4.6...v26.4.7) - perf: `cloneInstance()` no longer inherits `preload`. `loadResources()` adds every `preload` language to each load, and clones copied `preload` from the parent, so a clone's `init()` and every `changeLanguage()` walked all preloaded languages × all namespaces through `queueLoad()` / `hasResourceBundle()`, although the parent had already loaded them into the shared store. With i18next-http-middleware (one clone + `changeLanguage()` per request), 25 preloaded languages and 20 namespaces, that was most of the per-request CPU: the reproduction from the issue went from \~90 µs to \~10 µs per request, the same as with a single language. A clone now only loads what it uses itself: its `changeLanguage()` no longer waits for parent preload languages that are still loading (the parent's own `init()` still does), and `clone.loadNamespaces()` loads the new namespace for the clone's language and fallbacks instead of every preloaded language. `clone.loadLanguages()` works as before, the parent instance is unchanged, and passing `preload` to `cloneInstance()` keeps the old behavior. Thanks [@​theMostCuriousHomunculus](https://redirect.github.com/theMostCuriousHomunculus) for the detailed report ([#​2451](https://redirect.github.com/i18next/i18next/issues/2451)). </details> --- ### Configuration 📅 **Schedule**: (UTC) - Branch creation - At any time (no schedule defined) - Automerge - At any time (no schedule defined) 🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied. ♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox. 🔕 **Ignore**: Close this PR and you won't be reminded about this update again. --- - [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check this box --- This PR was generated by [Mend Renovate](https://mend.io/renovate/). View the [repository job log](https://developer.mend.io/github/authelia/authelia). <!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0NC4xNjQuMSIsInVwZGF0ZWRJblZlciI6IjQ0LjE2NC4xIiwidGFyZ2V0QnJhbmNoIjoibWFzdGVyIiwibGFiZWxzIjpbImRlcGVuZGVuY2llcyIsImphdmFzY3JpcHQiXX0=--> Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com> |
||
|
renovate[bot]
|
b7c99bc024 |
build(deps): update maven:3.10.0-eclipse-temurin-21 docker digest to 2efc28d (#13499)
This PR contains the following updates: | Package | Type | Update | Change | |---|---|---|---| | [maven](https://hub.docker.com/_/maven) ([source](https://redirect.github.com/carlossg/docker-maven)) | stage | digest | `9b48777` → `2efc28d` | --- ### Configuration 📅 **Schedule**: (UTC) - Branch creation - At any time (no schedule defined) - Automerge - At any time (no schedule defined) 🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied. ♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox. 🔕 **Ignore**: Close this PR and you won't be reminded about this update again. --- - [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check this box --- This PR was generated by [Mend Renovate](https://mend.io/renovate/). View the [repository job log](https://developer.mend.io/github/authelia/authelia). <!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0NC4xNjQuMSIsInVwZGF0ZWRJblZlciI6IjQ0LjE2NC4xIiwidGFyZ2V0QnJhbmNoIjoibWFzdGVyIiwibGFiZWxzIjpbImRlcGVuZGVuY2llcyIsImRvY2tlciJdfQ==--> Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com> |
||
|
renovate[bot]
|
e3a715e436 |
build(deps): update dependency js-yaml to v5.5.0 (#13500)
This PR contains the following updates: | Package | Change | [Age](https://docs.renovatebot.com/merge-confidence/) | [Confidence](https://docs.renovatebot.com/merge-confidence/) | |---|---|---|---| | [js-yaml](https://redirect.github.com/nodeca/js-yaml) | [`5.4.3` → `5.5.0`](https://renovatebot.com/diffs/npm/js-yaml/5.4.3/5.5.0) |  |  | --- ### Release Notes <details> <summary>nodeca/js-yaml (js-yaml)</summary> ### [`v5.5.0`](https://redirect.github.com/nodeca/js-yaml/blob/HEAD/CHANGELOG.md#550---2026-10-16) [Compare Source](https://redirect.github.com/nodeca/js-yaml/compare/5.4.3...5.5.0) ##### Changed - Updated `argparse` to v3. - Updated development dependencies. ##### Fixed - Correct percent-encoding of shorthand and verbatim tags. - Reject `,`, `]`, and `}` at the start of block plain scalars, [#​801](https://redirect.github.com/nodeca/js-yaml/issues/801). - Report the exact position of non-printable characters in errors, [#​801](https://redirect.github.com/nodeca/js-yaml/issues/801). </details> --- ### Configuration 📅 **Schedule**: (UTC) - Branch creation - At any time (no schedule defined) - Automerge - At any time (no schedule defined) 🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied. ♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox. 🔕 **Ignore**: Close this PR and you won't be reminded about this update again. --- - [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check this box --- This PR was generated by [Mend Renovate](https://mend.io/renovate/). View the [repository job log](https://developer.mend.io/github/authelia/authelia). <!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0NC4xNjQuMSIsInVwZGF0ZWRJblZlciI6IjQ0LjE2NC4xIiwidGFyZ2V0QnJhbmNoIjoibWFzdGVyIiwibGFiZWxzIjpbImRlcGVuZGVuY2llcyIsImphdmFzY3JpcHQiXX0=--> Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com> |
||
|
renovate[bot]
|
93e1ba65b7 |
build(deps): update dependency i18next to v26.4.6 (#13494)
This PR contains the following updates: | Package | Change | [Age](https://docs.renovatebot.com/merge-confidence/) | [Confidence](https://docs.renovatebot.com/merge-confidence/) | |---|---|---|---| | [i18next](https://www.i18next.com) ([source](https://redirect.github.com/i18next/i18next)) | [`26.4.5` → `26.4.6`](https://renovatebot.com/diffs/npm/i18next/26.4.5/26.4.6) |  |  | --- ### Release Notes <details> <summary>i18next/i18next (i18next)</summary> ### [`v26.4.6`](https://redirect.github.com/i18next/i18next/blob/HEAD/CHANGELOG.md#2646) [Compare Source](https://redirect.github.com/i18next/i18next/compare/v26.4.5...v26.4.6) - fix: a fallback language whose formatted code is already in the hierarchy is no longer added a second time. `toResolveHierarchy()` checked the raw `fallbackLng` value against the list, but the list holds formatted codes, so any fallback written differently from its formatted form slipped through: `lng: 'de-CH'` with `fallbackLng: 'de-ch'` gave `languages` `['de-CH', 'de', 'de-CH']`, and the same happened with `fallbackLng: 'EN'` + `cleanCode`, `lowerCaseLng`, and Intl aliases (`iw-IL` → `he-IL`). Missing keys were looked up in the same language twice. Only exact duplicates are removed; the order is unchanged. Thanks [@​lprnmns](https://redirect.github.com/lprnmns) ([#​2450](https://redirect.github.com/i18next/i18next/pull/2450)). </details> --- ### Configuration 📅 **Schedule**: (UTC) - Branch creation - At any time (no schedule defined) - Automerge - At any time (no schedule defined) 🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied. ♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox. 🔕 **Ignore**: Close this PR and you won't be reminded about this update again. --- - [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check this box --- This PR was generated by [Mend Renovate](https://mend.io/renovate/). View the [repository job log](https://developer.mend.io/github/authelia/authelia). <!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0NC4xNjQuMSIsInVwZGF0ZWRJblZlciI6IjQ0LjE2NC4xIiwidGFyZ2V0QnJhbmNoIjoibWFzdGVyIiwibGFiZWxzIjpbImRlcGVuZGVuY2llcyIsImphdmFzY3JpcHQiXX0=--> Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com> |
||
|
renovate[bot]
|
9d56c0749c |
build(deps): update dependency hugo-extended to v0.168.0 (#13497)
This PR contains the following updates: | Package | Change | [Age](https://docs.renovatebot.com/merge-confidence/) | [Confidence](https://docs.renovatebot.com/merge-confidence/) | |---|---|---|---| | [hugo-extended](https://redirect.github.com/jakejarvis/hugo-extended) | `0.167.0` → `0.168.0` |  |  | | [hugo-extended](https://redirect.github.com/jakejarvis/hugo-extended) | [`0.167.0` → `0.168.0`](https://renovatebot.com/diffs/npm/hugo-extended/0.167.0/0.168.0) |  |  | --- ### Release Notes <details> <summary>jakejarvis/hugo-extended (hugo-extended)</summary> ### [`v0.168.0`](https://redirect.github.com/jakejarvis/hugo-extended/compare/v0.167.0...v0.168.0) [Compare Source](https://redirect.github.com/jakejarvis/hugo-extended/compare/v0.167.0...v0.168.0) </details> --- ### Configuration 📅 **Schedule**: (UTC) - Branch creation - At any time (no schedule defined) - Automerge - At any time (no schedule defined) 🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied. ♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox. 🔕 **Ignore**: Close this PR and you won't be reminded about these updates again. --- - [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check this box --- This PR was generated by [Mend Renovate](https://mend.io/renovate/). View the [repository job log](https://developer.mend.io/github/authelia/authelia). <!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0NC4xNjQuMSIsInVwZGF0ZWRJblZlciI6IjQ0LjE2NC4xIiwidGFyZ2V0QnJhbmNoIjoibWFzdGVyIiwibGFiZWxzIjpbImRlcGVuZGVuY2llcyIsImphdmFzY3JpcHQiXX0=--> Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com> |
||
|
renovate[bot]
|
38e3b7f353 |
build(deps): update dependency sass-embedded to v1.105.2 (#13496)
This PR contains the following updates: | Package | Change | [Age](https://docs.renovatebot.com/merge-confidence/) | [Confidence](https://docs.renovatebot.com/merge-confidence/) | |---|---|---|---| | [sass-embedded](https://redirect.github.com/sass/embedded-host-node) | `1.105.1` → `1.105.2` |  |  | | [sass-embedded](https://redirect.github.com/sass/embedded-host-node) | [`1.105.1` → `1.105.2`](https://renovatebot.com/diffs/npm/sass-embedded/1.105.1/1.105.2) |  |  | --- ### Release Notes <details> <summary>sass/embedded-host-node (sass-embedded)</summary> ### [`v1.105.2`](https://redirect.github.com/sass/embedded-host-node/blob/HEAD/CHANGELOG.md#11052) [Compare Source](https://redirect.github.com/sass/embedded-host-node/compare/1.105.1...1.105.2) ##### Node.js Embedded Host - Fix a deadlock when the async compiler fails to start. </details> --- ### Configuration 📅 **Schedule**: (UTC) - Branch creation - At any time (no schedule defined) - Automerge - At any time (no schedule defined) 🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied. ♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox. 🔕 **Ignore**: Close this PR and you won't be reminded about these updates again. --- - [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check this box --- This PR was generated by [Mend Renovate](https://mend.io/renovate/). View the [repository job log](https://developer.mend.io/github/authelia/authelia). <!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0NC4xNjQuMSIsInVwZGF0ZWRJblZlciI6IjQ0LjE2NC4xIiwidGFyZ2V0QnJhbmNoIjoibWFzdGVyIiwibGFiZWxzIjpbImRlcGVuZGVuY2llcyIsImphdmFzY3JpcHQiXX0=--> Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com> |
||
|
renovate[bot]
|
b043c99765 |
build(deps): update dependency react-i18next to v17.0.18 (#13495)
This PR contains the following updates: | Package | Change | [Age](https://docs.renovatebot.com/merge-confidence/) | [Confidence](https://docs.renovatebot.com/merge-confidence/) | |---|---|---|---| | [react-i18next](https://redirect.github.com/i18next/react-i18next) | [`17.0.17` → `17.0.18`](https://renovatebot.com/diffs/npm/react-i18next/17.0.17/17.0.18) |  |  | --- ### Release Notes <details> <summary>i18next/react-i18next (react-i18next)</summary> ### [`v17.0.18`](https://redirect.github.com/i18next/react-i18next/blob/HEAD/CHANGELOG.md#17018) [Compare Source](https://redirect.github.com/i18next/react-i18next/compare/v17.0.17...v17.0.18) - fix(Trans): with `shouldUnescape`, the default `unescape` now turns ` ` and `&#​160;` into a no-break space (U+00A0) instead of a regular space (U+0020). The regular space dropped what the entity is for: `u nás` or `10 km` could wrap across lines, and consecutive ` `s collapsed into one space. This also matches `IcuTrans`, whose entity decoder already mapped ` ` to U+00A0. Compatibility note: only affects `shouldUnescape`; snapshots or exact `textContent` comparisons of such text now contain U+00A0 (Testing Library's default normalizer still matches it as a space). A custom `react.unescape` function can restore the old mapping for text nodes. Thanks [@​lprnmns](https://redirect.github.com/lprnmns) ([#​1935](https://redirect.github.com/i18next/react-i18next/pull/1935)). </details> --- ### Configuration 📅 **Schedule**: (UTC) - Branch creation - At any time (no schedule defined) - Automerge - At any time (no schedule defined) 🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied. ♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox. 🔕 **Ignore**: Close this PR and you won't be reminded about this update again. --- - [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check this box --- This PR was generated by [Mend Renovate](https://mend.io/renovate/). View the [repository job log](https://developer.mend.io/github/authelia/authelia). <!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0NC4xNjQuMSIsInVwZGF0ZWRJblZlciI6IjQ0LjE2NC4xIiwidGFyZ2V0QnJhbmNoIjoibWFzdGVyIiwibGFiZWxzIjpbImRlcGVuZGVuY2llcyIsImphdmFzY3JpcHQiXX0=--> Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com> |
||
|
renovate[bot]
|
23e1d12802 |
build(deps): update dependency happy-dom to v21.0.3 (#13493)
This PR contains the following updates: | Package | Change | [Age](https://docs.renovatebot.com/merge-confidence/) | [Confidence](https://docs.renovatebot.com/merge-confidence/) | |---|---|---|---| | [happy-dom](https://redirect.github.com/capricorn86/happy-dom) | [`21.0.1` → `21.0.3`](https://renovatebot.com/diffs/npm/happy-dom/21.0.1/21.0.3) |  |  | --- ### Release Notes <details> <summary>capricorn86/happy-dom (happy-dom)</summary> ### [`v21.0.3`](https://redirect.github.com/capricorn86/happy-dom/releases/tag/v21.0.3) [Compare Source](https://redirect.github.com/capricorn86/happy-dom/compare/v21.0.2...v21.0.3) ##### 👷♂️ Patch fixes - Fixes security vulnerability where authorization header was forwarded when redirecting - By **[@​capricorn86](https://redirect.github.com/capricorn86)** ### [`v21.0.2`](https://redirect.github.com/capricorn86/happy-dom/releases/tag/v21.0.2) [Compare Source](https://redirect.github.com/capricorn86/happy-dom/compare/v21.0.1...v21.0.2) ##### 👷♂️ Patch fixes - Fixes SSRF security vulnerability by doing a target-origin bypass in the proxy server in [@​happy-dom/server-renderer](https://redirect.github.com/capricorn86/happy-dom/wiki/Server-Renderer) - By **[@​capricorn86](https://redirect.github.com/capricorn86)** </details> --- ### Configuration 📅 **Schedule**: (UTC) - Branch creation - At any time (no schedule defined) - Automerge - At any time (no schedule defined) 🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied. ♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox. 🔕 **Ignore**: Close this PR and you won't be reminded about this update again. --- - [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check this box --- This PR was generated by [Mend Renovate](https://mend.io/renovate/). View the [repository job log](https://developer.mend.io/github/authelia/authelia). <!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0NC4xNjQuMSIsInVwZGF0ZWRJblZlciI6IjQ0LjE2NC4xIiwidGFyZ2V0QnJhbmNoIjoibWFzdGVyIiwibGFiZWxzIjpbImRlcGVuZGVuY2llcyIsImphdmFzY3JpcHQiXX0=--> Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com> |
||
|
renovate[bot]
|
c9da21a16b |
build(deps): update dependency @eslint/css to v2.0.1 (#13492)
This PR contains the following updates: | Package | Change | [Age](https://docs.renovatebot.com/merge-confidence/) | [Confidence](https://docs.renovatebot.com/merge-confidence/) | |---|---|---|---| | [@eslint/css](https://redirect.github.com/eslint/css) | [`2.0.0` → `2.0.1`](https://renovatebot.com/diffs/npm/@eslint%2fcss/2.0.0/2.0.1) |  |  | --- ### Release Notes <details> <summary>eslint/css (@​eslint/css)</summary> ### [`v2.0.1`](https://redirect.github.com/eslint/css/blob/HEAD/CHANGELOG.md#201-2026-10-11) [Compare Source](https://redirect.github.com/eslint/css/compare/cb523536527359e5eb0a7aeaf2d3abc5d44032c2...c29255e6f9551360319c09470b406b03d2da31ca) ##### Bug Fixes - allow additional properties in `CSSLanguageOptions` ([#​538](https://redirect.github.com/eslint/css/issues/538)) ([471e568](https://redirect.github.com/eslint/css/commit/471e56813150cbfb5a1f27aa7602f0131dc56578)) - crash in `no-important` on non-standard important values ([#​541](https://redirect.github.com/eslint/css/issues/541)) ([2985ad5](https://redirect.github.com/eslint/css/commit/2985ad5a79b33d355bafd8156e81bbe16921d7dd)) - handle `var()` and `env()` in `no-invalid-at-rules` ([#​570](https://redirect.github.com/eslint/css/issues/570)) ([75050c3](https://redirect.github.com/eslint/css/commit/75050c315c3f3bed6bd399f7508d262cf2f59f43)) - preserve keyframe selector casing in error messages ([#​571](https://redirect.github.com/eslint/css/issues/571)) ([6589273](https://redirect.github.com/eslint/css/commit/6589273acf49edd67f46bbb28e2c9d63da3a1395)) - preserve property casing in `use-baseline` messages ([#​573](https://redirect.github.com/eslint/css/issues/573)) ([0f65765](https://redirect.github.com/eslint/css/commit/0f65765423b927fdce89d4499730c6d6fa9e20f4)) - prevent crashes on `[@supports](https://redirect.github.com/supports)` queries in `use-baseline` ([#​576](https://redirect.github.com/eslint/css/issues/576)) ([6ecf264](https://redirect.github.com/eslint/css/commit/6ecf264a402d47d17ff33cf1e5676729ab04f513)) - recognize `at-rule()` feature queries in `use-baseline` ([#​533](https://redirect.github.com/eslint/css/issues/533)) ([ba65596](https://redirect.github.com/eslint/css/commit/ba655964e8d4bb424638ab1c56dcf50a24231130)) - recognize CSS whitespace in named grid areas ([#​556](https://redirect.github.com/eslint/css/issues/556)) ([ea5407d](https://redirect.github.com/eslint/css/commit/ea5407ddd542955b820271db75b4fef73b9bf79e)) - report each disallowed attribute location in `selector-complexity` ([#​580](https://redirect.github.com/eslint/css/issues/580)) ([2bf2350](https://redirect.github.com/eslint/css/commit/2bf2350be041912803ad4680f03f582bb6fb6587)) - support at-rules nested in `[@page](https://redirect.github.com/page)` and `[@font-feature-values](https://redirect.github.com/font-feature-values)` ([#​543](https://redirect.github.com/eslint/css/issues/543)) ([12ec029](https://redirect.github.com/eslint/css/commit/12ec029258de03056d8533a6960de154d8fb7e76)) - update baseline data ([bcd705e](https://redirect.github.com/eslint/css/commit/bcd705e7536d47dd8aff8fb0b5dc9d6f3d72e276)) - update baseline data ([#​561](https://redirect.github.com/eslint/css/issues/561)) ([94d79a4](https://redirect.github.com/eslint/css/commit/94d79a46c8249fc6d12e6c02132952e106a53b68)) - update baseline data ([#​566](https://redirect.github.com/eslint/css/issues/566)) ([9856c3b](https://redirect.github.com/eslint/css/commit/9856c3b6f25f4ebaf2930b130159264b9d381628)) - update baseline data ([#​579](https://redirect.github.com/eslint/css/issues/579)) ([c60193b](https://redirect.github.com/eslint/css/commit/c60193bbc365efe94fa4c908f73f630bb3ce90c4)) - update baseline data ([#​585](https://redirect.github.com/eslint/css/issues/585)) ([7a2dc06](https://redirect.github.com/eslint/css/commit/7a2dc06e0b08b89af01767efd8ae3290c4060f94)) - update baseline data ([#​589](https://redirect.github.com/eslint/css/issues/589)) ([38ac3ad](https://redirect.github.com/eslint/css/commit/38ac3ade993e0bd168a230c0ac8c583fc6978e0f)) - update dependency [@​eslint/css-tree](https://redirect.github.com/eslint/css-tree) to ^4.1.1 ([#​568](https://redirect.github.com/eslint/css/issues/568)) ([ae69b1a](https://redirect.github.com/eslint/css/commit/ae69b1ad922f0c96e11bd4421033a92209e6afed)) - update eslint ([#​554](https://redirect.github.com/eslint/css/issues/554)) ([33e7314](https://redirect.github.com/eslint/css/commit/33e7314cf4127543f1863ebeab13a8b7ecc8f161)) </details> --- ### Configuration 📅 **Schedule**: (UTC) - Branch creation - At any time (no schedule defined) - Automerge - At any time (no schedule defined) 🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied. ♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox. 🔕 **Ignore**: Close this PR and you won't be reminded about this update again. --- - [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check this box --- This PR was generated by [Mend Renovate](https://mend.io/renovate/). View the [repository job log](https://developer.mend.io/github/authelia/authelia). <!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0NC4xNjQuMSIsInVwZGF0ZWRJblZlciI6IjQ0LjE2NC4xIiwidGFyZ2V0QnJhbmNoIjoibWFzdGVyIiwibGFiZWxzIjpbImRlcGVuZGVuY2llcyIsImphdmFzY3JpcHQiXX0=--> Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com> |
||
|
renovate[bot]
|
b5698cb156 |
build(deps): update authelia/base:latest docker digest to c9cedf4 (#13490)
This PR contains the following updates: | Package | Type | Update | Change | |---|---|---|---| | authelia/base | final | digest | `b008bbb` → `c9cedf4` | --- ### Configuration 📅 **Schedule**: (UTC) - Branch creation - At any time (no schedule defined) - Automerge - At any time (no schedule defined) 🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied. ♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox. 🔕 **Ignore**: Close this PR and you won't be reminded about this update again. --- - [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check this box --- This PR was generated by [Mend Renovate](https://mend.io/renovate/). View the [repository job log](https://developer.mend.io/github/authelia/authelia). <!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0NC4xNjQuMSIsInVwZGF0ZWRJblZlciI6IjQ0LjE2NC4xIiwidGFyZ2V0QnJhbmNoIjoibWFzdGVyIiwibGFiZWxzIjpbImRlcGVuZGVuY2llcyIsImRvY2tlciJdfQ==--> Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com> |
||
|
renovate[bot]
|
cb4b7c0766 |
build(deps): update dependency baseline-browser-mapping to v2.11.29 (#13491)
This PR contains the following updates: | Package | Change | [Age](https://docs.renovatebot.com/merge-confidence/) | [Confidence](https://docs.renovatebot.com/merge-confidence/) | |---|---|---|---| | [baseline-browser-mapping](https://redirect.github.com/web-platform-dx/baseline-browser-mapping) | [`2.11.28` → `2.11.29`](https://renovatebot.com/diffs/npm/baseline-browser-mapping/2.11.28/2.11.29) |  |  | --- ### Release Notes <details> <summary>web-platform-dx/baseline-browser-mapping (baseline-browser-mapping)</summary> ### [`v2.11.29`](https://redirect.github.com/web-platform-dx/baseline-browser-mapping/compare/v2.11.28...v2.11.29) [Compare Source](https://redirect.github.com/web-platform-dx/baseline-browser-mapping/compare/v2.11.28...v2.11.29) </details> --- ### Configuration 📅 **Schedule**: (UTC) - Branch creation - At any time (no schedule defined) - Automerge - At any time (no schedule defined) 🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied. ♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox. 🔕 **Ignore**: Close this PR and you won't be reminded about this update again. --- - [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check this box --- This PR was generated by [Mend Renovate](https://mend.io/renovate/). View the [repository job log](https://developer.mend.io/github/authelia/authelia). <!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0NC4xNjQuMSIsInVwZGF0ZWRJblZlciI6IjQ0LjE2NC4xIiwidGFyZ2V0QnJhbmNoIjoibWFzdGVyIiwibGFiZWxzIjpbImRlcGVuZGVuY2llcyIsImphdmFzY3JpcHQiXX0=--> Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com> |
||
|
renovate[bot]
|
7f3aad82ca |
build(deps): update pnpm to v12.14.0 (#13487)
This PR contains the following updates: | Package | Change | [Age](https://docs.renovatebot.com/merge-confidence/) | [Confidence](https://docs.renovatebot.com/merge-confidence/) | |---|---|---|---| | [pnpm](https://pnpm.io) ([source](https://redirect.github.com/pnpm/pnpm/tree/HEAD/pnpm/npm/pnpm)) | [`12.11.2` → `12.14.0`](https://renovatebot.com/diffs/npm/pnpm/12.11.2/12.14.0) |  |  | --- ### Release Notes <details> <summary>pnpm/pnpm (pnpm)</summary> ### [`v12.14.0`](https://redirect.github.com/pnpm/pnpm/releases/tag/v12.14.0): pnpm 12.14.0 [Compare Source](https://redirect.github.com/pnpm/pnpm/compare/v12.13.0...v12.14.0) This release adds the `sideEffectsCache.exclude` setting, stops `pnpm install` from waiting on the daily update check, and keeps pnpm from aborting with a core dump when the reader of its output exits. ##### Minor Changes - Added the `sideEffectsCache.exclude` setting for packages whose build depends on something pnpm cannot include in the cache key, such as the system libraries a native addon links against. pnpm builds the listed packages in every project and never restores or saves their builds through the side-effects cache, locally or on a `remoteCache` server. Under the global virtual store, each project gets its own copy of these packages and of the packages that depend on them. Entries use the same `name`, `@scope/*`, and `name@version` patterns as `minimumReleaseAgeExclude` [#​5271](https://redirect.github.com/pnpm/pnpm/issues/5271). - `pnpm login` now prints the `npm-notice` response header during web-based login. Registries use it to show the verification code that completes the sign-in in the browser. ##### Patch Changes ##### Installing packages - `pnpm install` and `pnpm add` no longer wait for the daily update check. If the command finishes first, pnpm skips the update notice and checks again next time. On a registry that accepted the connection but never answered, an install that had nothing to do used to take minutes [#​16839](https://redirect.github.com/pnpm/pnpm/issues/16839). - `pnpm install`, `pnpm add` and `pnpm update` now reuse `pnpm-lock.yaml` when the workspace configures a catalog entry that no dependency references, such as an unused entry or one whose package an `overrides` entry replaces. Before, every resolution in such a workspace resolved all dependencies again from the registry [#​16923](https://redirect.github.com/pnpm/pnpm/issues/16923). - `pnpm install` now looks up a git dependency's branch or tag once per install, even when many workspace projects depend on it. With `linkWorkspacePackages` enabled, it used to run `git ls-remote` once per project [#​16899](https://redirect.github.com/pnpm/pnpm/issues/16899). - A filtered install, such as `pnpm install --filter <pkg>`, now keeps the `pnpm-lock.yaml` entries of workspace projects that are missing from disk, as in a sparse checkout. Their importers, packages, and catalog entries stay even when the filter matches every project on disk [#​16931](https://redirect.github.com/pnpm/pnpm/issues/16931). - pnpm now decides whether a dependency that a package also declares as an optional peer is linked as a dependency or as a peer from the shallowest path that reaches the package. When an existing lockfile records such a dependency as a regular dependency and a newly added dependency now provides the peer, pnpm records it as a peer, as a fresh install does. The lockfile entry of such a package can change on the next install [#​16901](https://redirect.github.com/pnpm/pnpm/issues/16901). - An install that adds nothing to the store no longer changes the modification time of the store directory. CI caches that check modification times, such as GitLab's, no longer re-upload an unchanged store [#​16929](https://redirect.github.com/pnpm/pnpm/issues/16929). ##### Running commands and scripts - pnpm no longer aborts with a core dump when the reader of its output has exited, as in `pnpm list | head -1` or `pnpm start 2>&1 | head -1`. The command finishes with its usual exit code, and a failing script's exit code is kept. A write to stdout that fails for another reason, such as a full disk, ends the command with exit code 1 [#​16904](https://redirect.github.com/pnpm/pnpm/issues/16904) [pnpm/tasks#132](https://redirect.github.com/pnpm/tasks/issues/132). - On Windows, `pnpm exec`, `pnpm run`, and commands such as `pnpm nx` now return when the command they run exits, even if it left a detached process running and pnpm's output is redirected or piped. Previously a shell reading that output waited until the detached process, such as the Nx daemon, exited [#​16930](https://redirect.github.com/pnpm/pnpm/issues/16930). - Commands that do not write the project manifest now leave a missing `package.json` absent. This covers queries such as `pnpm why` and `pnpm outdated`, `pnpm fetch`, `pnpm dedupe --check`, and commands that exit with an error, such as `pnpm rt ls`. These commands used to create one from the initialization template. `pnpm sbom` run from a lockfile alone now reports the root component as `unknown` with version `0.0.0` [#​16907](https://redirect.github.com/pnpm/pnpm/issues/16907). - `pnpm run` now reports a failed script as a JSON record under `--reporter=ndjson`. It printed a plain `[ELIFECYCLE]` line to stderr. - `pnpm run` no longer prints `[ELIFECYCLE] Command failed with exit code N.` to stderr when a script fails under `--reporter=silent`, `--silent`, or `--loglevel=silent`. - `pnpm pipeline --dry-run` no longer writes a run report when no projects are selected. With `--json` it prints `{"tasks": []}` [pnpm/tasks#126](https://redirect.github.com/pnpm/tasks/issues/126). ##### Packing and publishing - `pnpm pack` and `pnpm publish` now ship the whole gitignored directory that `main`, `browser`, or `bin` points into, as npm does. Previously only the `main` and `bin` files themselves were packed, and a gitignored `browser` file was left out [#​16908](https://redirect.github.com/pnpm/pnpm/issues/16908). - `pnpm pack` and `pnpm publish` now honor a `.npmignore` or `.gitignore` inside a subdirectory when `package.json` has a `files` field. The package root's ignore files and those inherited from the workspace are still skipped [#​16909](https://redirect.github.com/pnpm/pnpm/issues/16909). ##### Setting up pnpm and toolchains - `--registry`, `--https-proxy`, `--http-proxy`, and `--no-proxy` now apply when pnpm resolves and downloads the pnpm version a project pins in `packageManager`. Before, these lookups went to `https://registry.npmjs.org/`, which a firewall that only allows a private registry blocks [#​16911](https://redirect.github.com/pnpm/pnpm/discussions/16911). - On Windows, `pnpm install` now installs the Rust toolchain for rustup's default host, so a machine set up with `rustup set default-host x86_64-pc-windows-gnu` gets the MinGW toolchain. Without a default host, pnpm installs the MSVC toolchain for the machine's architecture, as rustup does. This includes a pnpm built for MinGW, such as the MSYS2 package, which has installed the MinGW toolchain since 12.13.0. An x64 pnpm on ARM64 Windows now installs the ARM64 toolchain [#​16854](https://redirect.github.com/pnpm/pnpm/issues/16854). <!-- sponsors --> ##### Platinum Sponsors <table> <tbody> <tr> <td align="center" valign="middle"> <a href="https://bit.cloud/?utm_source=pnpm&utm_medium=release_notes" target="_blank" rel="noopener noreferrer"><img src="https://pnpm.io/img/users/bit.svg" width="80" alt="Bit"></a> </td> <td align="center" valign="middle"> <a href="https://openai.com/?utm_source=pnpm&utm_medium=release_notes" target="_blank" rel="noopener noreferrer"> <picture> <source media="(prefers-color-scheme: light)" srcset="https://pnpm.io/img/users/openai_dark.svg" /> <source media="(prefers-color-scheme: dark)" srcset="https://pnpm.io/img/users/openai_light.svg" /> <img src="https://pnpm.io/img/users/openai_dark.svg" width="160" alt="OpenAI" /> </picture> </a> </td> <td align="center" valign="middle"> <a href="https://notion.com/?utm_source=pnpm&utm_medium=release_notes" target="_blank" rel="noopener noreferrer"><img src="https://pnpm.io/img/users/notion.svg" width="80" alt="Notion"></a> </td> </tr> <tr> <td align="center" valign="middle"> <a href="https://coderabbit.ai/?utm_source=pnpm&utm_medium=release_notes" target="_blank" rel="noopener noreferrer"> <picture> <source media="(prefers-color-scheme: light)" srcset="https://pnpm.io/img/users/coderabbit.svg" /> <source media="(prefers-color-scheme: dark)" srcset="https://pnpm.io/img/users/coderabbit_light.svg" /> <img src="https://pnpm.io/img/users/coderabbit.svg" width="220" alt="CodeRabbit" /> </picture> </a> </td> </tr> </tbody> </table> ##### Gold Sponsors <table> <tbody> <tr> <td align="center" valign="middle"> <a href="https://sanity.io/?utm_source=pnpm&utm_medium=release_notes" target="_blank" rel="noopener noreferrer"> <picture> <source media="(prefers-color-scheme: light)" srcset="https://pnpm.io/img/users/sanity.svg" /> <source media="(prefers-color-scheme: dark)" srcset="https://pnpm.io/img/users/sanity_light.svg" /> <img src="https://pnpm.io/img/users/sanity.svg" width="120" alt="Sanity" /> </picture> </a> </td> <td align="center" valign="middle"> <a href="https://discord.com/?utm_source=pnpm&utm_medium=release_notes" target="_blank" rel="noopener noreferrer"> <picture> <source media="(prefers-color-scheme: light)" srcset="https://pnpm.io/img/users/discord.svg" /> <source media="(prefers-color-scheme: dark)" srcset="https://pnpm.io/img/users/discord_light.svg" /> <img src="https://pnpm.io/img/users/discord.svg" width="220" alt="Discord" /> </picture> </a> </td> <td align="center" valign="middle"> <a href="https://vite.dev/?utm_source=pnpm&utm_medium=release_notes" target="_blank" rel="noopener noreferrer"><img src="https://pnpm.io/img/users/vitejs.svg" width="42" alt="Vite"></a> </td> </tr> <tr> <td align="center" valign="middle"> <a href="https://serpapi.com/?utm_source=pnpm&utm_medium=release_notes" target="_blank" rel="noopener noreferrer"> <picture> <source media="(prefers-color-scheme: light)" srcset="https://pnpm.io/img/users/serpapi_dark.svg" /> <source media="(prefers-color-scheme: dark)" srcset="https://pnpm.io/img/users/serpapi_light.svg" /> <img src="https://pnpm.io/img/users/serpapi_dark.svg" width="160" alt="SerpApi" /> </picture> </a> </td> <td align="center" valign="middle"> <a href="https://stackblitz.com/?utm_source=pnpm&utm_medium=release_notes" target="_blank" rel="noopener noreferrer"> <picture> <source media="(prefers-color-scheme: light)" srcset="https://pnpm.io/img/users/stackblitz.svg" /> <source media="(prefers-color-scheme: dark)" srcset="https://pnpm.io/img/users/stackblitz_light.svg" /> <img src="https://pnpm.io/img/users/stackblitz.svg" width="190" alt="Stackblitz" /> </picture> </a> </td> <td align="center" valign="middle"> <a href="https://workleap.com/?utm_source=pnpm&utm_medium=release_notes" target="_blank" rel="noopener noreferrer"> <picture> <source media="(prefers-color-scheme: light)" srcset="https://pnpm.io/img/users/workleap.svg" /> <source media="(prefers-color-scheme: dark)" srcset="https://pnpm.io/img/users/workleap_light.svg" /> <img src="https://pnpm.io/img/users/workleap.svg" width="190" alt="Workleap" /> </picture> </a> </td> </tr> <tr> <td align="center" valign="middle"> <a href="https://nx.dev/?utm_source=pnpm&utm_medium=release_notes" target="_blank" rel="noopener noreferrer"> <picture> <source media="(prefers-color-scheme: light)" srcset="https://pnpm.io/img/users/nx.svg" /> <source media="(prefers-color-scheme: dark)" srcset="https://pnpm.io/img/users/nx_light.svg" /> <img src="https://pnpm.io/img/users/nx.svg" width="50" alt="Nx" /> </picture> </a> </td> <td align="center" valign="middle"> <a href="https://latitude.so/?utm_source=pnpm&utm_medium=release_notes" target="_blank" rel="noopener noreferrer"><img src="https://pnpm.io/img/users/latitude.svg" width="160" alt="Latitude"></a> </td> </tr> </tbody> </table> <!-- sponsors end --> ### [`v12.13.0`](https://redirect.github.com/pnpm/pnpm/releases/tag/v12.13.0): pnpm 12.13.0 [Compare Source](https://redirect.github.com/pnpm/pnpm/compare/v12.12.1...v12.13.0) This release adds the `pnpm profile` and `pnpm token` commands, the `storeIndexFormat: files` setting for stores shared over a network filesystem, and faster Python dependency resolution. ##### Minor Changes - Added the `pnpm profile` command to view and update registry user profile settings. - Added `pnpm token` to list, create, and revoke authentication tokens on the registry. - Added the `storeIndexFormat` setting. Set it to `files` to keep a store's package index as one file per package instead of the SQLite `index.db`, for a store on a network filesystem that several machines use at once. SQLite's locking does not work across machines, so concurrent installs on such a store could corrupt `index.db`. - Added the `nodePackageMap` setting, which groups the package-map settings. `nodePackageMap.mode: write-only` writes `node_modules/.package-map.json` for other tools without making Node.js load it. `mode: load` also makes Node.js load the map, like `nodeExperimentalPackageMap: true`. `nodePackageMap.type` replaces `nodePackageMapType`. The old settings still work [#​14937](https://redirect.github.com/pnpm/pnpm/issues/14937). ```yaml nodePackageMap: mode: write-only type: loose ``` ##### Patch Changes ##### Setting up pnpm - `pnpm setup` now works when pnpm was installed with npm on macOS. It installed pnpm from npm's `bin` directory and left a `$PNPM_HOME/bin/pnpm` that could not run [#​16855](https://redirect.github.com/pnpm/pnpm/issues/16855). - pnpm runs again after `pnpm setup` when `globalShims` enables pnpm. Every command failed with "the global target of the pnpm shim points back at the shim" [#​16874](https://redirect.github.com/pnpm/pnpm/issues/16874). - A pnpm built for the MinGW target on Windows, such as the MSYS2 package, now installs the MinGW Rust toolchain that `rust-toolchain.toml` names. It used to install the MSVC toolchain. ##### Installing packages - On macOS, `pnpm install` no longer fails with `ERR_PNPM_LOCKFILE_WRITE_FILE` when the project is on a virtiofs or SMB share. pnpm now falls back to a regular `fsync` when the file system rejects a full sync [#​16846](https://redirect.github.com/pnpm/pnpm/issues/16846). - On macOS, `pnpm install`, `pnpm patch-commit`, and other commands that load a pnpmfile no longer hang at random. - `pnpm install` now puts the executables of a Python build backend's requirements on the `PATH` while the backend runs. Projects built with `uv_build` now install. Before, they failed with "uv-build was not properly installed". - Removing a `link:` dependency now also removes its symlink from `node_modules` when `nodeLinker` is `hoisted` [#​16884](https://redirect.github.com/pnpm/pnpm/issues/16884). - `pnpm-lock.yaml` no longer records the tarball URL of a package installed from a scoped registry, such as one set by `@types:registry=`, when pnpm can rebuild the URL from that registry [#​16866](https://redirect.github.com/pnpm/pnpm/issues/16866). ##### Packing, auditing, and pipelines - `pnpm pack` and `pnpm publish` now pack only `package.json`, the README, the license, and the files named in `main` and `bin` when `files` is an empty array. They used to pack every file in the package [#​16889](https://redirect.github.com/pnpm/pnpm/issues/16889). - `pnpm audit` and `pnpm audit signatures` no longer check runtimes installed through `devEngines.runtime`, such as `node@runtime:24.21.0`, against the npm package of the same name. `pnpm audit signatures` reported these runtimes as having an invalid registry signature [#​16869](https://redirect.github.com/pnpm/pnpm/issues/16869). - `pnpm pipeline` now runs the root's tasks when `pnpm-workspace.yaml` lists only the root in `packages` or omits `packages`, as `pnpm -r run` does. A change to a root file in such a workspace no longer triggers a full-run warning. When a full run has no projects to run, `pnpm pipeline` now reports that no projects are selected [#​16849](https://redirect.github.com/pnpm/pnpm/issues/16849). ##### Performance - `pnpm install` resolves Python dependencies faster. With `--lockfile-only`, a project with 10 dependencies now resolves in about 4 seconds, down from about 40. When the index publishes a metadata file beside each wheel (PEP 658), as PyPI does, pnpm downloads only the wheels of the releases it selects. - A repeat install against an existing lockfile no longer reads registry metadata for the dependencies it takes from that lockfile. On a warm store this removes thousands of metadata lookups from a repeat install of a large workspace. - `pnpm install` with `enableModulesDir: false` now verifies the packages already in the store while the dependencies resolve, and checks a package's files in parallel. On a 5,100-package install with the store on a network filesystem, this removed a 19-second pause between resolution and fetching. <!-- sponsors --> #### Platinum Sponsors <table> <tbody> <tr> <td align="center" valign="middle"> <a href="https://bit.cloud/?utm_source=pnpm&utm_medium=release_notes" target="_blank" rel="noopener noreferrer"><img src="https://pnpm.io/img/users/bit.svg" width="80" alt="Bit"></a> </td> <td align="center" valign="middle"> <a href="https://openai.com/?utm_source=pnpm&utm_medium=release_notes" target="_blank" rel="noopener noreferrer"> <picture> <source media="(prefers-color-scheme: light)" srcset="https://pnpm.io/img/users/openai_dark.svg" /> <source media="(prefers-color-scheme: dark)" srcset="https://pnpm.io/img/users/openai_light.svg" /> <img src="https://pnpm.io/img/users/openai_dark.svg" width="160" alt="OpenAI" /> </picture> </a> </td> <td align="center" valign="middle"> <a href="https://notion.com/?utm_source=pnpm&utm_medium=release_notes" target="_blank" rel="noopener noreferrer"><img src="https://pnpm.io/img/users/notion.svg" width="80" alt="Notion"></a> </td> </tr> <tr> <td align="center" valign="middle"> <a href="https://coderabbit.ai/?utm_source=pnpm&utm_medium=release_notes" target="_blank" rel="noopener noreferrer"> <picture> <source media="(prefers-color-scheme: light)" srcset="https://pnpm.io/img/users/coderabbit.svg" /> <source media="(prefers-color-scheme: dark)" srcset="https://pnpm.io/img/users/coderabbit_light.svg" /> <img src="https://pnpm.io/img/users/coderabbit.svg" width="220" alt="CodeRabbit" /> </picture> </a> </td> </tr> </tbody> </table> #### Gold Sponsors <table> <tbody> <tr> <td align="center" valign="middle"> <a href="https://sanity.io/?utm_source=pnpm&utm_medium=release_notes" target="_blank" rel="noopener noreferrer"> <picture> <source media="(prefers-color-scheme: light)" srcset="https://pnpm.io/img/users/sanity.svg" /> <source media="(prefers-color-scheme: dark)" srcset="https://pnpm.io/img/users/sanity_light.svg" /> <img src="https://pnpm.io/img/users/sanity.svg" width="120" alt="Sanity" /> </picture> </a> </td> <td align="center" valign="middle"> <a href="https://discord.com/?utm_source=pnpm&utm_medium=release_notes" target="_blank" rel="noopener noreferrer"> <picture> <source media="(prefers-color-scheme: light)" srcset="https://pnpm.io/img/users/discord.svg" /> <source media="(prefers-color-scheme: dark)" srcset="https://pnpm.io/img/users/discord_light.svg" /> <img src="https://pnpm.io/img/users/discord.svg" width="220" alt="Discord" /> </picture> </a> </td> <td align="center" valign="middle"> <a href="https://vite.dev/?utm_source=pnpm&utm_medium=release_notes" target="_blank" rel="noopener noreferrer"><img src="https://pnpm.io/img/users/vitejs.svg" width="42" alt="Vite"></a> </td> </tr> <tr> <td align="center" valign="middle"> <a href="https://serpapi.com/?utm_source=pnpm&utm_medium=release_notes" target="_blank" rel="noopener noreferrer"> <picture> <source media="(prefers-color-scheme: light)" srcset="https://pnpm.io/img/users/serpapi_dark.svg" /> <source media="(prefers-color-scheme: dark)" srcset="https://pnpm.io/img/users/serpapi_light.svg" /> <img src="https://pnpm.io/img/users/serpapi_dark.svg" width="160" alt="SerpApi" /> </picture> </a> </td> <td align="center" valign="middle"> <a href="https://stackblitz.com/?utm_source=pnpm&utm_medium=release_notes" target="_blank" rel="noopener noreferrer"> <picture> <source media="(prefers-color-scheme: light)" srcset="https://pnpm.io/img/users/stackblitz.svg" /> <source media="(prefers-color-scheme: dark)" srcset="https://pnpm.io/img/users/stackblitz_light.svg" /> <img src="https://pnpm.io/img/users/stackblitz.svg" width="190" alt="Stackblitz" /> </picture> </a> </td> <td align="center" valign="middle"> <a href="https://workleap.com/?utm_source=pnpm&utm_medium=release_notes" target="_blank" rel="noopener noreferrer"> <picture> <source media="(prefers-color-scheme: light)" srcset="https://pnpm.io/img/users/workleap.svg" /> <source media="(prefers-color-scheme: dark)" srcset="https://pnpm.io/img/users/workleap_light.svg" /> <img src="https://pnpm.io/img/users/workleap.svg" width="190" alt="Workleap" /> </picture> </a> </td> </tr> <tr> <td align="center" valign="middle"> <a href="https://nx.dev/?utm_source=pnpm&utm_medium=release_notes" target="_blank" rel="noopener noreferrer"> <picture> <source media="(prefers-color-scheme: light)" srcset="https://pnpm.io/img/users/nx.svg" /> <source media="(prefers-color-scheme: dark)" srcset="https://pnpm.io/img/users/nx_light.svg" /> <img src="https://pnpm.io/img/users/nx.svg" width="50" alt="Nx" /> </picture> </a> </td> <td align="center" valign="middle"> <a href="https://latitude.so/?utm_source=pnpm&utm_medium=release_notes" target="_blank" rel="noopener noreferrer"><img src="https://pnpm.io/img/users/latitude.svg" width="160" alt="Latitude"></a> </td> </tr> </tbody> </table> <!-- sponsors end --> ### [`v12.12.1`](https://redirect.github.com/pnpm/pnpm/releases/tag/v12.12.1): pnpm 12.12.1 [Compare Source](https://redirect.github.com/pnpm/pnpm/compare/v12.12.0...v12.12.1) This release adds OIDC authentication to `pnpm dist-tag` and the `tool:` protocol. `pnpm publish` now checks which registry an `NPM_ID_TOKEN` was issued for before using it. ##### Patch Changes - `pnpm publish` now uses an `NPM_ID_TOKEN` only if its `aud` claim matches the selected registry, such as `npm:registry.npmjs.org`. A token for another registry is skipped with a warning, and pnpm falls back to the configured credentials. - `pnpm dist-tag add`, `rm`, and `ls` now support OIDC authentication in CI. Enable "Allow npm dist-tag" in the package's trusted publishing settings to manage tags without a stored npm token. - Added the `tool:` protocol for the tools pnpm downloads itself: Node.js, Bun, Deno, and Yarn. `pnpm add bun@tool:1.3.0`, `pnx node@tool:22`, and `pnx yarn@tool:4` work like the `runtime:` spelling, which stays supported as an alias. A lockfile written for `runtime:` stays up to date when `package.json` switches to `tool:`, and the other way around. A named registry can no longer be called `tool`. <!-- sponsors --> #### Platinum Sponsors <table> <tbody> <tr> <td align="center" valign="middle"> <a href="https://bit.cloud/?utm_source=pnpm&utm_medium=release_notes" target="_blank" rel="noopener noreferrer"><img src="https://pnpm.io/img/users/bit.svg" width="80" alt="Bit"></a> </td> <td align="center" valign="middle"> <a href="https://openai.com/?utm_source=pnpm&utm_medium=release_notes" target="_blank" rel="noopener noreferrer"> <picture> <source media="(prefers-color-scheme: light)" srcset="https://pnpm.io/img/users/openai_dark.svg" /> <source media="(prefers-color-scheme: dark)" srcset="https://pnpm.io/img/users/openai_light.svg" /> <img src="https://pnpm.io/img/users/openai_dark.svg" width="160" alt="OpenAI" /> </picture> </a> </td> <td align="center" valign="middle"> <a href="https://notion.com/?utm_source=pnpm&utm_medium=release_notes" target="_blank" rel="noopener noreferrer"><img src="https://pnpm.io/img/users/notion.svg" width="80" alt="Notion"></a> </td> </tr> <tr> <td align="center" valign="middle"> <a href="https://coderabbit.ai/?utm_source=pnpm&utm_medium=release_notes" target="_blank" rel="noopener noreferrer"> <picture> <source media="(prefers-color-scheme: light)" srcset="https://pnpm.io/img/users/coderabbit.svg" /> <source media="(prefers-color-scheme: dark)" srcset="https://pnpm.io/img/users/coderabbit_light.svg" /> <img src="https://pnpm.io/img/users/coderabbit.svg" width="220" alt="CodeRabbit" /> </picture> </a> </td> </tr> </tbody> </table> #### Gold Sponsors <table> <tbody> <tr> <td align="center" valign="middle"> <a href="https://sanity.io/?utm_source=pnpm&utm_medium=release_notes" target="_blank" rel="noopener noreferrer"> <picture> <source media="(prefers-color-scheme: light)" srcset="https://pnpm.io/img/users/sanity.svg" /> <source media="(prefers-color-scheme: dark)" srcset="https://pnpm.io/img/users/sanity_light.svg" /> <img src="https://pnpm.io/img/users/sanity.svg" width="120" alt="Sanity" /> </picture> </a> </td> <td align="center" valign="middle"> <a href="https://discord.com/?utm_source=pnpm&utm_medium=release_notes" target="_blank" rel="noopener noreferrer"> <picture> <source media="(prefers-color-scheme: light)" srcset="https://pnpm.io/img/users/discord.svg" /> <source media="(prefers-color-scheme: dark)" srcset="https://pnpm.io/img/users/discord_light.svg" /> <img src="https://pnpm.io/img/users/discord.svg" width="220" alt="Discord" /> </picture> </a> </td> <td align="center" valign="middle"> <a href="https://vite.dev/?utm_source=pnpm&utm_medium=release_notes" target="_blank" rel="noopener noreferrer"><img src="https://pnpm.io/img/users/vitejs.svg" width="42" alt="Vite"></a> </td> </tr> <tr> <td align="center" valign="middle"> <a href="https://serpapi.com/?utm_source=pnpm&utm_medium=release_notes" target="_blank" rel="noopener noreferrer"> <picture> <source media="(prefers-color-scheme: light)" srcset="https://pnpm.io/img/users/serpapi_dark.svg" /> <source media="(prefers-color-scheme: dark)" srcset="https://pnpm.io/img/users/serpapi_light.svg" /> <img src="https://pnpm.io/img/users/serpapi_dark.svg" width="160" alt="SerpApi" /> </picture> </a> </td> <td align="center" valign="middle"> <a href="https://stackblitz.com/?utm_source=pnpm&utm_medium=release_notes" target="_blank" rel="noopener noreferrer"> <picture> <source media="(prefers-color-scheme: light)" srcset="https://pnpm.io/img/users/stackblitz.svg" /> <source media="(prefers-color-scheme: dark)" srcset="https://pnpm.io/img/users/stackblitz_light.svg" /> <img src="https://pnpm.io/img/users/stackblitz.svg" width="190" alt="Stackblitz" /> </picture> </a> </td> <td align="center" valign="middle"> <a href="https://workleap.com/?utm_source=pnpm&utm_medium=release_notes" target="_blank" rel="noopener noreferrer"> <picture> <source media="(prefers-color-scheme: light)" srcset="https://pnpm.io/img/users/workleap.svg" /> <source media="(prefers-color-scheme: dark)" srcset="https://pnpm.io/img/users/workleap_light.svg" /> <img src="https://pnpm.io/img/users/workleap.svg" width="190" alt="Workleap" /> </picture> </a> </td> </tr> <tr> <td align="center" valign="middle"> <a href="https://nx.dev/?utm_source=pnpm&utm_medium=release_notes" target="_blank" rel="noopener noreferrer"> <picture> <source media="(prefers-color-scheme: light)" srcset="https://pnpm.io/img/users/nx.svg" /> <source media="(prefers-color-scheme: dark)" srcset="https://pnpm.io/img/users/nx_light.svg" /> <img src="https://pnpm.io/img/users/nx.svg" width="50" alt="Nx" /> </picture> </a> </td> <td align="center" valign="middle"> <a href="https://latitude.so/?utm_source=pnpm&utm_medium=release_notes" target="_blank" rel="noopener noreferrer"><img src="https://pnpm.io/img/users/latitude.svg" width="160" alt="Latitude"></a> </td> </tr> </tbody> </table> <!-- sponsors end --> ### [`v12.12.0`](https://redirect.github.com/pnpm/pnpm/releases/tag/v12.12.0): pnpm 12.12.0 [Compare Source](https://redirect.github.com/pnpm/pnpm/compare/v12.11.2...v12.12.0) This release shares task results and dependency builds through a remote cache, adds the `addMissingPeerTypes` setting, and lets `pnpm add --config` and `pnpm update` manage configuration dependencies. It also fixes `dangerouslyAllowAllBuilds` running the build scripts of packages that `allowBuilds` denies. ##### Minor Changes - `pnpm pipeline` can share task results between machines. A result is a signed artifact stored on a pnpr server or on a server that speaks the Turborepo Remote Cache API, such as Vercel Remote Cache. The remote side-effects cache can also store dependency builds on a Turborepo Remote Cache server. Both caches read the new `remoteCache` setting, which names the server and holds the signing keys. `pnpm pipeline --report` records the run under the organization `remoteCache.org` names. - Added the `addMissingPeerTypes` setting, which links the `@types` package of a peer dependency next to every package that peer-depends on it. For example, a package that peer-depends on `react` gets the project's `@types/react` linked next to it. This lets TypeScript find the types of a peer dependency when the global virtual store is on [#​15689](https://redirect.github.com/pnpm/pnpm/discussions/15689). - `pnpm add --config` and `pnpm update` now handle configuration dependencies the way they handle other dependencies [#​16814](https://redirect.github.com/pnpm/pnpm/issues/16814). `pnpm add --config` saves a version range in `pnpm-workspace.yaml` by the same rules as `pnpm add`, so `pnpm add --config my-config@latest` saves a range such as `^1.2.0`. It also resolves the package again when `pnpm-lock.yaml` already locks an older version. `pnpm update` updates configuration dependencies within their ranges, and `pnpm update --latest` moves them to their latest version. A selector such as `pnpm update my-config` updates only the configuration dependencies it names. ##### Patch Changes - A package set to `false` in `allowBuilds` no longer runs its build scripts when `dangerouslyAllowAllBuilds` is `true`. The two settings together now allow every build except the denied ones. Previously, `dangerouslyAllowAllBuilds` ignored the denials. - pnpm now switches to the pnpm version a project pins even when it cannot read its configuration. Previously, a setting it rejected in the global config file, an `.npmrc` file, or `_auth`, or a `pnpm-workspace.yaml` it could not parse, stopped every command, `pnpm --version` included. - `pnpm update` and `pnpm why` accept `--depth Infinity` again. They failed with `invalid value 'Infinity' for '--depth <DEPTH>'` [#​16817](https://redirect.github.com/pnpm/pnpm/issues/16817). - `pnpm deploy` without `injectWorkspacePackages` now binds a peer dependency of a linked workspace package to the version its parent provides, as an injected install does. Previously the deploy failed with `ERR_PNPM_DEPLOY_AMBIGUOUS_PEER` whenever other packages in the deployed graph depended on different versions of that peer [#​16807](https://redirect.github.com/pnpm/pnpm/issues/16807). - `pnpm deploy --legacy` no longer fails with `ERR_PNPM_SPEC_NOT_SUPPORTED_BY_ANY_RESOLVER` when a workspace dependency of the deployed project declares a `workspace:` peer dependency that the project does not depend on itself. pnpm now copies that peer from the workspace into the deploy directory. An auto-installed peer declared with `workspace:` now always resolves to the workspace project. Previously, `workspace:*` and `workspace:^1.0.0` peers could be installed from the registry [#​16806](https://redirect.github.com/pnpm/pnpm/issues/16806). - Repeat installs no longer resolve again when an injected workspace package lists a dependency also as a peer dependency. - Sped up frozen installs of unchanged injected workspace packages that use hardlinks. - Sped up workspace discovery with subtree exclusions such as `!generated/**`. - A key under a registry URL in the `_auth` setting that does not start with `@` is now skipped with a warning, so a field a later pnpm version adds there no longer breaks this one. A key that holds an `authToken` object but lacks its `@`, such as `org` for `@org`, is still an error. <!-- sponsors --> #### Platinum Sponsors <table> <tbody> <tr> <td align="center" valign="middle"> <a href="https://bit.cloud/?utm_source=pnpm&utm_medium=release_notes" target="_blank" rel="noopener noreferrer"><img src="https://pnpm.io/img/users/bit.svg" width="80" alt="Bit"></a> </td> <td align="center" valign="middle"> <a href="https://openai.com/?utm_source=pnpm&utm_medium=release_notes" target="_blank" rel="noopener noreferrer"> <picture> <source media="(prefers-color-scheme: light)" srcset="https://pnpm.io/img/users/openai_dark.svg" /> <source media="(prefers-color-scheme: dark)" srcset="https://pnpm.io/img/users/openai_light.svg" /> <img src="https://pnpm.io/img/users/openai_dark.svg" width="160" alt="OpenAI" /> </picture> </a> </td> <td align="center" valign="middle"> <a href="https://notion.com/?utm_source=pnpm&utm_medium=release_notes" target="_blank" rel="noopener noreferrer"><img src="https://pnpm.io/img/users/notion.svg" width="80" alt="Notion"></a> </td> </tr> <tr> <td align="center" valign="middle"> <a href="https://coderabbit.ai/?utm_source=pnpm&utm_medium=release_notes" target="_blank" rel="noopener noreferrer"> <picture> <source media="(prefers-color-scheme: light)" srcset="https://pnpm.io/img/users/coderabbit.svg" /> <source media="(prefers-color-scheme: dark)" srcset="https://pnpm.io/img/users/coderabbit_light.svg" /> <img src="https://pnpm.io/img/users/coderabbit.svg" width="220" alt="CodeRabbit" /> </picture> </a> </td> </tr> </tbody> </table> #### Gold Sponsors <table> <tbody> <tr> <td align="center" valign="middle"> <a href="https://sanity.io/?utm_source=pnpm&utm_medium=release_notes" target="_blank" rel="noopener noreferrer"> <picture> <source media="(prefers-color-scheme: light)" srcset="https://pnpm.io/img/users/sanity.svg" /> <source media="(prefers-color-scheme: dark)" srcset="https://pnpm.io/img/users/sanity_light.svg" /> <img src="https://pnpm.io/img/users/sanity.svg" width="120" alt="Sanity" /> </picture> </a> </td> <td align="center" valign="middle"> <a href="https://discord.com/?utm_source=pnpm&utm_medium=release_notes" target="_blank" rel="noopener noreferrer"> <picture> <source media="(prefers-color-scheme: light)" srcset="https://pnpm.io/img/users/discord.svg" /> <source media="(prefers-color-scheme: dark)" srcset="https://pnpm.io/img/users/discord_light.svg" /> <img src="https://pnpm.io/img/users/discord.svg" width="220" alt="Discord" /> </picture> </a> </td> <td align="center" valign="middle"> <a href="https://vite.dev/?utm_source=pnpm&utm_medium=release_notes" target="_blank" rel="noopener noreferrer"><img src="https://pnpm.io/img/users/vitejs.svg" width="42" alt="Vite"></a> </td> </tr> <tr> <td align="center" valign="middle"> <a href="https://serpapi.com/?utm_source=pnpm&utm_medium=release_notes" target="_blank" rel="noopener noreferrer"> <picture> <source media="(prefers-color-scheme: light)" srcset="https://pnpm.io/img/users/serpapi_dark.svg" /> <source media="(prefers-color-scheme: dark)" srcset="https://pnpm.io/img/users/serpapi_light.svg" /> <img src="https://pnpm.io/img/users/serpapi_dark.svg" width="160" alt="SerpApi" /> </picture> </a> </td> <td align="center" valign="middle"> <a href="https://stackblitz.com/?utm_source=pnpm&utm_medium=release_notes" target="_blank" rel="noopener noreferrer"> <picture> <source media="(prefers-color-scheme: light)" srcset="https://pnpm.io/img/users/stackblitz.svg" /> <source media="(prefers-color-scheme: dark)" srcset="https://pnpm.io/img/users/stackblitz_light.svg" /> <img src="https://pnpm.io/img/users/stackblitz.svg" width="190" alt="Stackblitz" /> </picture> </a> </td> <td align="center" valign="middle"> <a href="https://workleap.com/?utm_source=pnpm&utm_medium=release_notes" target="_blank" rel="noopener noreferrer"> <picture> <source media="(prefers-color-scheme: light)" srcset="https://pnpm.io/img/users/workleap.svg" /> <source media="(prefers-color-scheme: dark)" srcset="https://pnpm.io/img/users/workleap_light.svg" /> <img src="https://pnpm.io/img/users/workleap.svg" width="190" alt="Workleap" /> </picture> </a> </td> </tr> <tr> <td align="center" valign="middle"> <a href="https://nx.dev/?utm_source=pnpm&utm_medium=release_notes" target="_blank" rel="noopener noreferrer"> <picture> <source media="(prefers-color-scheme: light)" srcset="https://pnpm.io/img/users/nx.svg" /> <source media="(prefers-color-scheme: dark)" srcset="https://pnpm.io/img/users/nx_light.svg" /> <img src="https://pnpm.io/img/users/nx.svg" width="50" alt="Nx" /> </picture> </a> </td> <td align="center" valign="middle"> <a href="https://latitude.so/?utm_source=pnpm&utm_medium=release_notes" target="_blank" rel="noopener noreferrer"><img src="https://pnpm.io/img/users/latitude.svg" width="160" alt="Latitude"></a> </td> </tr> </tbody> </table> <!-- sponsors end --> </details> --- ### Configuration 📅 **Schedule**: (UTC) - Branch creation - At any time (no schedule defined) - Automerge - At any time (no schedule defined) 🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied. ♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox. 🔕 **Ignore**: Close this PR and you won't be reminded about this update again. --- - [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check this box --- This PR was generated by [Mend Renovate](https://mend.io/renovate/). View the [repository job log](https://developer.mend.io/github/authelia/authelia). <!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0NC4xNjQuMSIsInVwZGF0ZWRJblZlciI6IjQ0LjE2NC4xIiwidGFyZ2V0QnJhbmNoIjoibWFzdGVyIiwibGFiZWxzIjpbImRlcGVuZGVuY2llcyIsImphdmFzY3JpcHQiXX0=--> Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com> |
||
|
renovate[bot]
|
0a907bbe91 |
build(deps): update dependency react-i18next to v17.0.17 (#13488)
This PR contains the following updates: | Package | Change | [Age](https://docs.renovatebot.com/merge-confidence/) | [Confidence](https://docs.renovatebot.com/merge-confidence/) | |---|---|---|---| | [react-i18next](https://redirect.github.com/i18next/react-i18next) | [`17.0.16` → `17.0.17`](https://renovatebot.com/diffs/npm/react-i18next/17.0.16/17.0.17) |  |  | --- ### Release Notes <details> <summary>i18next/react-i18next (react-i18next)</summary> ### [`v17.0.17`](https://redirect.github.com/i18next/react-i18next/blob/HEAD/CHANGELOG.md#17017) [Compare Source](https://redirect.github.com/i18next/react-i18next/compare/v17.0.16...v17.0.17) - perf: `useTranslation` no longer unsubscribes and resubscribes its i18n listeners on every render. The `subscribe` callback handed to `useSyncExternalStore` depended on the merged options object, which is rebuilt whenever `props` is a new object: with no options (the `{}` default), with options passed inline (`useTranslation('ns', { keyPrefix })`), and through `withTranslation` and `<Translation>`. A new `subscribe` makes React resubscribe, so each render of each caller ran `i18n.off` and `i18n.on` in an extra effect. It now depends only on the instance and the `bindI18n`/`bindI18nStore` event names. No updates were ever missed, because React re-checks the snapshot after resubscribing; this only removes the churn, which adds up with many mounted components that re-render often. Reported via [next-i18next#2349](https://redirect.github.com/i18next/next-i18next/issues/2349). </details> --- ### Configuration 📅 **Schedule**: (UTC) - Branch creation - At any time (no schedule defined) - Automerge - At any time (no schedule defined) 🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied. ♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox. 🔕 **Ignore**: Close this PR and you won't be reminded about this update again. --- - [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check this box --- This PR was generated by [Mend Renovate](https://mend.io/renovate/). View the [repository job log](https://developer.mend.io/github/authelia/authelia). <!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0NC4xNjQuMSIsInVwZGF0ZWRJblZlciI6IjQ0LjE2NC4xIiwidGFyZ2V0QnJhbmNoIjoibWFzdGVyIiwibGFiZWxzIjpbImRlcGVuZGVuY2llcyIsImphdmFzY3JpcHQiXX0=--> Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com> |
||
|
renovate[bot]
|
09bcabab47 |
build(deps): update vitest monorepo to v5.0.5 (#13489)
This PR contains the following updates: | Package | Change | [Age](https://docs.renovatebot.com/merge-confidence/) | [Confidence](https://docs.renovatebot.com/merge-confidence/) | |---|---|---|---| | [@vitest/coverage-istanbul](https://vitest.dev/guide/coverage) ([source](https://redirect.github.com/vitest-dev/vitest/tree/HEAD/packages/coverage-istanbul)) | [`5.0.4` → `5.0.5`](https://renovatebot.com/diffs/npm/@vitest%2fcoverage-istanbul/5.0.4/5.0.5) |  |  | | [@vitest/ui](https://vitest.dev/guide/ui) ([source](https://redirect.github.com/vitest-dev/vitest/tree/HEAD/packages/ui)) | [`5.0.4` → `5.0.5`](https://renovatebot.com/diffs/npm/@vitest%2fui/5.0.4/5.0.5) |  |  | | [vitest](https://vitest.dev) ([source](https://redirect.github.com/vitest-dev/vitest/tree/HEAD/packages/vitest)) | [`5.0.4` → `5.0.5`](https://renovatebot.com/diffs/npm/vitest/5.0.4/5.0.5) |  |  | --- ### Release Notes <details> <summary>vitest-dev/vitest (@​vitest/coverage-istanbul)</summary> ### [`v5.0.5`](https://redirect.github.com/vitest-dev/vitest/releases/tag/v5.0.5) [Compare Source](https://redirect.github.com/vitest-dev/vitest/compare/v5.0.4...v5.0.5) ##### 🐞 Bug Fixes - Keep vite default `fs.deny` with api token file - by [@​hi-ogawa](https://redirect.github.com/hi-ogawa), **Hiroshi Ogawa** and **Claude Opus 5.5** in [#​11578](https://redirect.github.com/vitest-dev/vitest/issues/11578) [<samp>(28dc1)</samp>](https://redirect.github.com/vitest-dev/vitest/commit/28dc1edfb) - Handle quoted file names in `--changed` - by [@​sheremet-va](https://redirect.github.com/sheremet-va) in [#​11583](https://redirect.github.com/vitest-dev/vitest/issues/11583) [<samp>(14921)</samp>](https://redirect.github.com/vitest-dev/vitest/commit/14921e962) - Add `data` to the `import.meta.hot` stub - by [@​sheremet-va](https://redirect.github.com/sheremet-va) in [#​11590](https://redirect.github.com/vitest-dev/vitest/issues/11590) [<samp>(3a828)</samp>](https://redirect.github.com/vitest-dev/vitest/commit/3a8289ac3) - Set `skip` in `skipIf`, ignore `undefined` options - by [@​sheremet-va](https://redirect.github.com/sheremet-va) in [#​11591](https://redirect.github.com/vitest-dev/vitest/issues/11591) [<samp>(d523a)</samp>](https://redirect.github.com/vitest-dev/vitest/commit/d523a15f2) - Skip builtin loading in async leak detector - by [@​sheremet-va](https://redirect.github.com/sheremet-va) in [#​11598](https://redirect.github.com/vitest-dev/vitest/issues/11598) [<samp>(fe86a)</samp>](https://redirect.github.com/vitest-dev/vitest/commit/fe86a64c6) - Keep the import frame in native loader errors - by [@​sheremet-va](https://redirect.github.com/sheremet-va) in [#​11599](https://redirect.github.com/vitest-dev/vitest/issues/11599) [<samp>(9697b)</samp>](https://redirect.github.com/vitest-dev/vitest/commit/9697b3894) - Run hook cleanups when a later hook fails - by [@​sheremet-va](https://redirect.github.com/sheremet-va) in [#​11605](https://redirect.github.com/vitest-dev/vitest/issues/11605) [<samp>(6c5a4)</samp>](https://redirect.github.com/vitest-dev/vitest/commit/6c5a44720) - Release mocks of finished test files - by [@​sheremet-va](https://redirect.github.com/sheremet-va) in [#​11607](https://redirect.github.com/vitest-dev/vitest/issues/11607) [<samp>(e9c3d)</samp>](https://redirect.github.com/vitest-dev/vitest/commit/e9c3d72f0) - Abort all running tests on cancel - by [@​sheremet-va](https://redirect.github.com/sheremet-va) in [#​11606](https://redirect.github.com/vitest-dev/vitest/issues/11606) [<samp>(6621a)</samp>](https://redirect.github.com/vitest-dev/vitest/commit/6621a72d6) - **browser**: - Ignore synthetic pagehide events - by [@​sheremet-va](https://redirect.github.com/sheremet-va) in [#​11582](https://redirect.github.com/vitest-dev/vitest/issues/11582) [<samp>(ca081)</samp>](https://redirect.github.com/vitest-dev/vitest/commit/ca0813584) - Run plugin buildStart on server creation - by [@​sheremet-va](https://redirect.github.com/sheremet-va) in [#​11593](https://redirect.github.com/vitest-dev/vitest/issues/11593) [<samp>(ea611)</samp>](https://redirect.github.com/vitest-dev/vitest/commit/ea611e44c) - Drop late connections of closed sessions - by [@​sheremet-va](https://redirect.github.com/sheremet-va) in [#​11600](https://redirect.github.com/vitest-dev/vitest/issues/11600) [<samp>(f161e)</samp>](https://redirect.github.com/vitest-dev/vitest/commit/f161e6df2) - Wait 30s for the browser to close - by [@​sheremet-va](https://redirect.github.com/sheremet-va) in [#​11601](https://redirect.github.com/vitest-dev/vitest/issues/11601) [<samp>(6498b)</samp>](https://redirect.github.com/vitest-dev/vitest/commit/6498b666a) - Run global setup once with instances - by [@​sheremet-va](https://redirect.github.com/sheremet-va) in [#​11596](https://redirect.github.com/vitest-dev/vitest/issues/11596) [<samp>(8dd67)</samp>](https://redirect.github.com/vitest-dev/vitest/commit/8dd67c262) - **reporter**: - End reason `&#​39;failed&#​39;` on worker crash - by [@​AriPerkkio](https://redirect.github.com/AriPerkkio) in [#​11568](https://redirect.github.com/vitest-dev/vitest/issues/11568) [<samp>(6ae8e)</samp>](https://redirect.github.com/vitest-dev/vitest/commit/6ae8e89ff) ##### [View changes on GitHub](https://redirect.github.com/vitest-dev/vitest/compare/v5.0.4...v5.0.5) </details> --- ### Configuration 📅 **Schedule**: (UTC) - Branch creation - At any time (no schedule defined) - Automerge - At any time (no schedule defined) 🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied. ♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox. 🔕 **Ignore**: Close this PR and you won't be reminded about these updates again. --- - [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check this box --- This PR was generated by [Mend Renovate](https://mend.io/renovate/). View the [repository job log](https://developer.mend.io/github/authelia/authelia). <!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0NC4xNjQuMSIsInVwZGF0ZWRJblZlciI6IjQ0LjE2NC4xIiwidGFyZ2V0QnJhbmNoIjoibWFzdGVyIiwibGFiZWxzIjpbImRlcGVuZGVuY2llcyIsImphdmFzY3JpcHQiXX0=--> Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com> |
||
|
renovate[bot]
|
b17f586635 |
build(deps): update dependency @eslint-react/eslint-plugin to v5.27.2 (#13486)
This PR contains the following updates: | Package | Change | [Age](https://docs.renovatebot.com/merge-confidence/) | [Confidence](https://docs.renovatebot.com/merge-confidence/) | |---|---|---|---| | [@eslint-react/eslint-plugin](https://redirect.github.com/Rel1cx/eslint-react) ([source](https://redirect.github.com/Rel1cx/eslint-react/tree/HEAD/plugins/eslint-plugin)) | [`5.27.1` → `5.27.2`](https://renovatebot.com/diffs/npm/@eslint-react%2feslint-plugin/5.27.1/5.27.2) |  |  | --- ### Release Notes <details> <summary>Rel1cx/eslint-react (@​eslint-react/eslint-plugin)</summary> ### [`v5.27.2`](https://redirect.github.com/Rel1cx/eslint-react/blob/HEAD/CHANGELOG.md#v5272-2026-10-15) [Compare Source](https://redirect.github.com/Rel1cx/eslint-react/compare/v5.27.1...v5.27.2) ##### 🏗️ Internal - Added the missing `@tsconfig/node20` and `@types/node` dependencies to the workspace packages. ([#​2040](https://redirect.github.com/Rel1cx/eslint-react/issues/2040)) - Bumped `effect` and `@effect/platform-node` to `4.0.5`, `import-integrity-lint` to `1.3.1`, and `sort-package-json` to `4.1.0`. ([#​2040](https://redirect.github.com/Rel1cx/eslint-react/issues/2040)) **Full Changelog**: <https://github.com/Rel1cx/eslint-react/compare/v5.27.1...v5.27.2> </details> --- ### Configuration 📅 **Schedule**: (UTC) - Branch creation - At any time (no schedule defined) - Automerge - At any time (no schedule defined) 🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied. ♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox. 🔕 **Ignore**: Close this PR and you won't be reminded about this update again. --- - [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check this box --- This PR was generated by [Mend Renovate](https://mend.io/renovate/). View the [repository job log](https://developer.mend.io/github/authelia/authelia). <!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0NC4xNjQuMSIsInVwZGF0ZWRJblZlciI6IjQ0LjE2NC4xIiwidGFyZ2V0QnJhbmNoIjoibWFzdGVyIiwibGFiZWxzIjpbImRlcGVuZGVuY2llcyIsImphdmFzY3JpcHQiXX0=--> Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com> |
||
|
renovate[bot]
|
a5da19e41b |
build(deps): update dependency happy-dom to v21 (#13485)
This PR contains the following updates: | Package | Change | [Age](https://docs.renovatebot.com/merge-confidence/) | [Confidence](https://docs.renovatebot.com/merge-confidence/) | |---|---|---|---| | [happy-dom](https://redirect.github.com/capricorn86/happy-dom) | [`20.14.6` → `21.0.1`](https://renovatebot.com/diffs/npm/happy-dom/20.14.6/21.0.1) |  |  | --- ### Release Notes <details> <summary>capricorn86/happy-dom (happy-dom)</summary> ### [`v21.0.1`](https://redirect.github.com/capricorn86/happy-dom/releases/tag/v21.0.1) [Compare Source](https://redirect.github.com/capricorn86/happy-dom/compare/v21.0.0...v21.0.1) ##### 👷♂️ Patch fixes - Adds alias for enabling CSS and iframe loading to [@​happy-dom/server-renderer](https://redirect.github.com/capricorn86/happy-dom/wiki/Server-Renderer) - By **[@​capricorn86](https://redirect.github.com/capricorn86)** ### [`v21.0.0`](https://redirect.github.com/capricorn86/happy-dom/releases/tag/v21.0.0) [Compare Source](https://redirect.github.com/capricorn86/happy-dom/compare/v20.14.6...v21.0.0) ##### 💣 Breaking Changes - Disables CSS and IFrame loading by default to prevent [server-side request forgery (SSRF)](https://en.wikipedia.org/wiki/Server-side_request_forgery) - By **[@​capricorn86](https://redirect.github.com/capricorn86)** - An attacker could embed `<iframe>` or `<link rel="stylesheet">` elements in untrusted HTML to make Happy DOM send HTTP requests from the server to attacker-chosen URLs, including internal services. This could allow access to otherwise unreachable endpoints or trigger unintended actions, depending on the application and its network access. - The settings property `disableCSSFileLoading` has been deprecated - Added the new settings properties [enableCSSFileLoading](https://redirect.github.com/capricorn86/happy-dom/wiki/IBrowserSettings#properties) and [enableIframePageLoading](https://redirect.github.com/capricorn86/happy-dom/wiki/IBrowserSettings#properties) </details> --- ### Configuration 📅 **Schedule**: (UTC) - Branch creation - At any time (no schedule defined) - Automerge - At any time (no schedule defined) 🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied. ♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox. 🔕 **Ignore**: Close this PR and you won't be reminded about this update again. --- - [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check this box --- This PR was generated by [Mend Renovate](https://mend.io/renovate/). View the [repository job log](https://developer.mend.io/github/authelia/authelia). <!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0NC4xNjQuMSIsInVwZGF0ZWRJblZlciI6IjQ0LjE2NC4xIiwidGFyZ2V0QnJhbmNoIjoibWFzdGVyIiwibGFiZWxzIjpbImRlcGVuZGVuY2llcyIsImphdmFzY3JpcHQiXX0=--> Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com> |
||
|
renovate[bot]
|
119ee836e9 |
build(deps): update step-security/harden-runner action to v2.22.1 (#13484)
This PR contains the following updates: | Package | Type | Update | Change | |---|---|---|---| | [step-security/harden-runner](https://redirect.github.com/step-security/harden-runner) | action | minor | `v2.21.1` → `v2.22.1` | --- ### Release Notes <details> <summary>step-security/harden-runner</summary> ### [`v2.22.1`](https://redirect.github.com/step-security/harden-runner/releases/tag/v2.22.1) [Compare Source](https://redirect.github.com/step-security/harden-runner/compare/v2.22.0...v2.22.1) ##### What's Changed - Fixed security rules not initializing on GHES self-hosted runners - Fixed GHES connectivity in block mode by implicitly allowing the GHES hostname **Full Changelog**: <https://github.com/step-security/harden-runner/compare/v2.22.0...v2.22.1> ### [`v2.22.0`](https://redirect.github.com/step-security/harden-runner/releases/tag/v2.22.0) [Compare Source](https://redirect.github.com/step-security/harden-runner/compare/v2.21.1...v2.22.0) ##### What's Changed - Linux ARM64 support for community tier - GHES support for self-hosted VMs (enterprise tier) - MacOS and Windows runner deny list support for block policy (enterprise tier). **Full Changelog**: <https://github.com/step-security/harden-runner/compare/v2.21.1...v2.22.0> </details> --- ### Configuration 📅 **Schedule**: (UTC) - Branch creation - At any time (no schedule defined) - Automerge - At any time (no schedule defined) 🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied. ♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox. 🔕 **Ignore**: Close this PR and you won't be reminded about this update again. --- - [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check this box --- This PR was generated by [Mend Renovate](https://mend.io/renovate/). View the [repository job log](https://developer.mend.io/github/authelia/authelia). <!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0NC4xNjQuMSIsInVwZGF0ZWRJblZlciI6IjQ0LjE2NC4xIiwidGFyZ2V0QnJhbmNoIjoibWFzdGVyIiwibGFiZWxzIjpbImRlcGVuZGVuY2llcyIsImdpdGh1Yl9hY3Rpb25zIl19--> Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com> |
||
|
renovate[bot]
|
c27af0564f |
build(deps): update ossf/scorecard-action action to v2.5.0 (#13482)
This PR contains the following updates: | Package | Type | Update | Change | |---|---|---|---| | [ossf/scorecard-action](https://redirect.github.com/ossf/scorecard-action) | action | minor | `v2.4.4` → `v2.5.0` | --- ### Release Notes <details> <summary>ossf/scorecard-action</summary> ### [`v2.5.0`](https://redirect.github.com/ossf/scorecard-action/releases/tag/v2.5.0) [Compare Source](https://redirect.github.com/ossf/scorecard-action/compare/v2.4.4...v2.5.0) #### What's Changed This release moves the action to Scorecard v5.6.0, the first Scorecard release since its hosted services moved to new infrastructure. For changes to checks and results, and what the infrastructure move means for you, see the [Scorecard v5.6.0 release notes](https://redirect.github.com/ossf/scorecard/releases/tag/v5.6.0). - The action's container image is built with Go 1.27.2 on a refreshed distroless base. by [@​justaugustus](https://redirect.github.com/justaugustus) in [#​1716](https://redirect.github.com/ossf/scorecard-action/pull/1716) - The installer (`cmd/installer`) now creates `.github/workflows/scorecard.yml`, and still recognizes existing `scorecards.yml` and `scorecards-analysis.yml` workflows. by [@​justaugustus](https://redirect.github.com/justaugustus) in [#​1716](https://redirect.github.com/ossf/scorecard-action/pull/1716) - The Scorecard version in results now always matches the Scorecard release the action is built with. by [@​justaugustus](https://redirect.github.com/justaugustus) in [#​1718](https://redirect.github.com/ossf/scorecard-action/pull/1718) - The action no longer prints the GitHub token variable while validating its options. by [@​arpitjain099](https://redirect.github.com/arpitjain099) in [#​1709](https://redirect.github.com/ossf/scorecard-action/pull/1709) - `results_format` accepts `intoto`, which wraps the JSON results in an in-toto attestation statement. by [@​puerco](https://redirect.github.com/puerco) in [#​1702](https://redirect.github.com/ossf/scorecard-action/pull/1702) ##### Other - Add a daily canary against Scorecard main by [@​justaugustus](https://redirect.github.com/justaugustus) in [#​1711](https://redirect.github.com/ossf/scorecard-action/pull/1711) - Bump Scorecard to the v5.6.0 candidate and fix the canary toolchain by [@​justaugustus](https://redirect.github.com/justaugustus) in [#​1714](https://redirect.github.com/ossf/scorecard-action/pull/1714) - Run Scorecard on every merge, add a zizmor presubmit, analyze workflows with CodeQL, and update RELEASE.md by [@​justaugustus](https://redirect.github.com/justaugustus) in [#​1716](https://redirect.github.com/ossf/scorecard-action/pull/1716) - Bump Scorecard to v5.6.0 by [@​justaugustus](https://redirect.github.com/justaugustus) in [#​1719](https://redirect.github.com/ossf/scorecard-action/pull/1719) #### New Contributors - [@​arpitjain099](https://redirect.github.com/arpitjain099) made their first contribution in [#​1709](https://redirect.github.com/ossf/scorecard-action/pull/1709) - [@​puerco](https://redirect.github.com/puerco) made their first contribution in [#​1702](https://redirect.github.com/ossf/scorecard-action/pull/1702) **Full Changelog**: <https://github.com/ossf/scorecard-action/compare/v2.4.4...v2.5.0> </details> --- ### Configuration 📅 **Schedule**: (UTC) - Branch creation - At any time (no schedule defined) - Automerge - At any time (no schedule defined) 🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied. ♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox. 🔕 **Ignore**: Close this PR and you won't be reminded about this update again. --- - [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check this box --- This PR was generated by [Mend Renovate](https://mend.io/renovate/). View the [repository job log](https://developer.mend.io/github/authelia/authelia). <!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0NC4xNjQuMSIsInVwZGF0ZWRJblZlciI6IjQ0LjE2NC4xIiwidGFyZ2V0QnJhbmNoIjoibWFzdGVyIiwibGFiZWxzIjpbImRlcGVuZGVuY2llcyIsImdpdGh1Yl9hY3Rpb25zIl19--> Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com> |
||
|
renovate[bot]
|
4c10b7a54e |
build(deps): update pnpm to v12.11.2 (#13483)
> [!NOTE] > This PR body was truncated due to platform limits. This PR contains the following updates: | Package | Change | [Age](https://docs.renovatebot.com/merge-confidence/) | [Confidence](https://docs.renovatebot.com/merge-confidence/) | |---|---|---|---| | [pnpm](https://pnpm.io) ([source](https://redirect.github.com/pnpm/pnpm/tree/HEAD/pnpm/npm/pnpm)) | [`12.9.1` → `12.11.2`](https://renovatebot.com/diffs/npm/pnpm/12.9.1/12.11.2) |  |  | --- ### Release Notes <details> <summary>pnpm/pnpm (pnpm)</summary> ### [`v12.11.2`](https://redirect.github.com/pnpm/pnpm/releases/tag/v12.11.2): pnpm 12.11.2 [Compare Source](https://redirect.github.com/pnpm/pnpm/compare/v12.11.1...v12.11.2) This release fixes `--workspace-concurrency=Infinity`, filters set by an `updateConfig` hook, and store fetches with `enable-modules-dir=false`. ##### Patch Changes - `--workspace-concurrency=Infinity` now runs workspace projects with no concurrency limit. It used to fail with `invalid digit found in string` [#​16793](https://redirect.github.com/pnpm/pnpm/issues/16793). - `pnpm install` and other recursive commands now apply the `filter` and `filterProd` that an `updateConfig` hook sets. They used to run on every workspace project [#​16792](https://redirect.github.com/pnpm/pnpm/issues/16792). - `enable-modules-dir=false` now also fetches the packages an install reuses from an existing lockfile, so the store holds every package the lockfile lists. <!-- sponsors --> #### Platinum Sponsors <table> <tbody> <tr> <td align="center" valign="middle"> <a href="https://bit.cloud/?utm_source=pnpm&utm_medium=release_notes" target="_blank" rel="noopener noreferrer"><img src="https://pnpm.io/img/users/bit.svg" width="80" alt="Bit"></a> </td> <td align="center" valign="middle"> <a href="https://openai.com/?utm_source=pnpm&utm_medium=release_notes" target="_blank" rel="noopener noreferrer"> <picture> <source media="(prefers-color-scheme: light)" srcset="https://pnpm.io/img/users/openai_dark.svg" /> <source media="(prefers-color-scheme: dark)" srcset="https://pnpm.io/img/users/openai_light.svg" /> <img src="https://pnpm.io/img/users/openai_dark.svg" width="160" alt="OpenAI" /> </picture> </a> </td> <td align="center" valign="middle"> <a href="https://notion.com/?utm_source=pnpm&utm_medium=release_notes" target="_blank" rel="noopener noreferrer"><img src="https://pnpm.io/img/users/notion.svg" width="80" alt="Notion"></a> </td> </tr> <tr> <td align="center" valign="middle"> <a href="https://coderabbit.ai/?utm_source=pnpm&utm_medium=release_notes" target="_blank" rel="noopener noreferrer"> <picture> <source media="(prefers-color-scheme: light)" srcset="https://pnpm.io/img/users/coderabbit.svg" /> <source media="(prefers-color-scheme: dark)" srcset="https://pnpm.io/img/users/coderabbit_light.svg" /> <img src="https://pnpm.io/img/users/coderabbit.svg" width="220" alt="CodeRabbit" /> </picture> </a> </td> </tr> </tbody> </table> #### Gold Sponsors <table> <tbody> <tr> <td align="center" valign="middle"> <a href="https://sanity.io/?utm_source=pnpm&utm_medium=release_notes" target="_blank" rel="noopener noreferrer"> <picture> <source media="(prefers-color-scheme: light)" srcset="https://pnpm.io/img/users/sanity.svg" /> <source media="(prefers-color-scheme: dark)" srcset="https://pnpm.io/img/users/sanity_light.svg" /> <img src="https://pnpm.io/img/users/sanity.svg" width="120" alt="Sanity" /> </picture> </a> </td> <td align="center" valign="middle"> <a href="https://discord.com/?utm_source=pnpm&utm_medium=release_notes" target="_blank" rel="noopener noreferrer"> <picture> <source media="(prefers-color-scheme: light)" srcset="https://pnpm.io/img/users/discord.svg" /> <source media="(prefers-color-scheme: dark)" srcset="https://pnpm.io/img/users/discord_light.svg" /> <img src="https://pnpm.io/img/users/discord.svg" width="220" alt="Discord" /> </picture> </a> </td> <td align="center" valign="middle"> <a href="https://vite.dev/?utm_source=pnpm&utm_medium=release_notes" target="_blank" rel="noopener noreferrer"><img src="https://pnpm.io/img/users/vitejs.svg" width="42" alt="Vite"></a> </td> </tr> <tr> <td align="center" valign="middle"> <a href="https://serpapi.com/?utm_source=pnpm&utm_medium=release_notes" target="_blank" rel="noopener noreferrer"> <picture> <source media="(prefers-color-scheme: light)" srcset="https://pnpm.io/img/users/serpapi_dark.svg" /> <source media="(prefers-color-scheme: dark)" srcset="https://pnpm.io/img/users/serpapi_light.svg" /> <img src="https://pnpm.io/img/users/serpapi_dark.svg" width="160" alt="SerpApi" /> </picture> </a> </td> <td align="center" valign="middle"> <a href="https://stackblitz.com/?utm_source=pnpm&utm_medium=release_notes" target="_blank" rel="noopener noreferrer"> <picture> <source media="(prefers-color-scheme: light)" srcset="https://pnpm.io/img/users/stackblitz.svg" /> <source media="(prefers-color-scheme: dark)" srcset="https://pnpm.io/img/users/stackblitz_light.svg" /> <img src="https://pnpm.io/img/users/stackblitz.svg" width="190" alt="Stackblitz" /> </picture> </a> </td> <td align="center" valign="middle"> <a href="https://workleap.com/?utm_source=pnpm&utm_medium=release_notes" target="_blank" rel="noopener noreferrer"> <picture> <source media="(prefers-color-scheme: light)" srcset="https://pnpm.io/img/users/workleap.svg" /> <source media="(prefers-color-scheme: dark)" srcset="https://pnpm.io/img/users/workleap_light.svg" /> <img src="https://pnpm.io/img/users/workleap.svg" width="190" alt="Workleap" /> </picture> </a> </td> </tr> <tr> <td align="center" valign="middle"> <a href="https://nx.dev/?utm_source=pnpm&utm_medium=release_notes" target="_blank" rel="noopener noreferrer"> <picture> <source media="(prefers-color-scheme: light)" srcset="https://pnpm.io/img/users/nx.svg" /> <source media="(prefers-color-scheme: dark)" srcset="https://pnpm.io/img/users/nx_light.svg" /> <img src="https://pnpm.io/img/users/nx.svg" width="50" alt="Nx" /> </picture> </a> </td> <td align="center" valign="middle"> <a href="https://latitude.so/?utm_source=pnpm&utm_medium=release_notes" target="_blank" rel="noopener noreferrer"><img src="https://pnpm.io/img/users/latitude.svg" width="160" alt="Latitude"></a> </td> </tr> </tbody> </table> <!-- sponsors end --> ### [`v12.11.1`](https://redirect.github.com/pnpm/pnpm/releases/tag/v12.11.1): pnpm 12.11.1 [Compare Source](https://redirect.github.com/pnpm/pnpm/compare/v12.11.0...v12.11.1) This release fixes two ways `pnpm install` could fail, runs tools of any Rust release through `pnx`, and treats `registry.npmjs.com` as an alias of the npm registry. ##### Patch Changes - `pnpm install` no longer fails when `packageManager` pins the pnpm version that is already running and the registry does not publish that version. pnpm warns and continues. A registry mirror that has not synced a release no longer blocks the commands of a project pinned to it. - `pnpm install` no longer fails with `ERR_PNPM_CMD_SHIM_CHMOD` when `node_modules/.bin` holds a shim that another user created, if everyone can already execute it and it is not world-writable. This happens when several users share one checkout. - `enable-modules-dir=false` (`enableModulesDir: false` through the Node.js addon) fetches the registry packages the host can install into the store again, as pnpm v10 did, while still writing nothing under `node_modules`. The setting exists for a `node_modules` that something else mounts from the store, such as a FUSE daemon, and that consumer no longer has to download each package on first access. A plain `--lockfile-only` run still fetches nothing. - `pnpm pack` and `pnpm publish` no longer put `.npmignore` and `.gitignore` files in the tarball. A `files` entry that names one still ships it. - pnpm now treats `https://registry.npmjs.com/` as an alias of `https://registry.npmjs.org/`. Registry requests, credentials, and trusted publishing use the canonical hostname. - `pnx --package=rust@<channel> <tool>` runs a tool of that Rust release, for example `pnx --package=rust@nightly-2026-01-01 cargo build`. pnpm installs the release with the components and targets from `rust-toolchain.toml` and the target of each `--target` argument. - `pnpm install` now links agent skills for more coding agents. It detects the agent from `ANTIGRAVITY_AGENT`, `COPILOT_AGENT`, `COPILOT_CLI`, `CODEX_THREAD_ID`, `CODEX_SANDBOX`, `AI_AGENT`, and `CLAUDE_CODE` [pnpm/tasks#116](https://redirect.github.com/pnpm/tasks/issues/116). - When the registry rejects `pnpm stage publish`, the error message now starts with "Failed to stage package". <!-- sponsors --> #### Platinum Sponsors <table> <tbody> <tr> <td align="center" valign="middle"> <a href="https://bit.cloud/?utm_source=pnpm&utm_medium=release_notes" target="_blank" rel="noopener noreferrer"><img src="https://pnpm.io/img/users/bit.svg" width="80" alt="Bit"></a> </td> <td align="center" valign="middle"> <a href="https://openai.com/?utm_source=pnpm&utm_medium=release_notes" target="_blank" rel="noopener noreferrer"> <picture> <source media="(prefers-color-scheme: light)" srcset="https://pnpm.io/img/users/openai_dark.svg" /> <source media="(prefers-color-scheme: dark)" srcset="https://pnpm.io/img/users/openai_light.svg" /> <img src="https://pnpm.io/img/users/openai_dark.svg" width="160" alt="OpenAI" /> </picture> </a> </td> <td align="center" valign="middle"> <a href="https://notion.com/?utm_source=pnpm&utm_medium=release_notes" target="_blank" rel="noopener noreferrer"><img src="https://pnpm.io/img/users/notion.svg" width="80" alt="Notion"></a> </td> </tr> <tr> <td align="center" valign="middle"> <a href="https://coderabbit.ai/?utm_source=pnpm&utm_medium=release_notes" target="_blank" rel="noopener noreferrer"> <picture> <source media="(prefers-color-scheme: light)" srcset="https://pnpm.io/img/users/coderabbit.svg" /> <source media="(prefers-color-scheme: dark)" srcset="https://pnpm.io/img/users/coderabbit_light.svg" /> <img src="https://pnpm.io/img/users/coderabbit.svg" width="220" alt="CodeRabbit" /> </picture> </a> </td> </tr> </tbody> </table> #### Gold Sponsors <table> <tbody> <tr> <td align="center" valign="middle"> <a href="https://sanity.io/?utm_source=pnpm&utm_medium=release_notes" target="_blank" rel="noopener noreferrer"> <picture> <source media="(prefers-color-scheme: light)" srcset="https://pnpm.io/img/users/sanity.svg" /> <source media="(prefers-color-scheme: dark)" srcset="https://pnpm.io/img/users/sanity_light.svg" /> <img src="https://pnpm.io/img/users/sanity.svg" width="120" alt="Sanity" /> </picture> </a> </td> <td align="center" valign="middle"> <a href="https://discord.com/?utm_source=pnpm&utm_medium=release_notes" target="_blank" rel="noopener noreferrer"> <picture> <source media="(prefers-color-scheme: light)" srcset="https://pnpm.io/img/users/discord.svg" /> <source media="(prefers-color-scheme: dark)" srcset="https://pnpm.io/img/users/discord_light.svg" /> <img src="https://pnpm.io/img/users/discord.svg" width="220" alt="Discord" /> </picture> </a> </td> <td align="center" valign="middle"> <a href="https://vite.dev/?utm_source=pnpm&utm_medium=release_notes" target="_blank" rel="noopener noreferrer"><img src="https://pnpm.io/img/users/vitejs.svg" width="42" alt="Vite"></a> </td> </tr> <tr> <td align="center" valign="middle"> <a href="https://serpapi.com/?utm_source=pnpm&utm_medium=release_notes" target="_blank" rel="noopener noreferrer"> <picture> <source media="(prefers-color-scheme: light)" srcset="https://pnpm.io/img/users/serpapi_dark.svg" /> <source media="(prefers-color-scheme: dark)" srcset="https://pnpm.io/img/users/serpapi_light.svg" /> <img src="https://pnpm.io/img/users/serpapi_dark.svg" width="160" alt="SerpApi" /> </picture> </a> </td> <td align="center" valign="middle"> <a href="https://stackblitz.com/?utm_source=pnpm&utm_medium=release_notes" target="_blank" rel="noopener noreferrer"> <picture> <source media="(prefers-color-scheme: light)" srcset="https://pnpm.io/img/users/stackblitz.svg" /> <source media="(prefers-color-scheme: dark)" srcset="https://pnpm.io/img/users/stackblitz_light.svg" /> <img src="https://pnpm.io/img/users/stackblitz.svg" width="190" alt="Stackblitz" /> </picture> </a> </td> <td align="center" valign="middle"> <a href="https://workleap.com/?utm_source=pnpm&utm_medium=release_notes" target="_blank" rel="noopener noreferrer"> <picture> <source media="(prefers-color-scheme: light)" srcset="https://pnpm.io/img/users/workleap.svg" /> <source media="(prefers-color-scheme: dark)" srcset="https://pnpm.io/img/users/workleap_light.svg" /> <img src="https://pnpm.io/img/users/workleap.svg" width="190" alt="Workleap" /> </picture> </a> </td> </tr> <tr> <td align="center" valign="middle"> <a href="https://nx.dev/?utm_source=pnpm&utm_medium=release_notes" target="_blank" rel="noopener noreferrer"> <picture> <source media="(prefers-color-scheme: light)" srcset="https://pnpm.io/img/users/nx.svg" /> <source media="(prefers-color-scheme: dark)" srcset="https://pnpm.io/img/users/nx_light.svg" /> <img src="https://pnpm.io/img/users/nx.svg" width="50" alt="Nx" /> </picture> </a> </td> <td align="center" valign="middle"> <a href="https://latitude.so/?utm_source=pnpm&utm_medium=release_notes" target="_blank" rel="noopener noreferrer"><img src="https://pnpm.io/img/users/latitude.svg" width="160" alt="Latitude"></a> </td> </tr> </tbody> </table> <!-- sponsors end --> ### [`v12.11.0`](https://redirect.github.com/pnpm/pnpm/releases/tag/v12.11.0): pnpm 12.11.0 [Compare Source](https://redirect.github.com/pnpm/pnpm/compare/v12.10.1...v12.11.0) This release adds Rust toolchain management, links the agent skills that dependencies ship, adds the `permissions` setting, and keeps the colors of streamed script output. ##### Minor Changes - `pnpm install` now links the agent skills that direct dependencies ship under `skills/<name>/SKILL.md` into the project's agent skill directories, such as `.claude/skills`. A package's skills are linked only after you approve them with `pnpm approve`. The `skills.dirs` setting chooses the directories [pnpm/rfcs#35](https://redirect.github.com/pnpm/rfcs/pull/35). Added the `permissions` setting, which records what each dependency may do. Its `build` capability works like `allowBuilds` and takes precedence over it. `pnpm approve-builds` writes to `permissions` when `pnpm-workspace.yaml` already has it, and to `allowBuilds` otherwise. Added `pnpm permissions`, which lists the granted and denied permissions and the packages awaiting approval. `pnpm approve` reviews build scripts and agent skills in one prompt [pnpm/rfcs#36](https://redirect.github.com/pnpm/rfcs/pull/36). - pnpm now installs and runs Rust toolchains. - With `cargo.enabled`, `pnpm install` installs the toolchain named in `rust-toolchain.toml`. pnpm verifies the release signature, stores the toolchain once per machine, and links it into `.pnpm/rust`. `pnpm run` and `pnpm exec` put its `cargo` and `rustc` on the `PATH`. - `pnpm add -g rust@<channel>` installs a toolchain globally. The `cargo` and `rustc` commands run it outside projects that pin their own. `pnpm update -g`, `pnpm ls -g`, and `pnpm remove -g` manage it like any global package. - In a project, `pnpm add rust@<channel>` pins the toolchain in `rust-toolchain.toml`. - `pnpm shim add rust` adds project-aware shims for `cargo`, `rustc`, and the other Rust tools. In a project with a `rust-toolchain.toml`, they run the toolchain the file names and install it on first use. Elsewhere, the next command of the same name on `PATH` runs, such as rustup's. - `pnpm run` and `pnpm exec` now keep the colors of script output that they print under the project's name, such as with `--stream`. pnpm sets `FORCE_COLOR=1` for these scripts when its own output is in color, unless `FORCE_COLOR` is already set. Script output is also rendered more cleanly: - A line that a progress bar redraws with `\r` shows only its last state. - Escape codes that move the cursor or clear the screen are dropped. - Long colored lines are cut at the terminal width. - `pnpm -r run` no longer garbles its live output when a script fails while other scripts are still running. ##### Patch Changes ##### Installing packages - pnpm no longer panics with "unexpected error when polling the I/O driver" when it runs under QEMU user-mode emulation, such as a `linux/amd64` container on an Apple Silicon Mac [#​16696](https://redirect.github.com/pnpm/pnpm/issues/16696). - `pnpm view`, `pnpm update`, and other commands that read registry metadata now work behind proxies that end a response by closing the connection without a TLS `close_notify` alert [#​16704](https://redirect.github.com/pnpm/pnpm/issues/16704). - pnpm now switches to the version a project pins in `packageManager` or `devEngines.packageManager` even when `pnpm-workspace.yaml` has a setting the running pnpm cannot read, such as a `lockfile.includeResolutionSettings` section. If pnpm does not switch, it still reports that setting [#​16675](https://redirect.github.com/pnpm/pnpm/issues/16675). - When the `pnpm` package has to download its native binary on first run, it now uses the registry and credentials from `.npmrc` and from the `npm_config_registry` and `pnpm_config_registry` environment variables. `COREPACK_NPM_REGISTRY` still takes precedence. A project `.npmrc` is not read when `COREPACK_INTEGRITY_KEYS` turns off the signature check [#​16655](https://redirect.github.com/pnpm/pnpm/issues/16655). - `pnpm install` and `pnpm add --config` now apply `minimumReleaseAge` when they resolve a config dependency. A config dependency range resolves to the newest version that is old enough, so a later clean `pnpm install --frozen-lockfile` accepts the lockfile [#​16660](https://redirect.github.com/pnpm/pnpm/issues/16660). - `pnpm remove` with `catalogPrune` no longer removes catalog entries that `pnpm-lock.yaml` still records for workspace projects missing from disk. Before, a following frozen install failed with `ERR_PNPM_LOCKFILE_CONFIG_MISMATCH` [#​16679](https://redirect.github.com/pnpm/pnpm/issues/16679). - With `cargo.enabled`, `pnpm install` now writes the source replacement for vendored crates into `.pnpm/crates/config.toml` and includes it as optional from `.cargo/config.toml`. A checkout without `.pnpm` builds with plain Cargo [#​16659](https://redirect.github.com/pnpm/pnpm/issues/16659). - With `nodeLinker.type` set to `loaded`, Node.js now stops with `ERR_PNPM_LOADER_UNSUPPORTED_NODE` when it preloads the store loader on a version the loader cannot serve. The supported versions are `^24.18.0 || >=26.2.0`. On other versions, CommonJS packages imported from ESM failed with `Cannot find module` on their first relative `require()`. - On Windows, `pnpm install` no longer fails with "The filename, directory name, or volume label syntax is incorrect" when a package contains a file whose name is invalid on Windows, such as `icon.svg?as=metadata.d.ts`. pnpm removes the invalid characters from the name and prints a warning that lists the renamed files. - On Windows, hoisting no longer fails intermittently with link errors when a junction is created or replaced concurrently [pnpm/tasks#53](https://redirect.github.com/pnpm/tasks/issues/53). ##### Resolving dependencies - `pnpm install --no-optional` now installs the peer dependencies a project declares when `autoInstallPeers` is on. The lockfile marked such a peer `optional: true` when another dependency had it as an optional peer. - `pnpm install` and `pnpm dedupe` now link an optional peer to the workspace package that the workspace root depends on when the picked version matches it. They installed the registry package with the same name and version [#​16706](https://redirect.github.com/pnpm/pnpm/issues/16706). - Removal overrides such as `"debug>supports-color": "-"` now also apply to an optional peer that a package declares only in `peerDependenciesMeta` [#​16681](https://redirect.github.com/pnpm/pnpm/issues/16681). - `pnpm add` and other installs that re-resolve dependencies now keep the locked `devEngines.runtime` version while it still satisfies the declared range [#​16764](https://redirect.github.com/pnpm/pnpm/issues/16764). - `pnpm audit --fix update` now updates only the dependencies whose locked version is vulnerable [#​14928](https://redirect.github.com/pnpm/pnpm/issues/14928). - `pnpm outdated` and `pnpm update --interactive` now apply `overrides` before they look up the latest version. Before, a dependency overridden to an npm alias was compared with the latest version of the package the override replaces [#​16719](https://redirect.github.com/pnpm/pnpm/issues/16719). ##### Patched dependencies - Patches saved with CRLF line endings now apply, including a patch that creates or deletes a file. pnpm rejected the git headers of such a patch with `ERR_PNPM_INVALID_PATCH` and the message `invalid file mode: 100644` [#​16641](https://redirect.github.com/pnpm/pnpm/issues/16641). - A patch that changes a file's mode, such as adding or removing the executable bit, now applies the new mode on Unix [pnpm/tasks#110](https://redirect.github.com/pnpm/tasks/issues/110). ##### Injected dependencies and deploy - With `sharedWorkspaceLockfile: false`, an injected workspace package installed in the same run as its dependent now holds only the files its `files` field selects. The copy also held other files of the project, such as `tsconfig.json` [#​16683](https://redirect.github.com/pnpm/pnpm/issues/16683). - A script listed in `syncInjectedDepsAfterScripts` no longer fails when it rewrites `package.json` while pnpm is copying its edits into the injected copies. The sync after the script now replaces a half-copied manifest. - `pnpm deploy` with a shared lockfile no longer fails with `ERR_PNPM_LOCKFILE_CONFIG_MISMATCH` for `settings.dedupeInjectedDeps` or `settings.dedupePeerDependents` when `lockfile.includeResolutionSettings` is enabled. The deployed lockfile now records both settings as `false`, the values the deploy installs with. - `pnpm deploy` now writes the dependencies in the deployed `package.json` sorted by name. It also sorts the `allowBuilds` entries in the deployed `pnpm-workspace.yaml`. Repeated deploys of the same lockfile now produce identical files [#​16687](https://redirect.github.com/pnpm/pnpm/issues/16687). ##### Packing and publishing - `pnpm pack` and `pnpm publish` now match `.npmignore` and `.gitignore` rules the way npm does. A negation such as `!lib/**` or `!lib/**/!(*.map)` re-includes files under a directory that an earlier `*` rule excluded [#​16743](https://redirect.github.com/pnpm/pnpm/issues/16743). - `pnpm pack` and `pnpm publish` no longer always include root files that merely start with `README`, `LICENSE`, or `LICENCE`, such as `README_INTERNAL.md`. Only `README`, `LICENSE`, `LICENCE`, and `COPYING`, with or without an extension, ship regardless of `files` and `.npmignore`, as in npm [#​16753](https://redirect.github.com/pnpm/pnpm/issues/16753). - `pnpm publish --provenance=false` and `--no-provenance` now turn off provenance under trusted publishing, so a package can be published from a self-hosted runner. Setting `provenance: false` in `pnpm-workspace.yaml` does the same [#​16721](https://redirect.github.com/pnpm/pnpm/issues/16721). ##### Speed and resource use - `pnpm install` hardlinks files from a group-writable or world-writable store again. pnpm copied every file from such a store into `node_modules` [#​16677](https://redirect.github.com/pnpm/pnpm/issues/16677). - A repeat `pnpm install` no longer imports patched packages and packages with build scripts again when nothing changed. Their builds no longer run again either. This happened when `recursiveInstall` was `false` or the project had a `file:` dependency [#​16705](https://redirect.github.com/pnpm/pnpm/issues/16705). - Verifying the lockfile against `trustPolicy` and `minimumReleaseAge` uses less memory. pnpm no longer keeps every published version's manifest of each checked package in memory until the install ends [#​16656](https://redirect.github.com/pnpm/pnpm/issues/16656). - `pnpm rebuild <pkg>` and `pnpm rebuild --pending` no longer read the manifest of every installed package to find build scripts. Only the selected packages are inspected and built. On a large `node_modules` served lazily, such as over a network or FUSE mount, this turned a rebuild of a few packages into a fetch of every package. - `pnpm rebuild` no longer removes and recreates `node_modules` when the settings recorded in `node_modules/.modules.yaml` differ from the current configuration. The rebuild runs the build scripts against the installed packages as they are. - `pnpm store prune` now compacts the store's `index.db` after removing package entries, so the file shrinks again [#​16717](https://redirect.github.com/pnpm/pnpm/issues/16717). ##### Registry commands - `pnpm whoami`, `pnpm bugs`, `pnpm docs`, `pnpm repo`, `pnpm star`, `pnpm unstar`, and `pnpm stars` now honor the `--registry` option. - `--registry` now takes precedence over a scope's configured registry for scoped packages in `pnpm access`, `pnpm view`, `pnpm repo`, `pnpm star`, `pnpm unstar`, `pnpm owner`, `pnpm deprecate`, `pnpm undeprecate`, `pnpm unpublish`, `pnpm dist-tag`, `pnpm team`, and `pnpm stage`. Without `--registry`, `pnpm access` now sends a scoped package or scope to the registry configured for that scope. - Registry commands now keep the path of a registry URL such as `https://example.com/npm/` when they build request URLs. This applies to `pnpm access`, `pnpm owner`, `pnpm ping`, `pnpm search`, `pnpm star`, `pnpm stars`, `pnpm team`, `pnpm unstar`, and `pnpm whoami`. - `pnpm view` now honors the network retry settings. - `pnpm repo` now fetches the repository URLs of several packages in parallel. <!-- sponsors --> #### Platinum Sponsors <table> <tbody> <tr> <td align="center" valign="middle"> <a href="https://bit.cloud/?utm_source=pnpm&utm_medium=release_notes" target="_blank" rel="noopener noreferrer"><img src="https://pnpm.io/img/users/bit.svg" width="80" alt="Bit"></a> </td> <td align="center" valign="middle"> <a href="https://openai.com/?utm_source=pnpm&utm_medium=release_notes" target="_blank" rel="noopener noreferrer"> <picture> <source media="(prefers-color-scheme: light)" srcset="https://pnpm.io/img/users/openai_dark.svg" /> <source media="(prefers-color-scheme: dark)" srcset="https://pnpm.io/img/users/openai_light.svg" /> <img src="https://pnpm.io/img/users/openai_dark.svg" width="160" alt="OpenAI" /> </picture> </a> </td> <td align="center" valign="middle"> <a href="https://notion.com/?utm_source=pnpm&utm_medium=release_notes" target="_blank" rel="noopener noreferrer"><img src="https://pnpm.io/img/users/notion.svg" width="80" alt="Notion"></a> </td> </tr> <tr> <td align="center" valign="middle"> <a href="https://coderabbit.ai/?utm_source=pnpm&utm_medium=release_notes" target="_blank" rel="noopener noreferrer"> <picture> <source media="(prefers-color-scheme: light)" srcset="https://pnpm.io/img/users/coderabbit.svg" /> <source media="(prefers-color-scheme: dark)" srcset="https://pnpm.io/img/users/coderabbit_light.svg" /> <img src="https://pnpm.io/img/users/coderabbit.svg" width="220" alt="CodeRabbit" /> </picture> </a> </td> </tr> </tbody> </table> #### Gold Sponsors <table> <tbody> <tr> <td align="center" valign="middle"> <a href="https://sanity.io/?utm_source=pnpm&utm_medium=release_notes" target="_blank" rel="noopener noreferrer"> <picture> <source media="(prefers-color-scheme: light)" srcset="https://pnpm.io/img/users/sanity.svg" /> <source media="(prefers-color-scheme: dark)" srcset="https://pnpm.io/img/users/sanity_light.svg" /> <img src="https://pnpm.io/img/users/sanity.svg" width="120" alt="Sanity" /> </picture> </a> </td> <td align="center" valign="middle"> <a href="https://discord.com/?utm_source=pnpm&utm_medium=release_notes" target="_blank" rel="noopener noreferrer"> <picture> <source media="(prefers-color-scheme: light)" srcset="https://pnpm.io/img/users/discord.svg" /> <source media="(prefers-color-scheme: dark)" srcset="https://pnpm.io/img/users/discord_light.svg" /> <img src="https://pnpm.io/img/users/discord.svg" width="220" alt="Discord" /> </picture> </a> </td> <td align="center" valign="middle"> <a href="https://vite.dev/?utm_source=pnpm&utm_medium=release_notes" target="_blank" rel="noopener noreferrer"><img src="https://pnpm.io/img/users/vitejs.svg" width="42" alt="Vite"></a> </td> </tr> <tr> <td align="center" valign="middle"> <a href="https://serpapi.com/?utm_source=pnpm&utm_medium=release_notes" target="_blank" rel="noopener noreferrer"> <picture> <source media="(prefers-color-scheme: light)" srcset="https://pnpm.io/img/users/serpapi_dark.svg" /> <source media="(prefers-color-scheme: dark)" srcset="https://pnpm.io/img/users/serpapi_light.svg" /> <img src="https://pnpm.io/img/users/serpapi_dark.svg" width="160" alt="SerpApi" /> </picture> </a> </td> <td align="center" valign="middle"> <a href="https://stackblitz.com/?utm_source=pnpm&utm_medium=release_notes" target="_blank" rel="noopener noreferrer"> <picture> <source media="(prefers-color-scheme: light)" srcset="https://pnpm.io/img/users/stackblitz.svg" /> <source media="(prefers-color-scheme: dark)" srcset="https://pnpm.io/img/users/stackblitz_light.svg" /> <img src="https://pnpm.io/img/users/stackblitz.svg" width="190" alt="Stackblitz" /> </picture> </a> </td> <td align="center" valign="middle"> <a href="https://workleap.com/?utm_source=pnpm&utm_medium=release_notes" target="_blank" rel="noopener noreferrer"> <picture> <source media="(prefers-color-scheme: light)" srcset="https://pnpm.io/img/users/workleap.svg" /> <source media="(prefers-color-scheme: dark)" srcset="https://pnpm.io/img/users/workleap_light.svg" /> <img src="https://pnpm.io/img/users/workleap.svg" width="190" alt="Workleap" /> </picture> </a> </td> </tr> <tr> <td align="center" valign="middle"> <a href="https://nx.dev/?utm_source=pnpm&utm_medium=release_notes" target="_blank" rel="noopener noreferrer"> <picture> <source media="(prefers-color-scheme: light)" srcset="https://pnpm.io/img/users/nx.svg" /> <source media="(prefers-color-scheme: dark)" srcset="https://pnpm.io/img/users/nx_light.svg" /> <img src="https://pnpm.io/img/users/nx.svg" width="50" alt="Nx" /> </picture> </a> </td> <td align="center" valign="middle"> <a href="https://latitude.so/?utm_source=pnpm&utm_medium=release_notes" target="_blank" rel="noopener noreferrer"><img src="https://pnpm.io/img/users/latitude.svg" width="160" alt="Latitude"></a> </td> </tr> </tbody> </table> <!-- sponsors end --> ### [`v12.10.1`](https://redirect.github.com/pnpm/pnpm/releases/tag/v12.10.1): pnpm 12.10.1 [Compare Source](https://redirect.github.com/pnpm/pnpm/compare/v12.10.0...v12.10.1) This release fixes `pnpm install` failures after an `overrides` change and on a filtered frozen install with `catalogPrune`. It also fixes several bugs in the experimental `nodeLinker.type: loaded`, which now keeps its generated files in `node_modules`. ##### Patch Changes - With `nodeLinker.type: loaded`, pnpm now writes its generated files to `node_modules`, which projects already ignore in git. The store manifest and loader are `node_modules/.pnpm/.store-manifest.json` and `node_modules/.pnpm/.store-loader.mjs`. Bin shims are in `node_modules/.bin`. Earlier versions wrote `.pnpm-store.json` and `.pnpm-store-loader.mjs` to the project root, and a `.pnpm` directory to the root and to each workspace package. Delete them after reinstalling. - With `nodeLinker.type: loaded`, packages that ship their own `node_modules` directory, such as `npm` with its bundled dependencies, now load from the store. Before, one such package in the install stopped every Node.js process from starting. - With `nodeLinker.type: loaded`, scripts can now run a Node.js runtime installed through `devEngines.runtime`. Before, every script that called `node` re-ran its own shim until it failed with "Argument list too long". - With `nodeLinker.type: loaded`, Node.js processes start faster. In a project with 13,000 stored files, the startup overhead per process dropped from 67 ms to 18 ms. - `pnpm install` no longer fails with `ERR_PNPM_NO_MATCHING_VERSION` after a change to `overrides` when the lockfile resolves an optional peer dependency to an npm alias of another package [#​16654](https://redirect.github.com/pnpm/pnpm/issues/16654). - A frozen install with `catalogPrune` no longer removes catalog entries that `pnpm-lock.yaml` still records. Before, `pnpm install --frozen-lockfile --filter` failed with `ERR_PNPM_LOCKFILE_CONFIG_MISMATCH` when some workspace projects were missing from disk [#​16638](https://redirect.github.com/pnpm/pnpm/issues/16638). - `pnpm install --fix-lockfile` no longer removes the `deprecated` and `hasBin` fields from lockfile entries [#​6600](https://redirect.github.com/pnpm/pnpm/issues/6600). - With `enableGlobalVirtualStore`, an install that updates `node_modules` now repairs a package in the global virtual store that an interrupted install left without some of its dependency links or package files. Before, such an install kept the incomplete package if the project's `node_modules` already recorded it [#​16642](https://redirect.github.com/pnpm/pnpm/issues/16642). - `pnpm install` now skips the Cargo and Python projects inside a nested directory that has its own `pnpm-workspace.yaml` or `.git` directory, such as a git worktree of the same workspace or a separate clone. - The `Request took` warning for package metadata now starts timing when pnpm sends the request. Before, it also counted the time the request waited for a free request slot, so large installs printed it for requests the registry answered quickly. <!-- sponsors --> #### Platinum Sponsors <table> <tbody> <tr> <td align="center" valign="middle"> <a href="https://bit.cloud/?utm_source=pnpm&utm_medium=release_notes" target="_blank" rel="noopener noreferrer"><img src="https://pnpm.io/img/users/bit.svg" width="80" alt="Bit"></a> </td> <td align="center" valign="middle"> <a href="https://openai.com/?utm_source=pnpm&utm_medium=release_notes" target="_blank" rel="noopener noreferrer"> <picture> <source media="(prefers-color-scheme: light)" srcset="https://pnpm.io/img/users/openai_dark.svg" /> <source media="(prefers-color-scheme: dark)" srcset="https://pnpm.io/img/users/openai_light.svg" /> <img src="https://pnpm.io/img/users/openai_dark.svg" width="160" alt="OpenAI" /> </picture> </a> </td> <td align="center" valign="middle"> <a href="https://notion.com/?utm_source=pnpm&utm_medium=release_notes" target="_blank" rel="noopener noreferrer"><img src="https://pnpm.io/img/users/notion.svg" width="80" alt="Notion"></a> </td> </tr> <tr> <td align="center" valign="middle"> <a href="https://coderabbit.ai/?utm_source=pnpm&utm_medium=release_notes" target="_blank" rel="noopener noreferrer"> <picture> <source media="(prefers-color-scheme: light)" srcset="https://pnpm.io/img/users/coderabbit.svg" /> <source media="(prefers-color-scheme: dark)" srcset="https://pnpm.io/img/users/coderabbit_light.svg" /> <img src="https://pnpm.io/img/users/coderabbit.svg" width="220" alt="CodeRabbit" /> </picture> </a> </td> </tr> </tbody> </table> #### Gold Sponsors <table> <tbody> <tr> <td align="center" valign="middle"> <a href="https://sanity.io/?utm_source=pnpm&utm_medium=release_notes" target="_blank" rel="noopener noreferrer"> <picture> <source media="(prefers-color-scheme: light)" srcset="https://pnpm.io/img/users/sanity.svg" /> <source media="(prefers-color-scheme: dark)" srcset="https://pnpm.io/img/users/sanity_light.svg" /> <img src="https://pnpm.io/img/users/sanity.svg" width="120" alt="Sanity" /> </picture> </a> </td> <td align="center" valign="middle"> <a href="https://discord.com/?utm_source=pnpm&utm_medium=release_notes" target="_blank" rel="noopener noreferrer"> <picture> <source media="(prefers-color-scheme: light)" srcset="https://pnpm.io/img/users/discord.svg" /> <source media="(prefers-color-scheme: dark)" srcset="https://pnpm.io/img/users/discord_light.svg" /> <img src="https://pnpm.io/img/users/discord.svg" width="220" alt="Discord" /> </picture> </a> </td> <td align="center" valign="middle"> <a href="https://vite.dev/?utm_source=pnpm&utm_medium=release_notes" target="_blank" rel="noopener noreferrer"><img src="https://pnpm.io/img/users/vitejs.svg" width="42" alt="Vite"></a> </td> </tr> <tr> <td align="center" valign="middle"> <a href="https://serpapi.com/?utm_source=pnpm&utm_medium=release_notes" target="_blank" rel="noopener noreferrer"> <picture> <source media="(prefers-color-scheme: light)" srcset="https://pnpm.io/img/users/serpapi_dark.svg" /> <source media="(prefers-color-scheme: dark)" srcset="https://pnpm.io/img/users/serpapi_light.svg" /> <img src="https://pnpm.io/img/users/serpapi_dark.svg" width="160" alt="SerpApi" /> </picture> </a> </td> <td align="center" valign="middle"> <a href="https://stackblitz.com/?utm_source=pnpm&utm_medium=release_notes" target="_blank" rel="noopener noreferrer"> <picture> <source media="(prefers-color-scheme: light)" srcset="https://pnpm.io/img/users/stackblitz.svg" /> <source media="(prefers-color-scheme: dark)" srcset="https://pnpm.io/img/users/stackblitz_light.svg" /> <img src="https://pnpm.io/img/users/stackblitz.svg" width="190" alt="Stackblitz" /> </picture> </a> </td> <td align="center" valign="middle"> <a href="https://workleap.com/?utm_source=pnpm&utm_medium=release_notes" target="_blank" rel="noopener noreferrer"> <picture> <source media="(prefers-color-scheme: light)" srcset="https://pnpm.io/img/users/workleap.svg" /> <source media="(prefers-color-scheme: dark)" srcset="https://pnpm.io/img/users/workleap_light.svg" /> <img src="https://pnpm.io/img/users/workleap.svg" width="190" alt="Workleap" /> </picture> </a> </td> </tr> <tr> <td align="center" valign="middle"> <a href="https://nx.dev/?utm_source=pnpm&utm_medium=release_notes" target="_blank" rel="noopener noreferrer"> <picture> <source media="(prefers-color-scheme: light)" srcset="https://pnpm.io/img/users/nx.svg" /> <source media="(prefers-color-scheme: dark)" srcset="https://pnpm.io/img/users/nx_light.svg" /> <img src="https://pnpm.io/img/users/nx.svg" width="50" alt="Nx" /> </picture> </a> </td> <td align="center" valign="middle"> <a href="https://latitude.so/?utm_source=pnpm&utm_medium=release_notes" target="_blank" rel="noopener noreferrer"><img src="https://pnpm.io/img/users/latitude.svg" width="160" alt="Latitude"></a> </td> </tr> </tbody> </table> <!-- sponsors end --> ### [`v12.10.0`](https://redirect.github.com/pnpm/pnpm/releases/tag/v12.10.0): pnpm 12.10.0 [Compare Source](https://redirect.github.com/pnpm/pnpm/compare/v12.9.1...v12.10.0) This release adds an experimental `loaded` node linker, lets `pnpm-lock.yaml` record resolution settings, and reads cached registry metadata faster. It also carries several security fixes, including one that stops a dependency version from writing files outside the global virtual store. ##### Minor Changes - Added experimental `nodeLinker: { type: loaded }` installation. Compatible dependencies load directly from the content-addressable store through an automatically registered Node.js loader. `nodeLinker.excluded` selects packages and their dependency trees to install in the global virtual store. - `lockfile.includeResolutionSettings: true` makes `pnpm-lock.yaml` record `autoDedupe`, `dedupeInjectedDeps`, `dedupePeerDependents` and `linkWorkspacePackages`. Installs then treat a lockfile that records other values as outdated. A lockfile that records `autoDedupe` is reused by later installs on any machine, so `pnpm run` after `pnpm install --frozen-lockfile` no longer starts another install [#​16583](https://redirect.github.com/pnpm/pnpm/issues/16583). ##### Patch Changes ##### Security - `pnpm install` now prevents dependency versions with path traversal from writing files outside the global virtual store. - pnpm now verifies locked config dependencies against their registry before installing them. Config dependencies must come from an npm registry. The lockfile can no longer replace the integrity of a config dependency pinned with `version+integrity`. - Lockfile verification now checks the tarballs inside a `variations` resolution against the registry. A `name@version` lockfile entry with an empty `variations` resolution is now rejected. - `pnpm audit signatures` now verifies signatures against the integrity recorded in the lockfile. Packages without a recorded integrity cannot pass signature verification. - `pnpm install` and `pnpm publish` now reject archive metadata larger than 64 MiB before reading it into memory. Publishing a pre-built tarball also rejects manifests and README files larger than 64 MiB. - Two URL or local path dependencies no longer share a virtual store directory when one URL has `+`, `#`, `:`, or `?` where the other has `/`. Such dependencies, including git dependencies pinned with `#`, now get a hash suffix on their directory name. - The warning about an ignored project `.npmrc` registry setting no longer prints the username and password of a URL-scoped key such as `//user:password@registry.example.com/${PATH}/:_authToken`. ##### Installing and resolving dependencies - `pnpm install` now fails with `ERR_PNPM_UNSUPPORTED_PROTOCOL` when a dependency uses a specifier with a protocol pnpm does not support, such as Yarn's `patch:`. On Windows, such a specifier failed with `os error 123`. On other platforms, pnpm linked it to a directory that does not exist. Reading a `package.json` that fails now names the file [#​16590](https://redirect.github.com/pnpm/pnpm/issues/16590). - `pnpm install` now fails with `ERR_PNPM_PACKAGE_MANIFEST_INVALID_ATTRIBUTE` when a project declares a dependency whose specifier is not a string, such as `"is-positive": 42`. Before, the dependency was silently left out of the lockfile. A `readPackage` hook can still correct the specifier. - Fixed `pnpm install` failing with `ERR_PNPM_CMD_SHIM_RESOLVE_PATH` when an executable's parent directory contains a dangling symlink. - `pnpm install --frozen-lockfile` no longer fails with `ERR_PNPM_RESOLUTION_SHAPE_MISMATCH` when a `name@version` lockfile entry has a resolution served by a custom fetcher [pnpm/tasks#108](https://redirect.github.com/pnpm/tasks/issues/108). - `pnpm install --fix-lockfile` repairs a lockfile whose importer references a package that has no snapshot entry, as left by a badly merged lockfile. It failed with `ERR_PNPM_LOCKFILE_MISSING_DEPENDENCY` since 12.8.0 [#​16618](https://redirect.github.com/pnpm/pnpm/issues/16618). - When a dependency moves an exact dependency of its own to an older version, a peer dependency that pnpm installed automatically now moves with it. Before, `pnpm install` and `pnpm dedupe` kept the newer locked version of the peer, so the lockfile held two copies of it, for example two copies of `vue` [pnpm/tasks#61](https://redirect.github.com/pnpm/tasks/issues/61). - `pnpm dedupe` now reads registry metadata for a dependency pinned to an exact version, as `pnpm install` does. If the registry metadata disagreed with the package's `package.json`, the lockfile it wrote depended on whether `minimumReleaseAge` was set [#​16615](https://redirect.github.com/pnpm/pnpm/issues/16615). ##### Speed and size - Dependency resolution reads cached registry metadata faster. The metadata cache moved to `<cache-dir>/v12/`, so the first install after upgrading downloads registry metadata again. A damaged cache entry is downloaded again, or reported as an error when `--offline` is set. `pnpm cache prune` also removes the metadata cache that older pnpm versions wrote under `<cache-dir>/v11/` [#​13512](https://redirect.github.com/pnpm/pnpm/pull/13512). - Package metadata requests no longer wait behind queued tarball downloads when `maxSockets` or a proxy limits the connections to a registry. Large installs resolve faster and print fewer `Request took` warnings. - Sped up installs in large workspaces on macOS when the dependency links already exist. pnpm now keeps a link that already points at the right package without trying to create it first. Relinking the direct dependencies of 1,000 workspace projects took 45 ms, down from 116 ms [pnpm/tasks#65](https://redirect.github.com/pnpm/tasks/issues/65). - Commands in a project that pins a different pnpm version start about 13 ms faster on macOS. pnpm now runs the pinned version's binary directly, without the shell script in front of it [pnpm/tasks#66](https://redirect.github.com/pnpm/tasks/issues/66). - The pnpm binary is about 0.9 MB smaller, and the arm64 Linux binary is about 1 MB smaller still. ##### Running scripts and commands - `pnpm run` no longer prints `[ELIFECYCLE] Command failed ...` after Ctrl+C ends the script. pnpm still exits the way the script's shell did: on Windows with the shell's exit code (`cmd` reports `-1073741510`, PowerShell `1`), on Unix by re-raising `SIGINT` [#​16579](https://redirect.github.com/pnpm/pnpm/issues/16579). - `pnpm run "/<regex>/"` now accepts JavaScript regular expression syntax such as lookahead and lookbehind. A selector like `"/^hello:(?!b).*$/"` failed with `ERR_PNPM_NO_SCRIPT` [#​16604](https://redirect.github.com/pnpm/pnpm/issues/16604). - `pnpm run` and `pnpm exec` now forward `--config.*` command-line flags to the install started by `verifyDepsBeforeRun` [pnpm/tasks#60](https://redirect.github.com/pnpm/tasks/issues/60). - On Windows, a process started by `pnpm run` or `pnpm exec` can again start a child with `CREATE_BREAKAWAY_FROM_JOB`. That child keeps running after pnpm exits, even if the command fails [#​16628](https://redirect.github.com/pnpm/pnpm/issues/16628). - Empty `nodeOptions` values from command-line flags and environment variables now override lower-priority settings. Scripts retain `NODE_OPTIONS` from the parent environment or `extraEnv` when `nodeOptions` is empty. - pnpm now reads the `failIfNoMatch` setting from `pnpm-workspace.yaml`, so a filter that matches no workspace project exits with code 1 when the setting is `true`. The new `--no-fail-if-no-match` flag turns the setting off for one command [#​16577](https://redirect.github.com/pnpm/pnpm/issues/16577). ##### Configuration, setup, and pnpm versions - `pnpm config get --global` and `pnpm config list --global` now show only the global configuration, also when run inside a project. Settings from the project's `pnpm-workspace.yaml` and `.npmrc` were included before. The same applies to `--location=global` [#​16598](https://redirect.github.com/pnpm/pnpm/issues/16598). - pnpm now prints config warnings, such as an unset environment variable in `.npmrc`, when loading the config fails. - pnpm 11 releases older than 11.28.4 can run pnpm 12 again when the `packageManager` field pins it. Since 12.9.0 they failed with `SyntaxError: Invalid or unexpected token` [#​16594](https://redirect.github.com/pnpm/pnpm/issues/16594). - On Windows, `pnpm self-update` no longer runs the update a second time when it replaces a `pnpm.cmd` linked by pnpm 12.8 or older. cmd.exe read on in the replaced `pnpm.cmd`, printed an error about a command that is not recognized, and ran the new pnpm once more [#​16573](https://redirect.github.com/pnpm/pnpm/issues/16573). - `pnpm setup` now puts `$PNPM_HOME/bin` first on `PATH` in login shells that inherited it further down, such as the VS Code terminal on macOS. Before, another `node` took precedence over the one installed by `pnpm runtime set node -g`. Run `pnpm setup` again to update the block in your shell config [#​16635](https://redirect.github.com/pnpm/pnpm/issues/16635). - `pnpm setup` now names the shell config file even if it is already up to date [#​16608](https://redirect.github.com/pnpm/pnpm/issues/16608). ##### Updating, auditing, and publishing - `pnpm update --latest` now applies the `savePrefix` setting when it rewrites a dependency whose range has no operator of its own, such as `<2.0.0`. - The interactive `pnpm audit --fix` picker now shows each patched version with the `saveExact` and `savePrefix` style that the override is written with [#​13209](https://redirect.github.com/pnpm/pnpm/issues/13209). - `pnpm unpublish <pkg>@<version>` now deletes the tarball under the registry's path when the registry is served under one, such as Gitea's npm registry. It used to send the delete to the host root and report success without removing the version [#​16568](https://redirect.github.com/pnpm/pnpm/issues/16568). It also no longer mistakes a sibling path such as `/npm-mirror/` for the registry path `/npm/` [pnpm/tasks#94](https://redirect.github.com/pnpm/tasks/issues/94). ##### Output and messages - A warning about a project's `devEngines` or `packageManager` pin is now printed to stderr. A command such as `pnpm cache path` or `pnpm list --json` keeps only its own output on stdout [#​16584](https://redirect.github.com/pnpm/pnpm/issues/16584). - `pnpm list` now reports the correct package paths when `nodeLinker` is `hoisted` [#​9593](https://redirect.github.com/pnpm/pnpm/issues/9593). - Resolution errors now name the failing dependency and its parent packages. Fatal errors appear as structured error records with their error codes when using `--reporter=ndjson`. - The error for an invalid git repository in the lockfile now has the code `ERR_PNPM_INVALID_GIT_REPOSITORY`. Its message now lists every rejected form of the value. - `pnpm runtime --help` and `pnpm help runtime` now name the `set` subcommand and the runtimes it accepts [#​16580](https://redirect.github.com/pnpm/pnpm/issues/16580). <!-- sponsors --> #### Platinum Sponsors <table> <tbody> <tr> <td align="center" valign="middle"> <a href="https://bit.cloud/?utm_source=pnpm&utm_medium=release_notes" target="_blank" rel="noopener noreferrer"><img src="https://pnpm.io/img/users/bit.svg" width="80" alt="Bit"></a> </td> <td align="center" valign="middle"> <a href="https://openai.com/?utm_source=pnpm&utm_medium=release_notes" target="_blank" rel="noopener noreferrer"> <picture> <source media="(prefers-color-scheme: light)" srcset="https://pnpm.io/img/users/openai_dark.svg" /> <source media="(prefers-color-scheme: dark)" srcset="https://pnpm.io/img/users/openai_light.svg" /> <img src="https://pnpm.io/img/users/openai_dark.svg" width="160" alt="OpenAI" /> </picture> </a> </td> <td align="center" valign="middle"> <a href="https://notion.com/?utm_source=pnpm&utm_medium=release_notes" target="_blank" rel="noopener noreferrer"><img src="https://pnpm.io/img/users/notion.svg" width="80" alt="Notion"></a> </td> </tr> <tr> <td align="center" valign="middle"> <a href="https://coderabbit.ai/?utm_source=pnpm&utm_medium=release_notes" target="_blank" rel="noopener noreferrer"> <picture> <source media="(prefers-color-scheme: light)" srcset="https://pnpm.io/img/users/coderabbit.svg" /> <source media="(prefers-color-scheme: dark)" srcset="https://pnpm.io/img/users/coderabbit_light.svg" /> <img src="https://pnpm.io/img/users/coderabbit.svg" width="220" alt="CodeRabbit" /> </picture> </a> </td> </tr> </tbody> </table> #### Gold Sponsors <table> <tbody> <tr> <td align="center" valign="middle"> <a href="https://sanity.io/?utm_source=pnpm&utm_medium=release_notes" target="_blank" rel="noopener noreferrer"> <picture> <source media="(prefers-color-scheme: light)" srcset="https://pnpm.io/img/users/sanity.svg" /> <source media="(prefers-color-scheme: dark)" srcset="https://pnpm.io/img/users/sanity_light.svg" /> <img src="https://pnpm.io/img/users/sanity.svg" width="120" alt="Sanity" /> </picture> </a> </td> <td align="center" valign="middle"> <a href="https://discord.com/?utm_source=pnpm&utm_medium=release_notes" target="_blank" rel="noopener noreferrer"> <picture> <source media="(prefers-color-scheme: light)" srcset="https://pnpm.io/img/users/discord.svg" /> <source media="(prefers-color-scheme: dark)" srcset="https://pnpm.io/img/users/discord_light.svg" /> <img src="https://pnpm.io/img/users/discord.svg" width="220" alt="Discord" /> </picture> </a> </td> <td align="center" valign="middle"> <a href="https://vite.dev/?utm_source=pnpm&utm_medium=release_notes" target="_blank" rel="noopener noreferrer"><img src="https://pnpm.io/img/users/vitejs.svg" width="42" alt="Vite"></a> </td> </tr> <tr> <td align="center" valign="middle"> <a href="https://serpapi.com/?utm_source=pnpm&utm_medium=release_notes" target="_blank" rel="noopener noreferrer"> <picture> <source media="(prefers-color-scheme: light)" srcset="https://pnpm.io/img/users/serpapi_dark.svg" /> <source media="(prefers-color-scheme: dark)" srcset="https://pnpm.io/img/users/serpapi_light.svg" /> <img src="https://pnpm.io/img/users/serpapi_dark.svg" width="160" alt="Serp > [!IMPORTANT] > ✂ PR body was truncated to here. </details> --- ### Configuration 📅 **Schedule**: (UTC) - Branch creation - At any time (no schedule defined) - Automerge - At any time (no schedule defined) 🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied. ♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox. 🔕 **Ignore**: Close this PR and you won't be reminded about this update again. --- - [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check this box --- This PR was generated by [Mend Renovate](https://mend.io/renovate/). View the [repository job log](https://developer.mend.io/github/authelia/authelia). <!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0NC4xNjQuMSIsInVwZGF0ZWRJblZlciI6IjQ0LjE2NC4xIiwidGFyZ2V0QnJhbmNoIjoibWFzdGVyIiwibGFiZWxzIjpbImRlcGVuZGVuY2llcyIsImphdmFzY3JpcHQiXX0=--> Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com> |
||
|
renovate[bot]
|
8751d2d83f |
build(deps): update mccutchen/go-httpbin docker tag to v2.26.0 (#13481)
This PR contains the following updates: | Package | Update | Change | |---|---|---| | [mccutchen/go-httpbin](https://redirect.github.com/mccutchen/go-httpbin) | minor | `2.25.0` → `2.26.0` | --- ### Release Notes <details> <summary>mccutchen/go-httpbin</summary> ### [`v2.26.0`](https://redirect.github.com/mccutchen/go-httpbin/releases/tag/v2.26.0) [Compare Source](https://redirect.github.com/mccutchen/go-httpbin/compare/v2.25.0...v2.26.0) #### 🔐 Security vulnerability 🔐 > \[!WARNING]\ > **This release addresses an unbounded memory allocation denial of service vulnerability ([GHSA-m6j5-42w4-55c3](https://redirect.github.com/mccutchen/go-httpbin/security/advisories/GHSA-m6j5-42w4-55c3)) in the `/websocket/echo` endpoint**: A single crafted websocket frame can crash any go-httpbin server, including programs that embed the httpbin package, by declaring a huge payload length that the server will attempt to allocate before checking it against the configured size limits. > > **The attack needs no authentication and only one small request, and the resulting out-of-memory error kills the whole process rather than just the one connection.** Versions v2.13.0 through v2.25.x are affected; upgrade to v2.26.0, which checks frame and message size limits before allocating. > > Many thanks to [@​lucky07072026](https://redirect.github.com/lucky07072026) for the report, and many apologies from [@​mccutchen](https://redirect.github.com/mccutchen) for this "network protocols 101"-level bug! #### What's Changed - feat: add /image/avif endpoint by [@​ChrisJr404](https://redirect.github.com/ChrisJr404) in [#​270](https://redirect.github.com/mccutchen/go-httpbin/pull/270) - middleware: allow QUERY method in CORS preflight by [@​marr-cloud](https://redirect.github.com/marr-cloud) in [#​275](https://redirect.github.com/mccutchen/go-httpbin/pull/275) - websocket: enforce frame size limit before allocating frame buffer by [@​mccutchen](https://redirect.github.com/mccutchen) in [`4d62637`](https://redirect.github.com/mccutchen/go-httpbin/commit/4d62637fc356b4ae4a4035427b885374f412939a) - build: update minimium go version to 1.26 by [@​mccutchen](https://redirect.github.com/mccutchen) in [#​276](https://redirect.github.com/mccutchen/go-httpbin/pull/276) #### New Contributors - [@​ChrisJr404](https://redirect.github.com/ChrisJr404) made their first contribution in [#​270](https://redirect.github.com/mccutchen/go-httpbin/pull/270) - [@​marr-cloud](https://redirect.github.com/marr-cloud) made their first contribution in [#​275](https://redirect.github.com/mccutchen/go-httpbin/pull/275) - [@​lucky07072026](https://redirect.github.com/lucky07072026) reported [GHSA-m6j5-42w4-55c3](https://redirect.github.com/mccutchen/go-httpbin/security/advisories/GHSA-m6j5-42w4-55c3) **Full Changelog**: <https://github.com/mccutchen/go-httpbin/compare/v2.25.0...v2.26.0> </details> --- ### Configuration 📅 **Schedule**: (UTC) - Branch creation - At any time (no schedule defined) - Automerge - At any time (no schedule defined) 🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied. ♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox. 🔕 **Ignore**: Close this PR and you won't be reminded about this update again. --- - [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check this box --- This PR was generated by [Mend Renovate](https://mend.io/renovate/). View the [repository job log](https://developer.mend.io/github/authelia/authelia). <!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0NC4xNjQuMSIsInVwZGF0ZWRJblZlciI6IjQ0LjE2NC4xIiwidGFyZ2V0QnJhbmNoIjoibWFzdGVyIiwibGFiZWxzIjpbImRlcGVuZGVuY2llcyIsImRvY2tlciJdfQ==--> Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com> |
||
|
renovate[bot]
|
e486caa19d |
build(deps): update github/codeql-action action to v4.39.0 (#13480)
This PR contains the following updates: | Package | Type | Update | Change | |---|---|---|---| | [github/codeql-action](https://redirect.github.com/github/codeql-action) | action | minor | `v4.38.3` → `v4.39.0` | --- ### Release Notes <details> <summary>github/codeql-action</summary> ### [`v4.39.0`](https://redirect.github.com/github/codeql-action/releases/tag/v4.39.0) [Compare Source](https://redirect.github.com/github/codeql-action/compare/v4.38.3...v4.39.0) - *Breaking change*: Bump the minimum required CodeQL bundle version to 2.20.7. [#​4205](https://redirect.github.com/github/codeql-action/pull/4205) - The `codeql-action/analyze` step now validates that a correct argument for the `checkout_path` input has been provided. The `checkout_path` input must be set to the path where the repository that is being analyzed is checked out at on the runner, if that path is something other than the workspace root. If the path does not point to a repository checkout or is different from the path that was used by `codeql-action/init`, then the CodeQL Action now produces a warning. [#​4148](https://redirect.github.com/github/codeql-action/pull/4148) - Resolved an issue with third-party caching implementations that prevented caches from being restored correctly. [#​4206](https://redirect.github.com/github/codeql-action/pull/4206) - The `codeql-action/start-proxy` step that is used in Code Scanning Default Setup now finds CodeQL releases using the same logic as `codeql-action/init`. This primarily benefits customers who are using GitHub instances other than `github.com` where the `codeql-action/start-proxy` step may previously have been unable to locate recent releases and ended up using outdated versions of the private registry authentication proxy as a result. [#​4198](https://redirect.github.com/github/codeql-action/pull/4198) </details> --- ### Configuration 📅 **Schedule**: (UTC) - Branch creation - At any time (no schedule defined) - Automerge - At any time (no schedule defined) 🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied. ♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox. 🔕 **Ignore**: Close this PR and you won't be reminded about this update again. --- - [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check this box --- This PR was generated by [Mend Renovate](https://mend.io/renovate/). View the [repository job log](https://developer.mend.io/github/authelia/authelia). <!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0NC4xNjQuMSIsInVwZGF0ZWRJblZlciI6IjQ0LjE2NC4xIiwidGFyZ2V0QnJhbmNoIjoibWFzdGVyIiwibGFiZWxzIjpbImRlcGVuZGVuY2llcyIsImdpdGh1Yl9hY3Rpb25zIl19--> Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com> |
||
|
renovate[bot]
|
0c70436841 |
build(deps): update dependency @eslint-react/eslint-plugin to v5.27.1 (#13478)
This PR contains the following updates: | Package | Change | [Age](https://docs.renovatebot.com/merge-confidence/) | [Confidence](https://docs.renovatebot.com/merge-confidence/) | |---|---|---|---| | [@eslint-react/eslint-plugin](https://redirect.github.com/Rel1cx/eslint-react) ([source](https://redirect.github.com/Rel1cx/eslint-react/tree/HEAD/plugins/eslint-plugin)) | [`5.26.8` → `5.27.1`](https://renovatebot.com/diffs/npm/@eslint-react%2feslint-plugin/5.26.8/5.27.1) |  |  | --- ### Release Notes <details> <summary>Rel1cx/eslint-react (@​eslint-react/eslint-plugin)</summary> ### [`v5.27.1`](https://redirect.github.com/Rel1cx/eslint-react/blob/HEAD/CHANGELOG.md#v5271-2026-10-15) [Compare Source](https://redirect.github.com/Rel1cx/eslint-react/compare/v5.27.0...v5.27.1) ##### 🐞 Fixes - Lifecycle methods defined as class properties (ex: `componentDidMount = () => { this.setState(...) }`, including type-expression-wrapped values) are now reported just like the method shorthand form. ([#​2039](https://redirect.github.com/Rel1cx/eslint-react/issues/2039)) Affected rules: - `react-x/no-set-state-in-component-did-mount` - `react-x/no-set-state-in-component-did-update` - `react-x/no-set-state-in-component-will-update` - Effect cleanups are now recognized when the `useEffect` call is nested in an outer `return` (ex: `return useEffect(() => () => { ... })`), so resources released there are no longer reported as leaked. ([#​2039](https://redirect.github.com/Rel1cx/eslint-react/issues/2039)) Affected rules: - `react-web-api/no-leaked-event-listener` - `react-web-api/no-leaked-fetch` - `react-web-api/no-leaked-intersection-observer` - `react-web-api/no-leaked-interval` - `react-web-api/no-leaked-resize-observer` - `react-web-api/no-leaked-timeout` ##### 🏗️ Internal - `@eslint-react/ast`: added the `Check.isFunctionOrClass` and `Check.isTypeOrChainExpression` helpers; parent lookups across `ast`, `core`, and the rules are now bounded at enclosing function/class boundaries. ([#​2039](https://redirect.github.com/Rel1cx/eslint-react/issues/2039)) - `@eslint-react/core`: `isUseEffectSetupCallback` and `isUseEffectCleanupCallback` reimplemented on bounded parent lookups. ([#​2039](https://redirect.github.com/Rel1cx/eslint-react/issues/2039)) **Full Changelog**: <https://github.com/Rel1cx/eslint-react/compare/v5.27.0...v5.27.1> ### [`v5.27.0`](https://redirect.github.com/Rel1cx/eslint-react/blob/HEAD/CHANGELOG.md#v5270-2026-10-15) ##### 🐞 Fixes - `react-web-api/no-leaked-event-listener`: cleanups returned through conditional expressions (ex: `return cond ? () => window.removeEventListener(...) : null`) are now recognized and no longer reported. ([#​2038](https://redirect.github.com/Rel1cx/eslint-react/issues/2038)) - `react-web-api/no-leaked-fetch`: effect setups wrapped in type expressions (ex: `useEffect((() => { fetch(...) }) as any, [])`) are now recognized. ([#​2038](https://redirect.github.com/Rel1cx/eslint-react/issues/2038)) - `react-debug/function-component`: computed string-literal `displayName` keys (ex: `App["displayName"] = "..."`) are now recognized. ([#​2038](https://redirect.github.com/Rel1cx/eslint-react/issues/2038)) ##### 📝 Documentation - Revised the rule implementation pattern guides and refined the core ideas and layer dependency model in the fact-based rule implementation docs. ([#​2034](https://redirect.github.com/Rel1cx/eslint-react/issues/2034), [#​2035](https://redirect.github.com/Rel1cx/eslint-react/issues/2035)) ##### 🏗️ Internal - `@eslint-react/core`: accuracy and consistency fixes in detection helpers. ([#​2038](https://redirect.github.com/Rel1cx/eslint-react/issues/2038)) - `react-x`: the custom `tsl` config now enforces the fact-based layer dependency order. ([#​2036](https://redirect.github.com/Rel1cx/eslint-react/issues/2036)) - Bumped `react` and `react-dom` to `19.3.1`, and `next` to `16.4.1`. **Full Changelog**: <https://github.com/Rel1cx/eslint-react/compare/v5.26.7...v5.27.0> </details> --- ### Configuration 📅 **Schedule**: (UTC) - Branch creation - At any time (no schedule defined) - Automerge - At any time (no schedule defined) 🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied. ♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox. 🔕 **Ignore**: Close this PR and you won't be reminded about this update again. --- - [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check this box --- This PR was generated by [Mend Renovate](https://mend.io/renovate/). View the [repository job log](https://developer.mend.io/github/authelia/authelia). <!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0NC4xNjQuMSIsInVwZGF0ZWRJblZlciI6IjQ0LjE2NC4xIiwidGFyZ2V0QnJhbmNoIjoibWFzdGVyIiwibGFiZWxzIjpbImRlcGVuZGVuY2llcyIsImphdmFzY3JpcHQiXX0=--> Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com> |
||
|
renovate[bot]
|
5652c190e5 |
build(deps): update traefik docker tag to v3.7.15 (#13477)
This PR contains the following updates: | Package | Update | Change | |---|---|---| | [traefik](https://hub.docker.com/_/traefik) ([source](https://redirect.github.com/traefik/traefik)) | patch | `v3.7.14` → `v3.7.15` | --- ### Release Notes <details> <summary>traefik/traefik (traefik)</summary> ### [`v3.7.15`](https://redirect.github.com/traefik/traefik/blob/HEAD/CHANGELOG.md#v3715-2026-10-15) [Compare Source](https://redirect.github.com/traefik/traefik/compare/v3.7.14...v3.7.15) [All Commits](https://redirect.github.com/traefik/traefik/compare/v3.7.14...v3.7.15) **Bug fixes:** - **\[server]** Reject CONNECT requests regardless of HTTP version ([#​14031](https://redirect.github.com/traefik/traefik/pull/14031) [@​juliens](https://redirect.github.com/juliens)) - **\[server]** Reject CONNECT method before reaching the muxer ([#​14050](https://redirect.github.com/traefik/traefik/pull/14050) [@​juliens](https://redirect.github.com/juliens)) - **\[k8s/crd]** Allow observability metadata on child routers ([#​14018](https://redirect.github.com/traefik/traefik/pull/14018) [@​bunnysayzz](https://redirect.github.com/bunnysayzz)) - **\[k8s/gatewayapi]** Bump sigs.k8s.io/gateway-api to v1.6.3 ([#​14017](https://redirect.github.com/traefik/traefik/pull/14017) [@​rtribotte](https://redirect.github.com/rtribotte)) - **\[k8s/gatewayapi]** Default HTTPRoute backend scheme to HTTP when no appProtocol ([#​13935](https://redirect.github.com/traefik/traefik/pull/13935) [@​Tyagiquamar](https://redirect.github.com/Tyagiquamar)) - **\[k8s/ingress-nginx]** Apply auth-tls client authentication to the whole host ([#​14057](https://redirect.github.com/traefik/traefik/pull/14057) [@​juliens](https://redirect.github.com/juliens)) - **\[k8s/ingress-nginx]** Fix cross-namespace check on shared auth-tls-secret TLS options ([#​14066](https://redirect.github.com/traefik/traefik/pull/14066) [@​juliens](https://redirect.github.com/juliens)) - **\[fastproxy]** Add a non-regression test for CR/LF in FastProxy request headers ([#​13642](https://redirect.github.com/traefik/traefik/pull/13642) [@​mturac](https://redirect.github.com/mturac)) - **\[fastproxy]** Fix concurrent buffer reads on upgraded connections ([#​14023](https://redirect.github.com/traefik/traefik/pull/14023) [@​juliens](https://redirect.github.com/juliens)) - Bump golang.org/x/net to v0.60.0 ([#​14048](https://redirect.github.com/traefik/traefik/pull/14048) [@​kevinpollet](https://redirect.github.com/kevinpollet)) **Documentation:** - **\[security]** Fix typo in the Request Path page ([#​14036](https://redirect.github.com/traefik/traefik/pull/14036) [@​SethFalco](https://redirect.github.com/SethFalco)) - **\[k8s/crd]** Fix broken Kubernetes CRD definitions links in CRD reference pages ([#​14047](https://redirect.github.com/traefik/traefik/pull/14047) [@​SatvikMishra08](https://redirect.github.com/SatvikMishra08)) - **\[k8s]** Document the safeNaming impact on cross-provider references ([#​13768](https://redirect.github.com/traefik/traefik/pull/13768) [@​lazerg](https://redirect.github.com/lazerg)) - **\[k8s/gatewayapi]** Fix broken links in the Gateway API routing page ([#​14072](https://redirect.github.com/traefik/traefik/pull/14072) [@​Neffi42](https://redirect.github.com/Neffi42)) - Fix broken anchor links to Restrict the Scope of Service Discovery ([#​14056](https://redirect.github.com/traefik/traefik/pull/14056) [@​SatvikMishra08](https://redirect.github.com/SatvikMishra08)) - Add the documentation style guide to the Contributing section ([#​14061](https://redirect.github.com/traefik/traefik/pull/14061) [@​rachana5](https://redirect.github.com/rachana5)) - Remove redundant period in README ([#​14068](https://redirect.github.com/traefik/traefik/pull/14068) [@​mxmrnn](https://redirect.github.com/mxmrnn)) </details> --- ### Configuration 📅 **Schedule**: (UTC) - Branch creation - At any time (no schedule defined) - Automerge - At any time (no schedule defined) 🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied. ♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox. 🔕 **Ignore**: Close this PR and you won't be reminded about this update again. --- - [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check this box --- This PR was generated by [Mend Renovate](https://mend.io/renovate/). View the [repository job log](https://developer.mend.io/github/authelia/authelia). <!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0NC4xNjQuMSIsInVwZGF0ZWRJblZlciI6IjQ0LjE2NC4xIiwidGFyZ2V0QnJhbmNoIjoibWFzdGVyIiwibGFiZWxzIjpbImRlcGVuZGVuY2llcyIsImRvY2tlciJdfQ==--> Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com> |
||
|
renovate[bot]
|
2ca4302529 |
build(deps): update traefik docker tag to v2.11.59 (#13476)
This PR contains the following updates: | Package | Update | Change | |---|---|---| | [traefik](https://hub.docker.com/_/traefik) ([source](https://redirect.github.com/traefik/traefik)) | patch | `v2.11.58` → `v2.11.59` | --- ### Release Notes <details> <summary>traefik/traefik (traefik)</summary> ### [`v2.11.59`](https://redirect.github.com/traefik/traefik/blob/HEAD/CHANGELOG.md#v21159-2026-10-15) [Compare Source](https://redirect.github.com/traefik/traefik/compare/v2.11.58...v2.11.59) [All Commits](https://redirect.github.com/traefik/traefik/compare/v2.11.58...v2.11.59) **Bug fixes:** - **\[server]** Reject CONNECT requests regardless of HTTP version ([#​14031](https://redirect.github.com/traefik/traefik/pull/14031) [@​juliens](https://redirect.github.com/juliens)) - **\[server]** Reject CONNECT method before reaching the muxer ([#​14050](https://redirect.github.com/traefik/traefik/pull/14050) [@​juliens](https://redirect.github.com/juliens)) - Bump golang.org/x/net to v0.60.0 ([#​14048](https://redirect.github.com/traefik/traefik/pull/14048) [@​kevinpollet](https://redirect.github.com/kevinpollet)) </details> --- ### Configuration 📅 **Schedule**: (UTC) - Branch creation - At any time (no schedule defined) - Automerge - At any time (no schedule defined) 🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied. ♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox. 🔕 **Ignore**: Close this PR and you won't be reminded about this update again. --- - [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check this box --- This PR was generated by [Mend Renovate](https://mend.io/renovate/). View the [repository job log](https://developer.mend.io/github/authelia/authelia). <!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0NC4xNjQuMSIsInVwZGF0ZWRJblZlciI6IjQ0LjE2NC4xIiwidGFyZ2V0QnJhbmNoIjoibWFzdGVyIiwibGFiZWxzIjpbImRlcGVuZGVuY2llcyIsImRvY2tlciJdfQ==--> Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com> |
||
|
renovate[bot]
|
e872482949 |
build(deps): update dependency @eslint-react/eslint-plugin to v5.26.8 (#13474)
This PR contains the following updates: | Package | Change | [Age](https://docs.renovatebot.com/merge-confidence/) | [Confidence](https://docs.renovatebot.com/merge-confidence/) | |---|---|---|---| | [@eslint-react/eslint-plugin](https://redirect.github.com/Rel1cx/eslint-react) ([source](https://redirect.github.com/Rel1cx/eslint-react/tree/HEAD/plugins/eslint-plugin)) | [`5.26.7` → `5.26.8`](https://renovatebot.com/diffs/npm/@eslint-react%2feslint-plugin/5.26.7/5.26.8) |  |  | --- ### Configuration 📅 **Schedule**: (UTC) - Branch creation - At any time (no schedule defined) - Automerge - At any time (no schedule defined) 🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied. ♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox. 🔕 **Ignore**: Close this PR and you won't be reminded about this update again. --- - [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check this box --- This PR was generated by [Mend Renovate](https://mend.io/renovate/). View the [repository job log](https://developer.mend.io/github/authelia/authelia). <!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0NC4xNjQuMSIsInVwZGF0ZWRJblZlciI6IjQ0LjE2NC4xIiwidGFyZ2V0QnJhbmNoIjoibWFzdGVyIiwibGFiZWxzIjpbImRlcGVuZGVuY2llcyIsImphdmFzY3JpcHQiXX0=--> Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com> |
||
|
renovate[bot]
|
b11df02a05 |
build(deps): update dependency qs to v6.16.1 (#13475)
This PR contains the following updates: | Package | Change | [Age](https://docs.renovatebot.com/merge-confidence/) | [Confidence](https://docs.renovatebot.com/merge-confidence/) | |---|---|---|---| | [qs](https://redirect.github.com/ljharb/qs) | [`6.16.0` → `6.16.1`](https://renovatebot.com/diffs/npm/qs/6.16.0/6.16.1) |  |  | --- ### Release Notes <details> <summary>ljharb/qs (qs)</summary> ### [`v6.16.1`](https://redirect.github.com/ljharb/qs/blob/HEAD/CHANGELOG.md#6161) [Compare Source](https://redirect.github.com/ljharb/qs/compare/v6.16.0...v6.16.1) - \[Fix] `parse`: do not mutate an object input - \[Fix] `stringify`: stop re-encoding structural separator dots when `encodeDotInKeys` is set ([#​564](https://redirect.github.com/ljharb/qs/issues/564)) - \[Fix] `stringify`: `arrayFormat: 'comma'`: pass the full encoder arguments with `encodeValuesOnly` - \[Fix] `utils`: encode `+` as `%2B` in iso-8859-1 mode so values round-trip ([#​565](https://redirect.github.com/ljharb/qs/issues/565)) - \[Fix] parse: only convert top-level dots to brackets when allowDots is on ([#​621](https://redirect.github.com/ljharb/qs/issues/621)) - \[Fix] `stringify`: ignore inherited array format names ([#​622](https://redirect.github.com/ljharb/qs/issues/622)) - \[Fix] `stringify`: `arrayFormat: 'comma'`: do not throw on elements with no callable `toString` - \[Fix] `utils`: `merge`: seed an overflow container's index from its own keys, not just the source - \[Fix] `utils`: `merge`: keep a `strictMerge` conflict container's index and `arrayLimit` correct - \[Fix] `parse`: only treat `[]` as array syntax when it ends the key - \[Perf] `decode`: skip decoders when there is no percent sign ([#​583](https://redirect.github.com/ljharb/qs/issues/583)) - \[Robustness] `utils`: `merge`: apply `arrayLimit` to the two-element array built for colliding values - \[Robustness] `parse`: bound the nesting added by repeated `strictMerge` conflicts (credit [@​Yeaseen](https://redirect.github.com/Yeaseen)) - \[Docs] document that `qs` and flat parsers disagree about parameter names - \[Docs] clarify that `throwOnLimitExceeded` limits each array, not the total number of values - \[Docs] clarify 6.14.1/6.15.2 parse bracket behavior change ([#​567](https://redirect.github.com/ljharb/qs/issues/567), [#​568](https://redirect.github.com/ljharb/qs/issues/568)) - \[meta] fix changelog indents - \[actions] set least-privilege `cache-mode` - \[Tests] `utils`: `decode`: add missing cases - \[Tests] `parse`: characterize the `]=` split when an `=` precedes any bracket group ([#​620](https://redirect.github.com/ljharb/qs/issues/620)) - \[Tests] `parse`: `allowDots`: cover stray close brackets before a dot - \[Dev Deps] update `@ljharb/eslint-config`, `eslint`, `tape` </details> --- ### Configuration 📅 **Schedule**: (UTC) - Branch creation - At any time (no schedule defined) - Automerge - At any time (no schedule defined) 🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied. ♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox. 🔕 **Ignore**: Close this PR and you won't be reminded about this update again. --- - [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check this box --- This PR was generated by [Mend Renovate](https://mend.io/renovate/). View the [repository job log](https://developer.mend.io/github/authelia/authelia). <!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0NC4xNjQuMSIsInVwZGF0ZWRJblZlciI6IjQ0LjE2NC4xIiwidGFyZ2V0QnJhbmNoIjoibWFzdGVyIiwibGFiZWxzIjpbImRlcGVuZGVuY2llcyIsImphdmFzY3JpcHQiXX0=--> Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com> |
||
|
renovate[bot]
|
afe6ec1047 |
build(deps): update react-email monorepo to v6.11.2 (#13473)
This PR contains the following updates: | Package | Change | [Age](https://docs.renovatebot.com/merge-confidence/) | [Confidence](https://docs.renovatebot.com/merge-confidence/) | |---|---|---|---| | [@react-email/ui](https://redirect.github.com/resend/react-email) ([source](https://redirect.github.com/resend/react-email/tree/HEAD/packages/ui)) | [`6.11.1` → `6.11.2`](https://renovatebot.com/diffs/npm/@react-email%2fui/6.11.1/6.11.2) |  |  | | [react-email](https://redirect.github.com/resend/react-email) ([source](https://redirect.github.com/resend/react-email/tree/HEAD/packages/react-email)) | [`6.11.1` → `6.11.2`](https://renovatebot.com/diffs/npm/react-email/6.11.1/6.11.2) |  |  | --- ### Release Notes <details> <summary>resend/react-email (@​react-email/ui)</summary> ### [`v6.11.2`](https://redirect.github.com/resend/react-email/blob/HEAD/packages/ui/CHANGELOG.md#6112) [Compare Source](https://redirect.github.com/resend/react-email/compare/@react-email/ui@6.11.1...@react-email/ui@6.11.2) </details> <details> <summary>resend/react-email (react-email)</summary> ### [`v6.11.2`](https://redirect.github.com/resend/react-email/blob/HEAD/packages/react-email/CHANGELOG.md#6112) [Compare Source](https://redirect.github.com/resend/react-email/compare/react-email@6.11.1...react-email@6.11.2) ##### Patch Changes - [`7190dca`](https://redirect.github.com/resend/react-email/commit/7190dca): Leave the direction marks U+200E and U+200F out of the `<Preview>` padding, so spam filters such as rspamd no longer score it as hidden text. The padding sequence is now `\xa0`; if you post-process rendered HTML by matching the old sequence, update it. - [`63f159a`](https://redirect.github.com/resend/react-email/commit/63f159a): `<Tailwind>` now inlines the default color for `shadow`, `shadow-md`, `ring-2` and similar classes, so these shadows show in email clients. </details> --- ### Configuration 📅 **Schedule**: (UTC) - Branch creation - At any time (no schedule defined) - Automerge - At any time (no schedule defined) 🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied. ♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox. 🔕 **Ignore**: Close this PR and you won't be reminded about these updates again. --- - [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check this box --- This PR was generated by [Mend Renovate](https://mend.io/renovate/). View the [repository job log](https://developer.mend.io/github/authelia/authelia). <!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0NC4xNjQuMSIsInVwZGF0ZWRJblZlciI6IjQ0LjE2NC4xIiwidGFyZ2V0QnJhbmNoIjoibWFzdGVyIiwibGFiZWxzIjpbImRlcGVuZGVuY2llcyIsImphdmFzY3JpcHQiXX0=--> Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com> |
||
|
renovate[bot]
|
509237c937 |
build(deps): update dependency i18next to v26.4.5 (#13470)
This PR contains the following updates: | Package | Change | [Age](https://docs.renovatebot.com/merge-confidence/) | [Confidence](https://docs.renovatebot.com/merge-confidence/) | |---|---|---|---| | [i18next](https://www.i18next.com) ([source](https://redirect.github.com/i18next/i18next)) | [`26.4.4` → `26.4.5`](https://renovatebot.com/diffs/npm/i18next/26.4.4/26.4.5) |  |  | --- ### Release Notes <details> <summary>i18next/i18next (i18next)</summary> ### [`v26.4.5`](https://redirect.github.com/i18next/i18next/blob/HEAD/CHANGELOG.md#2645) [Compare Source](https://redirect.github.com/i18next/i18next/compare/v26.4.4...v26.4.5) - fix: `hasLoadedNamespace(ns, { lng })` no longer stays `false` forever when the passed in `lng` is loaded under another code, or not at all. It checked the load state of the raw `lng`, but `loadLanguages()` stores a language under its resolved code (`de-ch` → `de-CH`, `de-CH` → `de` with `load: 'languageOnly'`) and skips a `lng` outside `supportedLngs` entirely (only the fallback gets loaded), so that state never got set. react-i18next's `useTranslation(ns, { lng })` then never became ready: with `useSuspense` it kept throwing an already resolved promise and React retried forever (100% CPU, SSR never finished), without it the load effect re-rendered in a loop. It now checks the code the language is actually loaded under, and for a `lng` outside `supportedLngs` only waits for the fallback, which is also what `t()` resolves to. Calls without `lng` and the `precheck` (react-i18next's `bindI18n: 'languageChanging'`) are unchanged ([react-i18next#1934](https://redirect.github.com/i18next/react-i18next/issues/1934)). </details> --- ### Configuration 📅 **Schedule**: (UTC) - Branch creation - At any time (no schedule defined) - Automerge - At any time (no schedule defined) 🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied. ♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox. 🔕 **Ignore**: Close this PR and you won't be reminded about this update again. --- - [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check this box --- This PR was generated by [Mend Renovate](https://mend.io/renovate/). View the [repository job log](https://developer.mend.io/github/authelia/authelia). <!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0NC4xNjQuMSIsInVwZGF0ZWRJblZlciI6IjQ0LjE2NC4xIiwidGFyZ2V0QnJhbmNoIjoibWFzdGVyIiwibGFiZWxzIjpbImRlcGVuZGVuY2llcyIsImphdmFzY3JpcHQiXX0=--> Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com> |
||
|
renovate[bot]
|
19e031d8f1 |
build(deps): update dependency i18next-http-backend to v4.0.3 (#13472)
This PR contains the following updates: | Package | Change | [Age](https://docs.renovatebot.com/merge-confidence/) | [Confidence](https://docs.renovatebot.com/merge-confidence/) | |---|---|---|---| | [i18next-http-backend](https://redirect.github.com/i18next/i18next-http-backend) | [`4.0.2` → `4.0.3`](https://renovatebot.com/diffs/npm/i18next-http-backend/4.0.2/4.0.3) |  |  | --- ### Release Notes <details> <summary>i18next/i18next-http-backend (i18next-http-backend)</summary> ### [`v4.0.3`](https://redirect.github.com/i18next/i18next-http-backend/blob/HEAD/CHANGELOG.md#403) [Compare Source](https://redirect.github.com/i18next/i18next-http-backend/compare/v4.0.2...v4.0.3) Security release. See advisory [GHSA-9jhj-wvmw-cfx5](https://redirect.github.com/i18next/i18next-http-backend/security/advisories/GHSA-9jhj-wvmw-cfx5). - security: refuse a request URL that starts with `//` (or `\`) when the `loadPath` / `addPath` template does not. With a template that puts `{{ns}}` directly after a leading `/` (e.g. `/{{ns}}/{{lng}}.json`), an `ns` value of `/evil.example` passed the per-value checks, because a single `/` is allowed for nested namespaces, but it joined the template's own `/` into `//evil.example/en.json`, a protocol-relative URL that browsers send to another origin. The 4.0.2 `//` check looked at the value only, so it missed this. The interpolated URL is now checked as a whole. The default `/locales/{{lng}}/{{ns}}.json`, templates with an origin, and protocol-relative CDN templates such as `//cdn.example/{{lng}}/{{ns}}.json` are not affected and keep working. </details> --- ### Configuration 📅 **Schedule**: (UTC) - Branch creation - At any time (no schedule defined) - Automerge - At any time (no schedule defined) 🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied. ♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox. 🔕 **Ignore**: Close this PR and you won't be reminded about this update again. --- - [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check this box --- This PR was generated by [Mend Renovate](https://mend.io/renovate/). View the [repository job log](https://developer.mend.io/github/authelia/authelia). <!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0NC4xNjQuMSIsInVwZGF0ZWRJblZlciI6IjQ0LjE2NC4xIiwidGFyZ2V0QnJhbmNoIjoibWFzdGVyIiwibGFiZWxzIjpbImRlcGVuZGVuY2llcyIsImphdmFzY3JpcHQiXX0=--> Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com> |
||
|
renovate[bot]
|
ec857b0a52 |
build(deps): update dependency @eslint-react/eslint-plugin to v5.26.7 (#13468)
This PR contains the following updates: | Package | Change | [Age](https://docs.renovatebot.com/merge-confidence/) | [Confidence](https://docs.renovatebot.com/merge-confidence/) | |---|---|---|---| | [@eslint-react/eslint-plugin](https://redirect.github.com/Rel1cx/eslint-react) ([source](https://redirect.github.com/Rel1cx/eslint-react/tree/HEAD/plugins/eslint-plugin)) | [`5.26.5` → `5.26.7`](https://renovatebot.com/diffs/npm/@eslint-react%2feslint-plugin/5.26.5/5.26.7) |  |  | --- ### Release Notes <details> <summary>Rel1cx/eslint-react (@​eslint-react/eslint-plugin)</summary> ### [`v5.26.7`](https://redirect.github.com/Rel1cx/eslint-react/blob/HEAD/CHANGELOG.md#v5267-2026-10-15) [Compare Source](https://redirect.github.com/Rel1cx/eslint-react/compare/v5.26.6...v5.26.7) ##### 🏗️ Internal - `@eslint-react/core`: collectors now use the node's source range start as the map key, replacing the shared counter, keys are stable across repeated lints, traceable to source positions when debugging, and slightly cheaper than stringified numbers. ([#​2033](https://redirect.github.com/Rel1cx/eslint-react/issues/2033)) **Full Changelog**: <https://github.com/Rel1cx/eslint-react/compare/v5.26.6...v5.26.7> ### [`v5.26.6`](https://redirect.github.com/Rel1cx/eslint-react/blob/HEAD/CHANGELOG.md#v5266-2026-10-14) [Compare Source](https://redirect.github.com/Rel1cx/eslint-react/compare/v5.26.5...v5.26.6) ##### 🏗️ Internal - `@eslint-react/core`: component and hook collectors now use sequential integer keys instead of random `randomBytes` hex keys, removing `node:crypto` from the lint hot path. ([#​2032](https://redirect.github.com/Rel1cx/eslint-react/issues/2032)) Thanks to [@​kurtextrem](https://redirect.github.com/kurtextrem)! - Bumped `effect` to `4.0.4`, `ts-pattern` to `5.9.2`, `fumadocs-core` and `fumadocs-ui` to `16.17.3`, `lucide-react` to `1.57.0`, `oxlint` to `1.88.0`, `typedoc-plugin-markdown` to `4.14.0`, and `undici` to `8.12.1`. ##### New Contributors - **Jacob Groß** ([@​kurtextrem](https://redirect.github.com/kurtextrem)) made their first contribution in [#​2032](https://redirect.github.com/Rel1cx/eslint-react/issues/2032). **Full Changelog**: <https://github.com/Rel1cx/eslint-react/compare/v5.26.5...v5.26.6> </details> --- ### Configuration 📅 **Schedule**: (UTC) - Branch creation - At any time (no schedule defined) - Automerge - At any time (no schedule defined) 🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied. ♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox. 🔕 **Ignore**: Close this PR and you won't be reminded about this update again. --- - [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check this box --- This PR was generated by [Mend Renovate](https://mend.io/renovate/). View the [repository job log](https://developer.mend.io/github/authelia/authelia). <!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0NC4xNjQuMSIsInVwZGF0ZWRJblZlciI6IjQ0LjE2NC4xIiwidGFyZ2V0QnJhbmNoIjoibWFzdGVyIiwibGFiZWxzIjpbImRlcGVuZGVuY2llcyIsImphdmFzY3JpcHQiXX0=--> Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com> |
||
|
renovate[bot]
|
47aeddd1c6 |
build(deps): update react monorepo to v19.3.1 (#13471)
This PR contains the following updates: | Package | Change | [Age](https://docs.renovatebot.com/merge-confidence/) | [Confidence](https://docs.renovatebot.com/merge-confidence/) | |---|---|---|---| | [react](https://react.dev/) ([source](https://redirect.github.com/react/react/tree/HEAD/packages/react)) | [`19.3.0` → `19.3.1`](https://renovatebot.com/diffs/npm/react/19.3.0/19.3.1) |  |  | | [react-dom](https://react.dev/) ([source](https://redirect.github.com/react/react/tree/HEAD/packages/react-dom)) | [`19.3.0` → `19.3.1`](https://renovatebot.com/diffs/npm/react-dom/19.3.0/19.3.1) |  |  | --- ### Release Notes <details> <summary>react/react (react)</summary> ### [`v19.3.1`](https://redirect.github.com/react/react/releases/tag/v19.3.1): 19.3.1 (October 14th, 2026) [Compare Source](https://redirect.github.com/react/react/compare/v19.3.0...v19.3.1) #### React Server Components - Improve transport protocol ([#​37845](https://redirect.github.com/facebook/react/pull/37845) by [@​unstubbable](https://redirect.github.com/unstubbable) and [@​eps1lon](https://redirect.github.com/eps1lon)) </details> --- ### Configuration 📅 **Schedule**: (UTC) - Branch creation - At any time (no schedule defined) - Automerge - At any time (no schedule defined) 🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied. ♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox. 🔕 **Ignore**: Close this PR and you won't be reminded about these updates again. --- - [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check this box --- This PR was generated by [Mend Renovate](https://mend.io/renovate/). View the [repository job log](https://developer.mend.io/github/authelia/authelia). <!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0NC4xNjQuMSIsInVwZGF0ZWRJblZlciI6IjQ0LjE2NC4xIiwidGFyZ2V0QnJhbmNoIjoibWFzdGVyIiwibGFiZWxzIjpbImRlcGVuZGVuY2llcyIsImphdmFzY3JpcHQiXX0=--> Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com> |
