authelia

0 Fork 0

mirror of https://github.com/authelia/authelia.git synced 2026-10-28 09:34:52 +08:00

Author	SHA1	Message	Date
renovate[bot]	a5da19e41b	build(deps): update dependency happy-dom to v21 (#13485 ) This PR contains the following updates: \| Package \| Change \| [Age](https://docs.renovatebot.com/merge-confidence/) \| [Confidence](https://docs.renovatebot.com/merge-confidence/) \| \|---\|---\|---\|---\| \| [happy-dom](https://redirect.github.com/capricorn86/happy-dom) \| [`20.14.6` → `21.0.1`](https://renovatebot.com/diffs/npm/happy-dom/20.14.6/21.0.1) \| ![age](https://developer.mend.io/api/mc/badges/age/npm/happy-dom/21.0.1?slim=true) \| ![confidence](https://developer.mend.io/api/mc/badges/confidence/npm/happy-dom/20.14.6/21.0.1?slim=true) \| --- ### Release Notes <details> <summary>capricorn86/happy-dom (happy-dom)</summary> ### [`v21.0.1`](https://redirect.github.com/capricorn86/happy-dom/releases/tag/v21.0.1) [Compare Source](https://redirect.github.com/capricorn86/happy-dom/compare/v21.0.0...v21.0.1) ##### 👷‍♂️ Patch fixes - Adds alias for enabling CSS and iframe loading to [@happy-dom/server-renderer](https://redirect.github.com/capricorn86/happy-dom/wiki/Server-Renderer) - By [@capricorn86](https://redirect.github.com/capricorn86) ### [`v21.0.0`](https://redirect.github.com/capricorn86/happy-dom/releases/tag/v21.0.0) [Compare Source](https://redirect.github.com/capricorn86/happy-dom/compare/v20.14.6...v21.0.0) ##### 💣 Breaking Changes - Disables CSS and IFrame loading by default to prevent [server-side request forgery (SSRF)](https://en.wikipedia.org/wiki/Server-side_request_forgery) - By [@capricorn86](https://redirect.github.com/capricorn86) - An attacker could embed `<iframe>` or `<link rel="stylesheet">` elements in untrusted HTML to make Happy DOM send HTTP requests from the server to attacker-chosen URLs, including internal services. This could allow access to otherwise unreachable endpoints or trigger unintended actions, depending on the application and its network access. - The settings property `disableCSSFileLoading` has been deprecated - Added the new settings properties [enableCSSFileLoading](https://redirect.github.com/capricorn86/happy-dom/wiki/IBrowserSettings#properties) and [enableIframePageLoading](https://redirect.github.com/capricorn86/happy-dom/wiki/IBrowserSettings#properties) </details> --- ### Configuration 📅 Schedule: (UTC) - Branch creation - At any time (no schedule defined) - Automerge - At any time (no schedule defined) 🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied. ♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox. 🔕 Ignore: Close this PR and you won't be reminded about this update again. --- - [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check this box --- This PR was generated by [Mend Renovate](https://mend.io/renovate/). View the [repository job log](https://developer.mend.io/github/authelia/authelia). <!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0NC4xNjQuMSIsInVwZGF0ZWRJblZlciI6IjQ0LjE2NC4xIiwidGFyZ2V0QnJhbmNoIjoibWFzdGVyIiwibGFiZWxzIjpbImRlcGVuZGVuY2llcyIsImphdmFzY3JpcHQiXX0=--> Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>	2026-10-16 10:49:09 +00:00
renovate[bot]	119ee836e9	build(deps): update step-security/harden-runner action to v2.22.1 (#13484 ) This PR contains the following updates: \| Package \| Type \| Update \| Change \| \|---\|---\|---\|---\| \| [step-security/harden-runner](https://redirect.github.com/step-security/harden-runner) \| action \| minor \| `v2.21.1` → `v2.22.1` \| --- ### Release Notes <details> <summary>step-security/harden-runner</summary> ### [`v2.22.1`](https://redirect.github.com/step-security/harden-runner/releases/tag/v2.22.1) [Compare Source](https://redirect.github.com/step-security/harden-runner/compare/v2.22.0...v2.22.1) ##### What's Changed - Fixed security rules not initializing on GHES self-hosted runners - Fixed GHES connectivity in block mode by implicitly allowing the GHES hostname Full Changelog: <https://github.com/step-security/harden-runner/compare/v2.22.0...v2.22.1> ### [`v2.22.0`](https://redirect.github.com/step-security/harden-runner/releases/tag/v2.22.0) [Compare Source](https://redirect.github.com/step-security/harden-runner/compare/v2.21.1...v2.22.0) ##### What's Changed - Linux ARM64 support for community tier - GHES support for self-hosted VMs (enterprise tier) - MacOS and Windows runner deny list support for block policy (enterprise tier). Full Changelog: <https://github.com/step-security/harden-runner/compare/v2.21.1...v2.22.0> </details> --- ### Configuration 📅 Schedule: (UTC) - Branch creation - At any time (no schedule defined) - Automerge - At any time (no schedule defined) 🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied. ♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox. 🔕 Ignore: Close this PR and you won't be reminded about this update again. --- - [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check this box --- This PR was generated by [Mend Renovate](https://mend.io/renovate/). View the [repository job log](https://developer.mend.io/github/authelia/authelia). <!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0NC4xNjQuMSIsInVwZGF0ZWRJblZlciI6IjQ0LjE2NC4xIiwidGFyZ2V0QnJhbmNoIjoibWFzdGVyIiwibGFiZWxzIjpbImRlcGVuZGVuY2llcyIsImdpdGh1Yl9hY3Rpb25zIl19--> Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>	2026-10-16 10:48:56 +00:00
renovate[bot]	c27af0564f	build(deps): update ossf/scorecard-action action to v2.5.0 (#13482 ) This PR contains the following updates: \| Package \| Type \| Update \| Change \| \|---\|---\|---\|---\| \| [ossf/scorecard-action](https://redirect.github.com/ossf/scorecard-action) \| action \| minor \| `v2.4.4` → `v2.5.0` \| --- ### Release Notes <details> <summary>ossf/scorecard-action</summary> ### [`v2.5.0`](https://redirect.github.com/ossf/scorecard-action/releases/tag/v2.5.0) [Compare Source](https://redirect.github.com/ossf/scorecard-action/compare/v2.4.4...v2.5.0) #### What's Changed This release moves the action to Scorecard v5.6.0, the first Scorecard release since its hosted services moved to new infrastructure. For changes to checks and results, and what the infrastructure move means for you, see the [Scorecard v5.6.0 release notes](https://redirect.github.com/ossf/scorecard/releases/tag/v5.6.0). - The action's container image is built with Go 1.27.2 on a refreshed distroless base. by [@justaugustus](https://redirect.github.com/justaugustus) in [#1716](https://redirect.github.com/ossf/scorecard-action/pull/1716) - The installer (`cmd/installer`) now creates `.github/workflows/scorecard.yml`, and still recognizes existing `scorecards.yml` and `scorecards-analysis.yml` workflows. by [@justaugustus](https://redirect.github.com/justaugustus) in [#1716](https://redirect.github.com/ossf/scorecard-action/pull/1716) - The Scorecard version in results now always matches the Scorecard release the action is built with. by [@justaugustus](https://redirect.github.com/justaugustus) in [#1718](https://redirect.github.com/ossf/scorecard-action/pull/1718) - The action no longer prints the GitHub token variable while validating its options. by [@arpitjain099](https://redirect.github.com/arpitjain099) in [#1709](https://redirect.github.com/ossf/scorecard-action/pull/1709) - `results_format` accepts `intoto`, which wraps the JSON results in an in-toto attestation statement. by [@puerco](https://redirect.github.com/puerco) in [#1702](https://redirect.github.com/ossf/scorecard-action/pull/1702) ##### Other - Add a daily canary against Scorecard main by [@justaugustus](https://redirect.github.com/justaugustus) in [#1711](https://redirect.github.com/ossf/scorecard-action/pull/1711) - Bump Scorecard to the v5.6.0 candidate and fix the canary toolchain by [@justaugustus](https://redirect.github.com/justaugustus) in [#1714](https://redirect.github.com/ossf/scorecard-action/pull/1714) - Run Scorecard on every merge, add a zizmor presubmit, analyze workflows with CodeQL, and update RELEASE.md by [@justaugustus](https://redirect.github.com/justaugustus) in [#1716](https://redirect.github.com/ossf/scorecard-action/pull/1716) - Bump Scorecard to v5.6.0 by [@justaugustus](https://redirect.github.com/justaugustus) in [#1719](https://redirect.github.com/ossf/scorecard-action/pull/1719) #### New Contributors - [@arpitjain099](https://redirect.github.com/arpitjain099) made their first contribution in [#1709](https://redirect.github.com/ossf/scorecard-action/pull/1709) - [@puerco](https://redirect.github.com/puerco) made their first contribution in [#1702](https://redirect.github.com/ossf/scorecard-action/pull/1702) Full Changelog: <https://github.com/ossf/scorecard-action/compare/v2.4.4...v2.5.0> </details> --- ### Configuration 📅 Schedule: (UTC) - Branch creation - At any time (no schedule defined) - Automerge - At any time (no schedule defined) 🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied. ♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox. 🔕 Ignore: Close this PR and you won't be reminded about this update again. --- - [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check this box --- This PR was generated by [Mend Renovate](https://mend.io/renovate/). View the [repository job log](https://developer.mend.io/github/authelia/authelia). <!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0NC4xNjQuMSIsInVwZGF0ZWRJblZlciI6IjQ0LjE2NC4xIiwidGFyZ2V0QnJhbmNoIjoibWFzdGVyIiwibGFiZWxzIjpbImRlcGVuZGVuY2llcyIsImdpdGh1Yl9hY3Rpb25zIl19--> Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>	2026-10-16 10:04:09 +00:00
renovate[bot]	4c10b7a54e	build(deps): update pnpm to v12.11.2 (#13483 ) > [!NOTE] > This PR body was truncated due to platform limits. This PR contains the following updates: \| Package \| Change \| [Age](https://docs.renovatebot.com/merge-confidence/) \| [Confidence](https://docs.renovatebot.com/merge-confidence/) \| \|---\|---\|---\|---\| \| [pnpm](https://pnpm.io) ([source](https://redirect.github.com/pnpm/pnpm/tree/HEAD/pnpm/npm/pnpm)) \| [`12.9.1` → `12.11.2`](https://renovatebot.com/diffs/npm/pnpm/12.9.1/12.11.2) \| ![age](https://developer.mend.io/api/mc/badges/age/npm/pnpm/12.11.2?slim=true) \| ![confidence](https://developer.mend.io/api/mc/badges/confidence/npm/pnpm/12.9.1/12.11.2?slim=true) \| --- ### Release Notes <details> <summary>pnpm/pnpm (pnpm)</summary> ### [`v12.11.2`](https://redirect.github.com/pnpm/pnpm/releases/tag/v12.11.2): pnpm 12.11.2 [Compare Source](https://redirect.github.com/pnpm/pnpm/compare/v12.11.1...v12.11.2) This release fixes `--workspace-concurrency=Infinity`, filters set by an `updateConfig` hook, and store fetches with `enable-modules-dir=false`. ##### Patch Changes - `--workspace-concurrency=Infinity` now runs workspace projects with no concurrency limit. It used to fail with `invalid digit found in string` [#16793](https://redirect.github.com/pnpm/pnpm/issues/16793). - `pnpm install` and other recursive commands now apply the `filter` and `filterProd` that an `updateConfig` hook sets. They used to run on every workspace project [#16792](https://redirect.github.com/pnpm/pnpm/issues/16792). - `enable-modules-dir=false` now also fetches the packages an install reuses from an existing lockfile, so the store holds every package the lockfile lists. <!-- sponsors --> #### Platinum Sponsors <table> <tbody> <tr> <td align="center" valign="middle"> <a href="https://bit.cloud/?utm_source=pnpm&utm_medium=release_notes" target="_blank" rel="noopener noreferrer"><img src="https://pnpm.io/img/users/bit.svg" width="80" alt="Bit"></a> </td> <td align="center" valign="middle"> <a href="https://openai.com/?utm_source=pnpm&utm_medium=release_notes" target="_blank" rel="noopener noreferrer"> <picture> <source media="(prefers-color-scheme: light)" srcset="https://pnpm.io/img/users/openai_dark.svg" /> <source media="(prefers-color-scheme: dark)" srcset="https://pnpm.io/img/users/openai_light.svg" /> <img src="https://pnpm.io/img/users/openai_dark.svg" width="160" alt="OpenAI" /> </picture> </a> </td> <td align="center" valign="middle"> <a href="https://notion.com/?utm_source=pnpm&utm_medium=release_notes" target="_blank" rel="noopener noreferrer"><img src="https://pnpm.io/img/users/notion.svg" width="80" alt="Notion"></a> </td> </tr> <tr> <td align="center" valign="middle"> <a href="https://coderabbit.ai/?utm_source=pnpm&utm_medium=release_notes" target="_blank" rel="noopener noreferrer"> <picture> <source media="(prefers-color-scheme: light)" srcset="https://pnpm.io/img/users/coderabbit.svg" /> <source media="(prefers-color-scheme: dark)" srcset="https://pnpm.io/img/users/coderabbit_light.svg" /> <img src="https://pnpm.io/img/users/coderabbit.svg" width="220" alt="CodeRabbit" /> </picture> </a> </td> </tr> </tbody> </table> #### Gold Sponsors <table> <tbody> <tr> <td align="center" valign="middle"> <a href="https://sanity.io/?utm_source=pnpm&utm_medium=release_notes" target="_blank" rel="noopener noreferrer"> <picture> <source media="(prefers-color-scheme: light)" srcset="https://pnpm.io/img/users/sanity.svg" /> <source media="(prefers-color-scheme: dark)" srcset="https://pnpm.io/img/users/sanity_light.svg" /> <img src="https://pnpm.io/img/users/sanity.svg" width="120" alt="Sanity" /> </picture> </a> </td> <td align="center" valign="middle"> <a href="https://discord.com/?utm_source=pnpm&utm_medium=release_notes" target="_blank" rel="noopener noreferrer"> <picture> <source media="(prefers-color-scheme: light)" srcset="https://pnpm.io/img/users/discord.svg" /> <source media="(prefers-color-scheme: dark)" srcset="https://pnpm.io/img/users/discord_light.svg" /> <img src="https://pnpm.io/img/users/discord.svg" width="220" alt="Discord" /> </picture> </a> </td> <td align="center" valign="middle"> <a href="https://vite.dev/?utm_source=pnpm&utm_medium=release_notes" target="_blank" rel="noopener noreferrer"><img src="https://pnpm.io/img/users/vitejs.svg" width="42" alt="Vite"></a> </td> </tr> <tr> <td align="center" valign="middle"> <a href="https://serpapi.com/?utm_source=pnpm&utm_medium=release_notes" target="_blank" rel="noopener noreferrer"> <picture> <source media="(prefers-color-scheme: light)" srcset="https://pnpm.io/img/users/serpapi_dark.svg" /> <source media="(prefers-color-scheme: dark)" srcset="https://pnpm.io/img/users/serpapi_light.svg" /> <img src="https://pnpm.io/img/users/serpapi_dark.svg" width="160" alt="SerpApi" /> </picture> </a> </td> <td align="center" valign="middle"> <a href="https://stackblitz.com/?utm_source=pnpm&utm_medium=release_notes" target="_blank" rel="noopener noreferrer"> <picture> <source media="(prefers-color-scheme: light)" srcset="https://pnpm.io/img/users/stackblitz.svg" /> <source media="(prefers-color-scheme: dark)" srcset="https://pnpm.io/img/users/stackblitz_light.svg" /> <img src="https://pnpm.io/img/users/stackblitz.svg" width="190" alt="Stackblitz" /> </picture> </a> </td> <td align="center" valign="middle"> <a href="https://workleap.com/?utm_source=pnpm&utm_medium=release_notes" target="_blank" rel="noopener noreferrer"> <picture> <source media="(prefers-color-scheme: light)" srcset="https://pnpm.io/img/users/workleap.svg" /> <source media="(prefers-color-scheme: dark)" srcset="https://pnpm.io/img/users/workleap_light.svg" /> <img src="https://pnpm.io/img/users/workleap.svg" width="190" alt="Workleap" /> </picture> </a> </td> </tr> <tr> <td align="center" valign="middle"> <a href="https://nx.dev/?utm_source=pnpm&utm_medium=release_notes" target="_blank" rel="noopener noreferrer"> <picture> <source media="(prefers-color-scheme: light)" srcset="https://pnpm.io/img/users/nx.svg" /> <source media="(prefers-color-scheme: dark)" srcset="https://pnpm.io/img/users/nx_light.svg" /> <img src="https://pnpm.io/img/users/nx.svg" width="50" alt="Nx" /> </picture> </a> </td> <td align="center" valign="middle"> <a href="https://latitude.so/?utm_source=pnpm&utm_medium=release_notes" target="_blank" rel="noopener noreferrer"><img src="https://pnpm.io/img/users/latitude.svg" width="160" alt="Latitude"></a> </td> </tr> </tbody> </table> <!-- sponsors end --> ### [`v12.11.1`](https://redirect.github.com/pnpm/pnpm/releases/tag/v12.11.1): pnpm 12.11.1 [Compare Source](https://redirect.github.com/pnpm/pnpm/compare/v12.11.0...v12.11.1) This release fixes two ways `pnpm install` could fail, runs tools of any Rust release through `pnx`, and treats `registry.npmjs.com` as an alias of the npm registry. ##### Patch Changes - `pnpm install` no longer fails when `packageManager` pins the pnpm version that is already running and the registry does not publish that version. pnpm warns and continues. A registry mirror that has not synced a release no longer blocks the commands of a project pinned to it. - `pnpm install` no longer fails with `ERR_PNPM_CMD_SHIM_CHMOD` when `node_modules/.bin` holds a shim that another user created, if everyone can already execute it and it is not world-writable. This happens when several users share one checkout. - `enable-modules-dir=false` (`enableModulesDir: false` through the Node.js addon) fetches the registry packages the host can install into the store again, as pnpm v10 did, while still writing nothing under `node_modules`. The setting exists for a `node_modules` that something else mounts from the store, such as a FUSE daemon, and that consumer no longer has to download each package on first access. A plain `--lockfile-only` run still fetches nothing. - `pnpm pack` and `pnpm publish` no longer put `.npmignore` and `.gitignore` files in the tarball. A `files` entry that names one still ships it. - pnpm now treats `https://registry.npmjs.com/` as an alias of `https://registry.npmjs.org/`. Registry requests, credentials, and trusted publishing use the canonical hostname. - `pnx --package=rust@<channel> <tool>` runs a tool of that Rust release, for example `pnx --package=rust@nightly-2026-01-01 cargo build`. pnpm installs the release with the components and targets from `rust-toolchain.toml` and the target of each `--target` argument. - `pnpm install` now links agent skills for more coding agents. It detects the agent from `ANTIGRAVITY_AGENT`, `COPILOT_AGENT`, `COPILOT_CLI`, `CODEX_THREAD_ID`, `CODEX_SANDBOX`, `AI_AGENT`, and `CLAUDE_CODE` [pnpm/tasks#116](https://redirect.github.com/pnpm/tasks/issues/116). - When the registry rejects `pnpm stage publish`, the error message now starts with "Failed to stage package". <!-- sponsors --> #### Platinum Sponsors <table> <tbody> <tr> <td align="center" valign="middle"> <a href="https://bit.cloud/?utm_source=pnpm&utm_medium=release_notes" target="_blank" rel="noopener noreferrer"><img src="https://pnpm.io/img/users/bit.svg" width="80" alt="Bit"></a> </td> <td align="center" valign="middle"> <a href="https://openai.com/?utm_source=pnpm&utm_medium=release_notes" target="_blank" rel="noopener noreferrer"> <picture> <source media="(prefers-color-scheme: light)" srcset="https://pnpm.io/img/users/openai_dark.svg" /> <source media="(prefers-color-scheme: dark)" srcset="https://pnpm.io/img/users/openai_light.svg" /> <img src="https://pnpm.io/img/users/openai_dark.svg" width="160" alt="OpenAI" /> </picture> </a> </td> <td align="center" valign="middle"> <a href="https://notion.com/?utm_source=pnpm&utm_medium=release_notes" target="_blank" rel="noopener noreferrer"><img src="https://pnpm.io/img/users/notion.svg" width="80" alt="Notion"></a> </td> </tr> <tr> <td align="center" valign="middle"> <a href="https://coderabbit.ai/?utm_source=pnpm&utm_medium=release_notes" target="_blank" rel="noopener noreferrer"> <picture> <source media="(prefers-color-scheme: light)" srcset="https://pnpm.io/img/users/coderabbit.svg" /> <source media="(prefers-color-scheme: dark)" srcset="https://pnpm.io/img/users/coderabbit_light.svg" /> <img src="https://pnpm.io/img/users/coderabbit.svg" width="220" alt="CodeRabbit" /> </picture> </a> </td> </tr> </tbody> </table> #### Gold Sponsors <table> <tbody> <tr> <td align="center" valign="middle"> <a href="https://sanity.io/?utm_source=pnpm&utm_medium=release_notes" target="_blank" rel="noopener noreferrer"> <picture> <source media="(prefers-color-scheme: light)" srcset="https://pnpm.io/img/users/sanity.svg" /> <source media="(prefers-color-scheme: dark)" srcset="https://pnpm.io/img/users/sanity_light.svg" /> <img src="https://pnpm.io/img/users/sanity.svg" width="120" alt="Sanity" /> </picture> </a> </td> <td align="center" valign="middle"> <a href="https://discord.com/?utm_source=pnpm&utm_medium=release_notes" target="_blank" rel="noopener noreferrer"> <picture> <source media="(prefers-color-scheme: light)" srcset="https://pnpm.io/img/users/discord.svg" /> <source media="(prefers-color-scheme: dark)" srcset="https://pnpm.io/img/users/discord_light.svg" /> <img src="https://pnpm.io/img/users/discord.svg" width="220" alt="Discord" /> </picture> </a> </td> <td align="center" valign="middle"> <a href="https://vite.dev/?utm_source=pnpm&utm_medium=release_notes" target="_blank" rel="noopener noreferrer"><img src="https://pnpm.io/img/users/vitejs.svg" width="42" alt="Vite"></a> </td> </tr> <tr> <td align="center" valign="middle"> <a href="https://serpapi.com/?utm_source=pnpm&utm_medium=release_notes" target="_blank" rel="noopener noreferrer"> <picture> <source media="(prefers-color-scheme: light)" srcset="https://pnpm.io/img/users/serpapi_dark.svg" /> <source media="(prefers-color-scheme: dark)" srcset="https://pnpm.io/img/users/serpapi_light.svg" /> <img src="https://pnpm.io/img/users/serpapi_dark.svg" width="160" alt="SerpApi" /> </picture> </a> </td> <td align="center" valign="middle"> <a href="https://stackblitz.com/?utm_source=pnpm&utm_medium=release_notes" target="_blank" rel="noopener noreferrer"> <picture> <source media="(prefers-color-scheme: light)" srcset="https://pnpm.io/img/users/stackblitz.svg" /> <source media="(prefers-color-scheme: dark)" srcset="https://pnpm.io/img/users/stackblitz_light.svg" /> <img src="https://pnpm.io/img/users/stackblitz.svg" width="190" alt="Stackblitz" /> </picture> </a> </td> <td align="center" valign="middle"> <a href="https://workleap.com/?utm_source=pnpm&utm_medium=release_notes" target="_blank" rel="noopener noreferrer"> <picture> <source media="(prefers-color-scheme: light)" srcset="https://pnpm.io/img/users/workleap.svg" /> <source media="(prefers-color-scheme: dark)" srcset="https://pnpm.io/img/users/workleap_light.svg" /> <img src="https://pnpm.io/img/users/workleap.svg" width="190" alt="Workleap" /> </picture> </a> </td> </tr> <tr> <td align="center" valign="middle"> <a href="https://nx.dev/?utm_source=pnpm&utm_medium=release_notes" target="_blank" rel="noopener noreferrer"> <picture> <source media="(prefers-color-scheme: light)" srcset="https://pnpm.io/img/users/nx.svg" /> <source media="(prefers-color-scheme: dark)" srcset="https://pnpm.io/img/users/nx_light.svg" /> <img src="https://pnpm.io/img/users/nx.svg" width="50" alt="Nx" /> </picture> </a> </td> <td align="center" valign="middle"> <a href="https://latitude.so/?utm_source=pnpm&utm_medium=release_notes" target="_blank" rel="noopener noreferrer"><img src="https://pnpm.io/img/users/latitude.svg" width="160" alt="Latitude"></a> </td> </tr> </tbody> </table> <!-- sponsors end --> ### [`v12.11.0`](https://redirect.github.com/pnpm/pnpm/releases/tag/v12.11.0): pnpm 12.11.0 [Compare Source](https://redirect.github.com/pnpm/pnpm/compare/v12.10.1...v12.11.0) This release adds Rust toolchain management, links the agent skills that dependencies ship, adds the `permissions` setting, and keeps the colors of streamed script output. ##### Minor Changes - `pnpm install` now links the agent skills that direct dependencies ship under `skills/<name>/SKILL.md` into the project's agent skill directories, such as `.claude/skills`. A package's skills are linked only after you approve them with `pnpm approve`. The `skills.dirs` setting chooses the directories [pnpm/rfcs#35](https://redirect.github.com/pnpm/rfcs/pull/35). Added the `permissions` setting, which records what each dependency may do. Its `build` capability works like `allowBuilds` and takes precedence over it. `pnpm approve-builds` writes to `permissions` when `pnpm-workspace.yaml` already has it, and to `allowBuilds` otherwise. Added `pnpm permissions`, which lists the granted and denied permissions and the packages awaiting approval. `pnpm approve` reviews build scripts and agent skills in one prompt [pnpm/rfcs#36](https://redirect.github.com/pnpm/rfcs/pull/36). - pnpm now installs and runs Rust toolchains. - With `cargo.enabled`, `pnpm install` installs the toolchain named in `rust-toolchain.toml`. pnpm verifies the release signature, stores the toolchain once per machine, and links it into `.pnpm/rust`. `pnpm run` and `pnpm exec` put its `cargo` and `rustc` on the `PATH`. - `pnpm add -g rust@<channel>` installs a toolchain globally. The `cargo` and `rustc` commands run it outside projects that pin their own. `pnpm update -g`, `pnpm ls -g`, and `pnpm remove -g` manage it like any global package. - In a project, `pnpm add rust@<channel>` pins the toolchain in `rust-toolchain.toml`. - `pnpm shim add rust` adds project-aware shims for `cargo`, `rustc`, and the other Rust tools. In a project with a `rust-toolchain.toml`, they run the toolchain the file names and install it on first use. Elsewhere, the next command of the same name on `PATH` runs, such as rustup's. - `pnpm run` and `pnpm exec` now keep the colors of script output that they print under the project's name, such as with `--stream`. pnpm sets `FORCE_COLOR=1` for these scripts when its own output is in color, unless `FORCE_COLOR` is already set. Script output is also rendered more cleanly: - A line that a progress bar redraws with `\r` shows only its last state. - Escape codes that move the cursor or clear the screen are dropped. - Long colored lines are cut at the terminal width. - `pnpm -r run` no longer garbles its live output when a script fails while other scripts are still running. ##### Patch Changes ##### Installing packages - pnpm no longer panics with "unexpected error when polling the I/O driver" when it runs under QEMU user-mode emulation, such as a `linux/amd64` container on an Apple Silicon Mac [#16696](https://redirect.github.com/pnpm/pnpm/issues/16696). - `pnpm view`, `pnpm update`, and other commands that read registry metadata now work behind proxies that end a response by closing the connection without a TLS `close_notify` alert [#16704](https://redirect.github.com/pnpm/pnpm/issues/16704). - pnpm now switches to the version a project pins in `packageManager` or `devEngines.packageManager` even when `pnpm-workspace.yaml` has a setting the running pnpm cannot read, such as a `lockfile.includeResolutionSettings` section. If pnpm does not switch, it still reports that setting [#16675](https://redirect.github.com/pnpm/pnpm/issues/16675). - When the `pnpm` package has to download its native binary on first run, it now uses the registry and credentials from `.npmrc` and from the `npm_config_registry` and `pnpm_config_registry` environment variables. `COREPACK_NPM_REGISTRY` still takes precedence. A project `.npmrc` is not read when `COREPACK_INTEGRITY_KEYS` turns off the signature check [#16655](https://redirect.github.com/pnpm/pnpm/issues/16655). - `pnpm install` and `pnpm add --config` now apply `minimumReleaseAge` when they resolve a config dependency. A config dependency range resolves to the newest version that is old enough, so a later clean `pnpm install --frozen-lockfile` accepts the lockfile [#16660](https://redirect.github.com/pnpm/pnpm/issues/16660). - `pnpm remove` with `catalogPrune` no longer removes catalog entries that `pnpm-lock.yaml` still records for workspace projects missing from disk. Before, a following frozen install failed with `ERR_PNPM_LOCKFILE_CONFIG_MISMATCH` [#16679](https://redirect.github.com/pnpm/pnpm/issues/16679). - With `cargo.enabled`, `pnpm install` now writes the source replacement for vendored crates into `.pnpm/crates/config.toml` and includes it as optional from `.cargo/config.toml`. A checkout without `.pnpm` builds with plain Cargo [#16659](https://redirect.github.com/pnpm/pnpm/issues/16659). - With `nodeLinker.type` set to `loaded`, Node.js now stops with `ERR_PNPM_LOADER_UNSUPPORTED_NODE` when it preloads the store loader on a version the loader cannot serve. The supported versions are `^24.18.0 \|\| >=26.2.0`. On other versions, CommonJS packages imported from ESM failed with `Cannot find module` on their first relative `require()`. - On Windows, `pnpm install` no longer fails with "The filename, directory name, or volume label syntax is incorrect" when a package contains a file whose name is invalid on Windows, such as `icon.svg?as=metadata.d.ts`. pnpm removes the invalid characters from the name and prints a warning that lists the renamed files. - On Windows, hoisting no longer fails intermittently with link errors when a junction is created or replaced concurrently [pnpm/tasks#53](https://redirect.github.com/pnpm/tasks/issues/53). ##### Resolving dependencies - `pnpm install --no-optional` now installs the peer dependencies a project declares when `autoInstallPeers` is on. The lockfile marked such a peer `optional: true` when another dependency had it as an optional peer. - `pnpm install` and `pnpm dedupe` now link an optional peer to the workspace package that the workspace root depends on when the picked version matches it. They installed the registry package with the same name and version [#16706](https://redirect.github.com/pnpm/pnpm/issues/16706). - Removal overrides such as `"debug>supports-color": "-"` now also apply to an optional peer that a package declares only in `peerDependenciesMeta` [#16681](https://redirect.github.com/pnpm/pnpm/issues/16681). - `pnpm add` and other installs that re-resolve dependencies now keep the locked `devEngines.runtime` version while it still satisfies the declared range [#16764](https://redirect.github.com/pnpm/pnpm/issues/16764). - `pnpm audit --fix update` now updates only the dependencies whose locked version is vulnerable [#14928](https://redirect.github.com/pnpm/pnpm/issues/14928). - `pnpm outdated` and `pnpm update --interactive` now apply `overrides` before they look up the latest version. Before, a dependency overridden to an npm alias was compared with the latest version of the package the override replaces [#16719](https://redirect.github.com/pnpm/pnpm/issues/16719). ##### Patched dependencies - Patches saved with CRLF line endings now apply, including a patch that creates or deletes a file. pnpm rejected the git headers of such a patch with `ERR_PNPM_INVALID_PATCH` and the message `invalid file mode: 100644` [#16641](https://redirect.github.com/pnpm/pnpm/issues/16641). - A patch that changes a file's mode, such as adding or removing the executable bit, now applies the new mode on Unix [pnpm/tasks#110](https://redirect.github.com/pnpm/tasks/issues/110). ##### Injected dependencies and deploy - With `sharedWorkspaceLockfile: false`, an injected workspace package installed in the same run as its dependent now holds only the files its `files` field selects. The copy also held other files of the project, such as `tsconfig.json` [#16683](https://redirect.github.com/pnpm/pnpm/issues/16683). - A script listed in `syncInjectedDepsAfterScripts` no longer fails when it rewrites `package.json` while pnpm is copying its edits into the injected copies. The sync after the script now replaces a half-copied manifest. - `pnpm deploy` with a shared lockfile no longer fails with `ERR_PNPM_LOCKFILE_CONFIG_MISMATCH` for `settings.dedupeInjectedDeps` or `settings.dedupePeerDependents` when `lockfile.includeResolutionSettings` is enabled. The deployed lockfile now records both settings as `false`, the values the deploy installs with. - `pnpm deploy` now writes the dependencies in the deployed `package.json` sorted by name. It also sorts the `allowBuilds` entries in the deployed `pnpm-workspace.yaml`. Repeated deploys of the same lockfile now produce identical files [#16687](https://redirect.github.com/pnpm/pnpm/issues/16687). ##### Packing and publishing - `pnpm pack` and `pnpm publish` now match `.npmignore` and `.gitignore` rules the way npm does. A negation such as `!lib/` or `!lib//!(.map)` re-includes files under a directory that an earlier `` rule excluded [#16743](https://redirect.github.com/pnpm/pnpm/issues/16743). - `pnpm pack` and `pnpm publish` no longer always include root files that merely start with `README`, `LICENSE`, or `LICENCE`, such as `README_INTERNAL.md`. Only `README`, `LICENSE`, `LICENCE`, and `COPYING`, with or without an extension, ship regardless of `files` and `.npmignore`, as in npm [#16753](https://redirect.github.com/pnpm/pnpm/issues/16753). - `pnpm publish --provenance=false` and `--no-provenance` now turn off provenance under trusted publishing, so a package can be published from a self-hosted runner. Setting `provenance: false` in `pnpm-workspace.yaml` does the same [#16721](https://redirect.github.com/pnpm/pnpm/issues/16721). ##### Speed and resource use - `pnpm install` hardlinks files from a group-writable or world-writable store again. pnpm copied every file from such a store into `node_modules` [#16677](https://redirect.github.com/pnpm/pnpm/issues/16677). - A repeat `pnpm install` no longer imports patched packages and packages with build scripts again when nothing changed. Their builds no longer run again either. This happened when `recursiveInstall` was `false` or the project had a `file:` dependency [#16705](https://redirect.github.com/pnpm/pnpm/issues/16705). - Verifying the lockfile against `trustPolicy` and `minimumReleaseAge` uses less memory. pnpm no longer keeps every published version's manifest of each checked package in memory until the install ends [#16656](https://redirect.github.com/pnpm/pnpm/issues/16656). - `pnpm rebuild <pkg>` and `pnpm rebuild --pending` no longer read the manifest of every installed package to find build scripts. Only the selected packages are inspected and built. On a large `node_modules` served lazily, such as over a network or FUSE mount, this turned a rebuild of a few packages into a fetch of every package. - `pnpm rebuild` no longer removes and recreates `node_modules` when the settings recorded in `node_modules/.modules.yaml` differ from the current configuration. The rebuild runs the build scripts against the installed packages as they are. - `pnpm store prune` now compacts the store's `index.db` after removing package entries, so the file shrinks again [#16717](https://redirect.github.com/pnpm/pnpm/issues/16717). ##### Registry commands - `pnpm whoami`, `pnpm bugs`, `pnpm docs`, `pnpm repo`, `pnpm star`, `pnpm unstar`, and `pnpm stars` now honor the `--registry` option. - `--registry` now takes precedence over a scope's configured registry for scoped packages in `pnpm access`, `pnpm view`, `pnpm repo`, `pnpm star`, `pnpm unstar`, `pnpm owner`, `pnpm deprecate`, `pnpm undeprecate`, `pnpm unpublish`, `pnpm dist-tag`, `pnpm team`, and `pnpm stage`. Without `--registry`, `pnpm access` now sends a scoped package or scope to the registry configured for that scope. - Registry commands now keep the path of a registry URL such as `https://example.com/npm/` when they build request URLs. This applies to `pnpm access`, `pnpm owner`, `pnpm ping`, `pnpm search`, `pnpm star`, `pnpm stars`, `pnpm team`, `pnpm unstar`, and `pnpm whoami`. - `pnpm view` now honors the network retry settings. - `pnpm repo` now fetches the repository URLs of several packages in parallel. <!-- sponsors --> #### Platinum Sponsors <table> <tbody> <tr> <td align="center" valign="middle"> <a href="https://bit.cloud/?utm_source=pnpm&utm_medium=release_notes" target="_blank" rel="noopener noreferrer"><img src="https://pnpm.io/img/users/bit.svg" width="80" alt="Bit"></a> </td> <td align="center" valign="middle"> <a href="https://openai.com/?utm_source=pnpm&utm_medium=release_notes" target="_blank" rel="noopener noreferrer"> <picture> <source media="(prefers-color-scheme: light)" srcset="https://pnpm.io/img/users/openai_dark.svg" /> <source media="(prefers-color-scheme: dark)" srcset="https://pnpm.io/img/users/openai_light.svg" /> <img src="https://pnpm.io/img/users/openai_dark.svg" width="160" alt="OpenAI" /> </picture> </a> </td> <td align="center" valign="middle"> <a href="https://notion.com/?utm_source=pnpm&utm_medium=release_notes" target="_blank" rel="noopener noreferrer"><img src="https://pnpm.io/img/users/notion.svg" width="80" alt="Notion"></a> </td> </tr> <tr> <td align="center" valign="middle"> <a href="https://coderabbit.ai/?utm_source=pnpm&utm_medium=release_notes" target="_blank" rel="noopener noreferrer"> <picture> <source media="(prefers-color-scheme: light)" srcset="https://pnpm.io/img/users/coderabbit.svg" /> <source media="(prefers-color-scheme: dark)" srcset="https://pnpm.io/img/users/coderabbit_light.svg" /> <img src="https://pnpm.io/img/users/coderabbit.svg" width="220" alt="CodeRabbit" /> </picture> </a> </td> </tr> </tbody> </table> #### Gold Sponsors <table> <tbody> <tr> <td align="center" valign="middle"> <a href="https://sanity.io/?utm_source=pnpm&utm_medium=release_notes" target="_blank" rel="noopener noreferrer"> <picture> <source media="(prefers-color-scheme: light)" srcset="https://pnpm.io/img/users/sanity.svg" /> <source media="(prefers-color-scheme: dark)" srcset="https://pnpm.io/img/users/sanity_light.svg" /> <img src="https://pnpm.io/img/users/sanity.svg" width="120" alt="Sanity" /> </picture> </a> </td> <td align="center" valign="middle"> <a href="https://discord.com/?utm_source=pnpm&utm_medium=release_notes" target="_blank" rel="noopener noreferrer"> <picture> <source media="(prefers-color-scheme: light)" srcset="https://pnpm.io/img/users/discord.svg" /> <source media="(prefers-color-scheme: dark)" srcset="https://pnpm.io/img/users/discord_light.svg" /> <img src="https://pnpm.io/img/users/discord.svg" width="220" alt="Discord" /> </picture> </a> </td> <td align="center" valign="middle"> <a href="https://vite.dev/?utm_source=pnpm&utm_medium=release_notes" target="_blank" rel="noopener noreferrer"><img src="https://pnpm.io/img/users/vitejs.svg" width="42" alt="Vite"></a> </td> </tr> <tr> <td align="center" valign="middle"> <a href="https://serpapi.com/?utm_source=pnpm&utm_medium=release_notes" target="_blank" rel="noopener noreferrer"> <picture> <source media="(prefers-color-scheme: light)" srcset="https://pnpm.io/img/users/serpapi_dark.svg" /> <source media="(prefers-color-scheme: dark)" srcset="https://pnpm.io/img/users/serpapi_light.svg" /> <img src="https://pnpm.io/img/users/serpapi_dark.svg" width="160" alt="SerpApi" /> </picture> </a> </td> <td align="center" valign="middle"> <a href="https://stackblitz.com/?utm_source=pnpm&utm_medium=release_notes" target="_blank" rel="noopener noreferrer"> <picture> <source media="(prefers-color-scheme: light)" srcset="https://pnpm.io/img/users/stackblitz.svg" /> <source media="(prefers-color-scheme: dark)" srcset="https://pnpm.io/img/users/stackblitz_light.svg" /> <img src="https://pnpm.io/img/users/stackblitz.svg" width="190" alt="Stackblitz" /> </picture> </a> </td> <td align="center" valign="middle"> <a href="https://workleap.com/?utm_source=pnpm&utm_medium=release_notes" target="_blank" rel="noopener noreferrer"> <picture> <source media="(prefers-color-scheme: light)" srcset="https://pnpm.io/img/users/workleap.svg" /> <source media="(prefers-color-scheme: dark)" srcset="https://pnpm.io/img/users/workleap_light.svg" /> <img src="https://pnpm.io/img/users/workleap.svg" width="190" alt="Workleap" /> </picture> </a> </td> </tr> <tr> <td align="center" valign="middle"> <a href="https://nx.dev/?utm_source=pnpm&utm_medium=release_notes" target="_blank" rel="noopener noreferrer"> <picture> <source media="(prefers-color-scheme: light)" srcset="https://pnpm.io/img/users/nx.svg" /> <source media="(prefers-color-scheme: dark)" srcset="https://pnpm.io/img/users/nx_light.svg" /> <img src="https://pnpm.io/img/users/nx.svg" width="50" alt="Nx" /> </picture> </a> </td> <td align="center" valign="middle"> <a href="https://latitude.so/?utm_source=pnpm&utm_medium=release_notes" target="_blank" rel="noopener noreferrer"><img src="https://pnpm.io/img/users/latitude.svg" width="160" alt="Latitude"></a> </td> </tr> </tbody> </table> <!-- sponsors end --> ### [`v12.10.1`](https://redirect.github.com/pnpm/pnpm/releases/tag/v12.10.1): pnpm 12.10.1 [Compare Source](https://redirect.github.com/pnpm/pnpm/compare/v12.10.0...v12.10.1) This release fixes `pnpm install` failures after an `overrides` change and on a filtered frozen install with `catalogPrune`. It also fixes several bugs in the experimental `nodeLinker.type: loaded`, which now keeps its generated files in `node_modules`. ##### Patch Changes - With `nodeLinker.type: loaded`, pnpm now writes its generated files to `node_modules`, which projects already ignore in git. The store manifest and loader are `node_modules/.pnpm/.store-manifest.json` and `node_modules/.pnpm/.store-loader.mjs`. Bin shims are in `node_modules/.bin`. Earlier versions wrote `.pnpm-store.json` and `.pnpm-store-loader.mjs` to the project root, and a `.pnpm` directory to the root and to each workspace package. Delete them after reinstalling. - With `nodeLinker.type: loaded`, packages that ship their own `node_modules` directory, such as `npm` with its bundled dependencies, now load from the store. Before, one such package in the install stopped every Node.js process from starting. - With `nodeLinker.type: loaded`, scripts can now run a Node.js runtime installed through `devEngines.runtime`. Before, every script that called `node` re-ran its own shim until it failed with "Argument list too long". - With `nodeLinker.type: loaded`, Node.js processes start faster. In a project with 13,000 stored files, the startup overhead per process dropped from 67 ms to 18 ms. - `pnpm install` no longer fails with `ERR_PNPM_NO_MATCHING_VERSION` after a change to `overrides` when the lockfile resolves an optional peer dependency to an npm alias of another package [#16654](https://redirect.github.com/pnpm/pnpm/issues/16654). - A frozen install with `catalogPrune` no longer removes catalog entries that `pnpm-lock.yaml` still records. Before, `pnpm install --frozen-lockfile --filter` failed with `ERR_PNPM_LOCKFILE_CONFIG_MISMATCH` when some workspace projects were missing from disk [#16638](https://redirect.github.com/pnpm/pnpm/issues/16638). - `pnpm install --fix-lockfile` no longer removes the `deprecated` and `hasBin` fields from lockfile entries [#6600](https://redirect.github.com/pnpm/pnpm/issues/6600). - With `enableGlobalVirtualStore`, an install that updates `node_modules` now repairs a package in the global virtual store that an interrupted install left without some of its dependency links or package files. Before, such an install kept the incomplete package if the project's `node_modules` already recorded it [#16642](https://redirect.github.com/pnpm/pnpm/issues/16642). - `pnpm install` now skips the Cargo and Python projects inside a nested directory that has its own `pnpm-workspace.yaml` or `.git` directory, such as a git worktree of the same workspace or a separate clone. - The `Request took` warning for package metadata now starts timing when pnpm sends the request. Before, it also counted the time the request waited for a free request slot, so large installs printed it for requests the registry answered quickly. <!-- sponsors --> #### Platinum Sponsors <table> <tbody> <tr> <td align="center" valign="middle"> <a href="https://bit.cloud/?utm_source=pnpm&utm_medium=release_notes" target="_blank" rel="noopener noreferrer"><img src="https://pnpm.io/img/users/bit.svg" width="80" alt="Bit"></a> </td> <td align="center" valign="middle"> <a href="https://openai.com/?utm_source=pnpm&utm_medium=release_notes" target="_blank" rel="noopener noreferrer"> <picture> <source media="(prefers-color-scheme: light)" srcset="https://pnpm.io/img/users/openai_dark.svg" /> <source media="(prefers-color-scheme: dark)" srcset="https://pnpm.io/img/users/openai_light.svg" /> <img src="https://pnpm.io/img/users/openai_dark.svg" width="160" alt="OpenAI" /> </picture> </a> </td> <td align="center" valign="middle"> <a href="https://notion.com/?utm_source=pnpm&utm_medium=release_notes" target="_blank" rel="noopener noreferrer"><img src="https://pnpm.io/img/users/notion.svg" width="80" alt="Notion"></a> </td> </tr> <tr> <td align="center" valign="middle"> <a href="https://coderabbit.ai/?utm_source=pnpm&utm_medium=release_notes" target="_blank" rel="noopener noreferrer"> <picture> <source media="(prefers-color-scheme: light)" srcset="https://pnpm.io/img/users/coderabbit.svg" /> <source media="(prefers-color-scheme: dark)" srcset="https://pnpm.io/img/users/coderabbit_light.svg" /> <img src="https://pnpm.io/img/users/coderabbit.svg" width="220" alt="CodeRabbit" /> </picture> </a> </td> </tr> </tbody> </table> #### Gold Sponsors <table> <tbody> <tr> <td align="center" valign="middle"> <a href="https://sanity.io/?utm_source=pnpm&utm_medium=release_notes" target="_blank" rel="noopener noreferrer"> <picture> <source media="(prefers-color-scheme: light)" srcset="https://pnpm.io/img/users/sanity.svg" /> <source media="(prefers-color-scheme: dark)" srcset="https://pnpm.io/img/users/sanity_light.svg" /> <img src="https://pnpm.io/img/users/sanity.svg" width="120" alt="Sanity" /> </picture> </a> </td> <td align="center" valign="middle"> <a href="https://discord.com/?utm_source=pnpm&utm_medium=release_notes" target="_blank" rel="noopener noreferrer"> <picture> <source media="(prefers-color-scheme: light)" srcset="https://pnpm.io/img/users/discord.svg" /> <source media="(prefers-color-scheme: dark)" srcset="https://pnpm.io/img/users/discord_light.svg" /> <img src="https://pnpm.io/img/users/discord.svg" width="220" alt="Discord" /> </picture> </a> </td> <td align="center" valign="middle"> <a href="https://vite.dev/?utm_source=pnpm&utm_medium=release_notes" target="_blank" rel="noopener noreferrer"><img src="https://pnpm.io/img/users/vitejs.svg" width="42" alt="Vite"></a> </td> </tr> <tr> <td align="center" valign="middle"> <a href="https://serpapi.com/?utm_source=pnpm&utm_medium=release_notes" target="_blank" rel="noopener noreferrer"> <picture> <source media="(prefers-color-scheme: light)" srcset="https://pnpm.io/img/users/serpapi_dark.svg" /> <source media="(prefers-color-scheme: dark)" srcset="https://pnpm.io/img/users/serpapi_light.svg" /> <img src="https://pnpm.io/img/users/serpapi_dark.svg" width="160" alt="SerpApi" /> </picture> </a> </td> <td align="center" valign="middle"> <a href="https://stackblitz.com/?utm_source=pnpm&utm_medium=release_notes" target="_blank" rel="noopener noreferrer"> <picture> <source media="(prefers-color-scheme: light)" srcset="https://pnpm.io/img/users/stackblitz.svg" /> <source media="(prefers-color-scheme: dark)" srcset="https://pnpm.io/img/users/stackblitz_light.svg" /> <img src="https://pnpm.io/img/users/stackblitz.svg" width="190" alt="Stackblitz" /> </picture> </a> </td> <td align="center" valign="middle"> <a href="https://workleap.com/?utm_source=pnpm&utm_medium=release_notes" target="_blank" rel="noopener noreferrer"> <picture> <source media="(prefers-color-scheme: light)" srcset="https://pnpm.io/img/users/workleap.svg" /> <source media="(prefers-color-scheme: dark)" srcset="https://pnpm.io/img/users/workleap_light.svg" /> <img src="https://pnpm.io/img/users/workleap.svg" width="190" alt="Workleap" /> </picture> </a> </td> </tr> <tr> <td align="center" valign="middle"> <a href="https://nx.dev/?utm_source=pnpm&utm_medium=release_notes" target="_blank" rel="noopener noreferrer"> <picture> <source media="(prefers-color-scheme: light)" srcset="https://pnpm.io/img/users/nx.svg" /> <source media="(prefers-color-scheme: dark)" srcset="https://pnpm.io/img/users/nx_light.svg" /> <img src="https://pnpm.io/img/users/nx.svg" width="50" alt="Nx" /> </picture> </a> </td> <td align="center" valign="middle"> <a href="https://latitude.so/?utm_source=pnpm&utm_medium=release_notes" target="_blank" rel="noopener noreferrer"><img src="https://pnpm.io/img/users/latitude.svg" width="160" alt="Latitude"></a> </td> </tr> </tbody> </table> <!-- sponsors end --> ### [`v12.10.0`](https://redirect.github.com/pnpm/pnpm/releases/tag/v12.10.0): pnpm 12.10.0 [Compare Source](https://redirect.github.com/pnpm/pnpm/compare/v12.9.1...v12.10.0) This release adds an experimental `loaded` node linker, lets `pnpm-lock.yaml` record resolution settings, and reads cached registry metadata faster. It also carries several security fixes, including one that stops a dependency version from writing files outside the global virtual store. ##### Minor Changes - Added experimental `nodeLinker: { type: loaded }` installation. Compatible dependencies load directly from the content-addressable store through an automatically registered Node.js loader. `nodeLinker.excluded` selects packages and their dependency trees to install in the global virtual store. - `lockfile.includeResolutionSettings: true` makes `pnpm-lock.yaml` record `autoDedupe`, `dedupeInjectedDeps`, `dedupePeerDependents` and `linkWorkspacePackages`. Installs then treat a lockfile that records other values as outdated. A lockfile that records `autoDedupe` is reused by later installs on any machine, so `pnpm run` after `pnpm install --frozen-lockfile` no longer starts another install [#16583](https://redirect.github.com/pnpm/pnpm/issues/16583). ##### Patch Changes ##### Security - `pnpm install` now prevents dependency versions with path traversal from writing files outside the global virtual store. - pnpm now verifies locked config dependencies against their registry before installing them. Config dependencies must come from an npm registry. The lockfile can no longer replace the integrity of a config dependency pinned with `version+integrity`. - Lockfile verification now checks the tarballs inside a `variations` resolution against the registry. A `name@version` lockfile entry with an empty `variations` resolution is now rejected. - `pnpm audit signatures` now verifies signatures against the integrity recorded in the lockfile. Packages without a recorded integrity cannot pass signature verification. - `pnpm install` and `pnpm publish` now reject archive metadata larger than 64 MiB before reading it into memory. Publishing a pre-built tarball also rejects manifests and README files larger than 64 MiB. - Two URL or local path dependencies no longer share a virtual store directory when one URL has `+`, `#`, `:`, or `?` where the other has `/`. Such dependencies, including git dependencies pinned with `#`, now get a hash suffix on their directory name. - The warning about an ignored project `.npmrc` registry setting no longer prints the username and password of a URL-scoped key such as `//user:password@registry.example.com/${PATH}/:_authToken`. ##### Installing and resolving dependencies - `pnpm install` now fails with `ERR_PNPM_UNSUPPORTED_PROTOCOL` when a dependency uses a specifier with a protocol pnpm does not support, such as Yarn's `patch:`. On Windows, such a specifier failed with `os error 123`. On other platforms, pnpm linked it to a directory that does not exist. Reading a `package.json` that fails now names the file [#16590](https://redirect.github.com/pnpm/pnpm/issues/16590). - `pnpm install` now fails with `ERR_PNPM_PACKAGE_MANIFEST_INVALID_ATTRIBUTE` when a project declares a dependency whose specifier is not a string, such as `"is-positive": 42`. Before, the dependency was silently left out of the lockfile. A `readPackage` hook can still correct the specifier. - Fixed `pnpm install` failing with `ERR_PNPM_CMD_SHIM_RESOLVE_PATH` when an executable's parent directory contains a dangling symlink. - `pnpm install --frozen-lockfile` no longer fails with `ERR_PNPM_RESOLUTION_SHAPE_MISMATCH` when a `name@version` lockfile entry has a resolution served by a custom fetcher [pnpm/tasks#108](https://redirect.github.com/pnpm/tasks/issues/108). - `pnpm install --fix-lockfile` repairs a lockfile whose importer references a package that has no snapshot entry, as left by a badly merged lockfile. It failed with `ERR_PNPM_LOCKFILE_MISSING_DEPENDENCY` since 12.8.0 [#16618](https://redirect.github.com/pnpm/pnpm/issues/16618). - When a dependency moves an exact dependency of its own to an older version, a peer dependency that pnpm installed automatically now moves with it. Before, `pnpm install` and `pnpm dedupe` kept the newer locked version of the peer, so the lockfile held two copies of it, for example two copies of `vue` [pnpm/tasks#61](https://redirect.github.com/pnpm/tasks/issues/61). - `pnpm dedupe` now reads registry metadata for a dependency pinned to an exact version, as `pnpm install` does. If the registry metadata disagreed with the package's `package.json`, the lockfile it wrote depended on whether `minimumReleaseAge` was set [#16615](https://redirect.github.com/pnpm/pnpm/issues/16615). ##### Speed and size - Dependency resolution reads cached registry metadata faster. The metadata cache moved to `<cache-dir>/v12/`, so the first install after upgrading downloads registry metadata again. A damaged cache entry is downloaded again, or reported as an error when `--offline` is set. `pnpm cache prune` also removes the metadata cache that older pnpm versions wrote under `<cache-dir>/v11/` [#13512](https://redirect.github.com/pnpm/pnpm/pull/13512). - Package metadata requests no longer wait behind queued tarball downloads when `maxSockets` or a proxy limits the connections to a registry. Large installs resolve faster and print fewer `Request took` warnings. - Sped up installs in large workspaces on macOS when the dependency links already exist. pnpm now keeps a link that already points at the right package without trying to create it first. Relinking the direct dependencies of 1,000 workspace projects took 45 ms, down from 116 ms [pnpm/tasks#65](https://redirect.github.com/pnpm/tasks/issues/65). - Commands in a project that pins a different pnpm version start about 13 ms faster on macOS. pnpm now runs the pinned version's binary directly, without the shell script in front of it [pnpm/tasks#66](https://redirect.github.com/pnpm/tasks/issues/66). - The pnpm binary is about 0.9 MB smaller, and the arm64 Linux binary is about 1 MB smaller still. ##### Running scripts and commands - `pnpm run` no longer prints `[ELIFECYCLE] Command failed ...` after Ctrl+C ends the script. pnpm still exits the way the script's shell did: on Windows with the shell's exit code (`cmd` reports `-1073741510`, PowerShell `1`), on Unix by re-raising `SIGINT` [#16579](https://redirect.github.com/pnpm/pnpm/issues/16579). - `pnpm run "/<regex>/"` now accepts JavaScript regular expression syntax such as lookahead and lookbehind. A selector like `"/^hello:(?!b).$/"` failed with `ERR_PNPM_NO_SCRIPT` [#16604](https://redirect.github.com/pnpm/pnpm/issues/16604). - `pnpm run` and `pnpm exec` now forward `--config.` command-line flags to the install started by `verifyDepsBeforeRun` [pnpm/tasks#60](https://redirect.github.com/pnpm/tasks/issues/60). - On Windows, a process started by `pnpm run` or `pnpm exec` can again start a child with `CREATE_BREAKAWAY_FROM_JOB`. That child keeps running after pnpm exits, even if the command fails [#16628](https://redirect.github.com/pnpm/pnpm/issues/16628). - Empty `nodeOptions` values from command-line flags and environment variables now override lower-priority settings. Scripts retain `NODE_OPTIONS` from the parent environment or `extraEnv` when `nodeOptions` is empty. - pnpm now reads the `failIfNoMatch` setting from `pnpm-workspace.yaml`, so a filter that matches no workspace project exits with code 1 when the setting is `true`. The new `--no-fail-if-no-match` flag turns the setting off for one command [#16577](https://redirect.github.com/pnpm/pnpm/issues/16577). ##### Configuration, setup, and pnpm versions - `pnpm config get --global` and `pnpm config list --global` now show only the global configuration, also when run inside a project. Settings from the project's `pnpm-workspace.yaml` and `.npmrc` were included before. The same applies to `--location=global` [#16598](https://redirect.github.com/pnpm/pnpm/issues/16598). - pnpm now prints config warnings, such as an unset environment variable in `.npmrc`, when loading the config fails. - pnpm 11 releases older than 11.28.4 can run pnpm 12 again when the `packageManager` field pins it. Since 12.9.0 they failed with `SyntaxError: Invalid or unexpected token` [#16594](https://redirect.github.com/pnpm/pnpm/issues/16594). - On Windows, `pnpm self-update` no longer runs the update a second time when it replaces a `pnpm.cmd` linked by pnpm 12.8 or older. cmd.exe read on in the replaced `pnpm.cmd`, printed an error about a command that is not recognized, and ran the new pnpm once more [#16573](https://redirect.github.com/pnpm/pnpm/issues/16573). - `pnpm setup` now puts `$PNPM_HOME/bin` first on `PATH` in login shells that inherited it further down, such as the VS Code terminal on macOS. Before, another `node` took precedence over the one installed by `pnpm runtime set node -g`. Run `pnpm setup` again to update the block in your shell config [#16635](https://redirect.github.com/pnpm/pnpm/issues/16635). - `pnpm setup` now names the shell config file even if it is already up to date [#16608](https://redirect.github.com/pnpm/pnpm/issues/16608). ##### Updating, auditing, and publishing - `pnpm update --latest` now applies the `savePrefix` setting when it rewrites a dependency whose range has no operator of its own, such as `<2.0.0`. - The interactive `pnpm audit --fix` picker now shows each patched version with the `saveExact` and `savePrefix` style that the override is written with [#13209](https://redirect.github.com/pnpm/pnpm/issues/13209). - `pnpm unpublish <pkg>@<version>` now deletes the tarball under the registry's path when the registry is served under one, such as Gitea's npm registry. It used to send the delete to the host root and report success without removing the version [#16568](https://redirect.github.com/pnpm/pnpm/issues/16568). It also no longer mistakes a sibling path such as `/npm-mirror/` for the registry path `/npm/` [pnpm/tasks#94](https://redirect.github.com/pnpm/tasks/issues/94). ##### Output and messages - A warning about a project's `devEngines` or `packageManager` pin is now printed to stderr. A command such as `pnpm cache path` or `pnpm list --json` keeps only its own output on stdout [#16584](https://redirect.github.com/pnpm/pnpm/issues/16584). - `pnpm list` now reports the correct package paths when `nodeLinker` is `hoisted` [#9593](https://redirect.github.com/pnpm/pnpm/issues/9593). - Resolution errors now name the failing dependency and its parent packages. Fatal errors appear as structured error records with their error codes when using `--reporter=ndjson`. - The error for an invalid git repository in the lockfile now has the code `ERR_PNPM_INVALID_GIT_REPOSITORY`. Its message now lists every rejected form of the value. - `pnpm runtime --help` and `pnpm help runtime` now name the `set` subcommand and the runtimes it accepts [#16580](https://redirect.github.com/pnpm/pnpm/issues/16580). <!-- sponsors --> #### Platinum Sponsors <table> <tbody> <tr> <td align="center" valign="middle"> <a href="https://bit.cloud/?utm_source=pnpm&utm_medium=release_notes" target="_blank" rel="noopener noreferrer"><img src="https://pnpm.io/img/users/bit.svg" width="80" alt="Bit"></a> </td> <td align="center" valign="middle"> <a href="https://openai.com/?utm_source=pnpm&utm_medium=release_notes" target="_blank" rel="noopener noreferrer"> <picture> <source media="(prefers-color-scheme: light)" srcset="https://pnpm.io/img/users/openai_dark.svg" /> <source media="(prefers-color-scheme: dark)" srcset="https://pnpm.io/img/users/openai_light.svg" /> <img src="https://pnpm.io/img/users/openai_dark.svg" width="160" alt="OpenAI" /> </picture> </a> </td> <td align="center" valign="middle"> <a href="https://notion.com/?utm_source=pnpm&utm_medium=release_notes" target="_blank" rel="noopener noreferrer"><img src="https://pnpm.io/img/users/notion.svg" width="80" alt="Notion"></a> </td> </tr> <tr> <td align="center" valign="middle"> <a href="https://coderabbit.ai/?utm_source=pnpm&utm_medium=release_notes" target="_blank" rel="noopener noreferrer"> <picture> <source media="(prefers-color-scheme: light)" srcset="https://pnpm.io/img/users/coderabbit.svg" /> <source media="(prefers-color-scheme: dark)" srcset="https://pnpm.io/img/users/coderabbit_light.svg" /> <img src="https://pnpm.io/img/users/coderabbit.svg" width="220" alt="CodeRabbit" /> </picture> </a> </td> </tr> </tbody> </table> #### Gold Sponsors <table> <tbody> <tr> <td align="center" valign="middle"> <a href="https://sanity.io/?utm_source=pnpm&utm_medium=release_notes" target="_blank" rel="noopener noreferrer"> <picture> <source media="(prefers-color-scheme: light)" srcset="https://pnpm.io/img/users/sanity.svg" /> <source media="(prefers-color-scheme: dark)" srcset="https://pnpm.io/img/users/sanity_light.svg" /> <img src="https://pnpm.io/img/users/sanity.svg" width="120" alt="Sanity" /> </picture> </a> </td> <td align="center" valign="middle"> <a href="https://discord.com/?utm_source=pnpm&utm_medium=release_notes" target="_blank" rel="noopener noreferrer"> <picture> <source media="(prefers-color-scheme: light)" srcset="https://pnpm.io/img/users/discord.svg" /> <source media="(prefers-color-scheme: dark)" srcset="https://pnpm.io/img/users/discord_light.svg" /> <img src="https://pnpm.io/img/users/discord.svg" width="220" alt="Discord" /> </picture> </a> </td> <td align="center" valign="middle"> <a href="https://vite.dev/?utm_source=pnpm&utm_medium=release_notes" target="_blank" rel="noopener noreferrer"><img src="https://pnpm.io/img/users/vitejs.svg" width="42" alt="Vite"></a> </td> </tr> <tr> <td align="center" valign="middle"> <a href="https://serpapi.com/?utm_source=pnpm&utm_medium=release_notes" target="_blank" rel="noopener noreferrer"> <picture> <source media="(prefers-color-scheme: light)" srcset="https://pnpm.io/img/users/serpapi_dark.svg" /> <source media="(prefers-color-scheme: dark)" srcset="https://pnpm.io/img/users/serpapi_light.svg" /> <img src="https://pnpm.io/img/users/serpapi_dark.svg" width="160" alt="Serp > [!IMPORTANT] > ✂ PR body was truncated to here. </details> --- ### Configuration 📅 Schedule: (UTC) - Branch creation - At any time (no schedule defined) - Automerge - At any time (no schedule defined) 🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied. ♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox. 🔕 Ignore: Close this PR and you won't be reminded about this update again. --- - [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check this box --- This PR was generated by [Mend Renovate](https://mend.io/renovate/). View the [repository job log](https://developer.mend.io/github/authelia/authelia). <!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0NC4xNjQuMSIsInVwZGF0ZWRJblZlciI6IjQ0LjE2NC4xIiwidGFyZ2V0QnJhbmNoIjoibWFzdGVyIiwibGFiZWxzIjpbImRlcGVuZGVuY2llcyIsImphdmFzY3JpcHQiXX0=--> Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>	2026-10-16 10:03:44 +00:00
renovate[bot]	8751d2d83f	build(deps): update mccutchen/go-httpbin docker tag to v2.26.0 (#13481 ) This PR contains the following updates: \| Package \| Update \| Change \| \|---\|---\|---\| \| [mccutchen/go-httpbin](https://redirect.github.com/mccutchen/go-httpbin) \| minor \| `2.25.0` → `2.26.0` \| --- ### Release Notes <details> <summary>mccutchen/go-httpbin</summary> ### [`v2.26.0`](https://redirect.github.com/mccutchen/go-httpbin/releases/tag/v2.26.0) [Compare Source](https://redirect.github.com/mccutchen/go-httpbin/compare/v2.25.0...v2.26.0) #### 🔐 Security vulnerability 🔐 > \[!WARNING]\ > This release addresses an unbounded memory allocation denial of service vulnerability ([GHSA-m6j5-42w4-55c3](https://redirect.github.com/mccutchen/go-httpbin/security/advisories/GHSA-m6j5-42w4-55c3)) in the `/websocket/echo` endpoint: A single crafted websocket frame can crash any go-httpbin server, including programs that embed the httpbin package, by declaring a huge payload length that the server will attempt to allocate before checking it against the configured size limits. > > The attack needs no authentication and only one small request, and the resulting out-of-memory error kills the whole process rather than just the one connection. Versions v2.13.0 through v2.25.x are affected; upgrade to v2.26.0, which checks frame and message size limits before allocating. > > Many thanks to [@lucky07072026](https://redirect.github.com/lucky07072026) for the report, and many apologies from [@mccutchen](https://redirect.github.com/mccutchen) for this "network protocols 101"-level bug! #### What's Changed - feat: add /image/avif endpoint by [@ChrisJr404](https://redirect.github.com/ChrisJr404) in [#270](https://redirect.github.com/mccutchen/go-httpbin/pull/270) - middleware: allow QUERY method in CORS preflight by [@marr-cloud](https://redirect.github.com/marr-cloud) in [#275](https://redirect.github.com/mccutchen/go-httpbin/pull/275) - websocket: enforce frame size limit before allocating frame buffer by [@mccutchen](https://redirect.github.com/mccutchen) in [`4d62637`](https://redirect.github.com/mccutchen/go-httpbin/commit/4d62637fc356b4ae4a4035427b885374f412939a) - build: update minimium go version to 1.26 by [@mccutchen](https://redirect.github.com/mccutchen) in [#276](https://redirect.github.com/mccutchen/go-httpbin/pull/276) #### New Contributors - [@ChrisJr404](https://redirect.github.com/ChrisJr404) made their first contribution in [#270](https://redirect.github.com/mccutchen/go-httpbin/pull/270) - [@marr-cloud](https://redirect.github.com/marr-cloud) made their first contribution in [#275](https://redirect.github.com/mccutchen/go-httpbin/pull/275) - [@lucky07072026](https://redirect.github.com/lucky07072026) reported [GHSA-m6j5-42w4-55c3](https://redirect.github.com/mccutchen/go-httpbin/security/advisories/GHSA-m6j5-42w4-55c3) Full Changelog: <https://github.com/mccutchen/go-httpbin/compare/v2.25.0...v2.26.0> </details> --- ### Configuration 📅 Schedule: (UTC) - Branch creation - At any time (no schedule defined) - Automerge - At any time (no schedule defined) 🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied. ♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox. 🔕 Ignore: Close this PR and you won't be reminded about this update again. --- - [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check this box --- This PR was generated by [Mend Renovate](https://mend.io/renovate/). View the [repository job log](https://developer.mend.io/github/authelia/authelia). <!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0NC4xNjQuMSIsInVwZGF0ZWRJblZlciI6IjQ0LjE2NC4xIiwidGFyZ2V0QnJhbmNoIjoibWFzdGVyIiwibGFiZWxzIjpbImRlcGVuZGVuY2llcyIsImRvY2tlciJdfQ==--> Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>	2026-10-16 06:15:05 +00:00
renovate[bot]	e486caa19d	build(deps): update github/codeql-action action to v4.39.0 (#13480 ) This PR contains the following updates: \| Package \| Type \| Update \| Change \| \|---\|---\|---\|---\| \| [github/codeql-action](https://redirect.github.com/github/codeql-action) \| action \| minor \| `v4.38.3` → `v4.39.0` \| --- ### Release Notes <details> <summary>github/codeql-action</summary> ### [`v4.39.0`](https://redirect.github.com/github/codeql-action/releases/tag/v4.39.0) [Compare Source](https://redirect.github.com/github/codeql-action/compare/v4.38.3...v4.39.0) - Breaking change: Bump the minimum required CodeQL bundle version to 2.20.7. [#4205](https://redirect.github.com/github/codeql-action/pull/4205) - The `codeql-action/analyze` step now validates that a correct argument for the `checkout_path` input has been provided. The `checkout_path` input must be set to the path where the repository that is being analyzed is checked out at on the runner, if that path is something other than the workspace root. If the path does not point to a repository checkout or is different from the path that was used by `codeql-action/init`, then the CodeQL Action now produces a warning. [#4148](https://redirect.github.com/github/codeql-action/pull/4148) - Resolved an issue with third-party caching implementations that prevented caches from being restored correctly. [#4206](https://redirect.github.com/github/codeql-action/pull/4206) - The `codeql-action/start-proxy` step that is used in Code Scanning Default Setup now finds CodeQL releases using the same logic as `codeql-action/init`. This primarily benefits customers who are using GitHub instances other than `github.com` where the `codeql-action/start-proxy` step may previously have been unable to locate recent releases and ended up using outdated versions of the private registry authentication proxy as a result. [#4198](https://redirect.github.com/github/codeql-action/pull/4198) </details> --- ### Configuration 📅 Schedule: (UTC) - Branch creation - At any time (no schedule defined) - Automerge - At any time (no schedule defined) 🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied. ♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox. 🔕 Ignore: Close this PR and you won't be reminded about this update again. --- - [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check this box --- This PR was generated by [Mend Renovate](https://mend.io/renovate/). View the [repository job log](https://developer.mend.io/github/authelia/authelia). <!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0NC4xNjQuMSIsInVwZGF0ZWRJblZlciI6IjQ0LjE2NC4xIiwidGFyZ2V0QnJhbmNoIjoibWFzdGVyIiwibGFiZWxzIjpbImRlcGVuZGVuY2llcyIsImdpdGh1Yl9hY3Rpb25zIl19--> Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>	2026-10-16 06:08:07 +00:00
renovate[bot]	0c70436841	build(deps): update dependency @eslint-react/eslint-plugin to v5.27.1 (#13478 ) This PR contains the following updates: \| Package \| Change \| [Age](https://docs.renovatebot.com/merge-confidence/) \| [Confidence](https://docs.renovatebot.com/merge-confidence/) \| \|---\|---\|---\|---\| \| [@eslint-react/eslint-plugin](https://redirect.github.com/Rel1cx/eslint-react) ([source](https://redirect.github.com/Rel1cx/eslint-react/tree/HEAD/plugins/eslint-plugin)) \| [`5.26.8` → `5.27.1`](https://renovatebot.com/diffs/npm/@eslint-react%2feslint-plugin/5.26.8/5.27.1) \| ![age](https://developer.mend.io/api/mc/badges/age/npm/@eslint-react%2feslint-plugin/5.27.1?slim=true) \| ![confidence](https://developer.mend.io/api/mc/badges/confidence/npm/@eslint-react%2feslint-plugin/5.26.8/5.27.1?slim=true) \| --- ### Release Notes <details> <summary>Rel1cx/eslint-react (@eslint-react/eslint-plugin)</summary> ### [`v5.27.1`](https://redirect.github.com/Rel1cx/eslint-react/blob/HEAD/CHANGELOG.md#v5271-2026-10-15) [Compare Source](https://redirect.github.com/Rel1cx/eslint-react/compare/v5.27.0...v5.27.1) ##### 🐞 Fixes - Lifecycle methods defined as class properties (ex: `componentDidMount = () => { this.setState(...) }`, including type-expression-wrapped values) are now reported just like the method shorthand form. ([#2039](https://redirect.github.com/Rel1cx/eslint-react/issues/2039)) Affected rules: - `react-x/no-set-state-in-component-did-mount` - `react-x/no-set-state-in-component-did-update` - `react-x/no-set-state-in-component-will-update` - Effect cleanups are now recognized when the `useEffect` call is nested in an outer `return` (ex: `return useEffect(() => () => { ... })`), so resources released there are no longer reported as leaked. ([#2039](https://redirect.github.com/Rel1cx/eslint-react/issues/2039)) Affected rules: - `react-web-api/no-leaked-event-listener` - `react-web-api/no-leaked-fetch` - `react-web-api/no-leaked-intersection-observer` - `react-web-api/no-leaked-interval` - `react-web-api/no-leaked-resize-observer` - `react-web-api/no-leaked-timeout` ##### 🏗️ Internal - `@eslint-react/ast`: added the `Check.isFunctionOrClass` and `Check.isTypeOrChainExpression` helpers; parent lookups across `ast`, `core`, and the rules are now bounded at enclosing function/class boundaries. ([#2039](https://redirect.github.com/Rel1cx/eslint-react/issues/2039)) - `@eslint-react/core`: `isUseEffectSetupCallback` and `isUseEffectCleanupCallback` reimplemented on bounded parent lookups. ([#2039](https://redirect.github.com/Rel1cx/eslint-react/issues/2039)) Full Changelog: <https://github.com/Rel1cx/eslint-react/compare/v5.27.0...v5.27.1> ### [`v5.27.0`](https://redirect.github.com/Rel1cx/eslint-react/blob/HEAD/CHANGELOG.md#v5270-2026-10-15) ##### 🐞 Fixes - `react-web-api/no-leaked-event-listener`: cleanups returned through conditional expressions (ex: `return cond ? () => window.removeEventListener(...) : null`) are now recognized and no longer reported. ([#2038](https://redirect.github.com/Rel1cx/eslint-react/issues/2038)) - `react-web-api/no-leaked-fetch`: effect setups wrapped in type expressions (ex: `useEffect((() => { fetch(...) }) as any, [])`) are now recognized. ([#2038](https://redirect.github.com/Rel1cx/eslint-react/issues/2038)) - `react-debug/function-component`: computed string-literal `displayName` keys (ex: `App["displayName"] = "..."`) are now recognized. ([#2038](https://redirect.github.com/Rel1cx/eslint-react/issues/2038)) ##### 📝 Documentation - Revised the rule implementation pattern guides and refined the core ideas and layer dependency model in the fact-based rule implementation docs. ([#2034](https://redirect.github.com/Rel1cx/eslint-react/issues/2034), [#2035](https://redirect.github.com/Rel1cx/eslint-react/issues/2035)) ##### 🏗️ Internal - `@eslint-react/core`: accuracy and consistency fixes in detection helpers. ([#2038](https://redirect.github.com/Rel1cx/eslint-react/issues/2038)) - `react-x`: the custom `tsl` config now enforces the fact-based layer dependency order. ([#2036](https://redirect.github.com/Rel1cx/eslint-react/issues/2036)) - Bumped `react` and `react-dom` to `19.3.1`, and `next` to `16.4.1`. Full Changelog: <https://github.com/Rel1cx/eslint-react/compare/v5.26.7...v5.27.0> </details> --- ### Configuration 📅 Schedule: (UTC) - Branch creation - At any time (no schedule defined) - Automerge - At any time (no schedule defined) 🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied. ♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox. 🔕 Ignore: Close this PR and you won't be reminded about this update again. --- - [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check this box --- This PR was generated by [Mend Renovate](https://mend.io/renovate/). View the [repository job log](https://developer.mend.io/github/authelia/authelia). <!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0NC4xNjQuMSIsInVwZGF0ZWRJblZlciI6IjQ0LjE2NC4xIiwidGFyZ2V0QnJhbmNoIjoibWFzdGVyIiwibGFiZWxzIjpbImRlcGVuZGVuY2llcyIsImphdmFzY3JpcHQiXX0=--> Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>	2026-10-16 06:05:41 +00:00
renovate[bot]	5652c190e5	build(deps): update traefik docker tag to v3.7.15 (#13477 ) This PR contains the following updates: \| Package \| Update \| Change \| \|---\|---\|---\| \| [traefik](https://hub.docker.com/_/traefik) ([source](https://redirect.github.com/traefik/traefik)) \| patch \| `v3.7.14` → `v3.7.15` \| --- ### Release Notes <details> <summary>traefik/traefik (traefik)</summary> ### [`v3.7.15`](https://redirect.github.com/traefik/traefik/blob/HEAD/CHANGELOG.md#v3715-2026-10-15) [Compare Source](https://redirect.github.com/traefik/traefik/compare/v3.7.14...v3.7.15) [All Commits](https://redirect.github.com/traefik/traefik/compare/v3.7.14...v3.7.15) Bug fixes: - \[server] Reject CONNECT requests regardless of HTTP version ([#14031](https://redirect.github.com/traefik/traefik/pull/14031) [@juliens](https://redirect.github.com/juliens)) - \[server] Reject CONNECT method before reaching the muxer ([#14050](https://redirect.github.com/traefik/traefik/pull/14050) [@juliens](https://redirect.github.com/juliens)) - \[k8s/crd] Allow observability metadata on child routers ([#14018](https://redirect.github.com/traefik/traefik/pull/14018) [@bunnysayzz](https://redirect.github.com/bunnysayzz)) - \[k8s/gatewayapi] Bump sigs.k8s.io/gateway-api to v1.6.3 ([#14017](https://redirect.github.com/traefik/traefik/pull/14017) [@rtribotte](https://redirect.github.com/rtribotte)) - \[k8s/gatewayapi] Default HTTPRoute backend scheme to HTTP when no appProtocol ([#13935](https://redirect.github.com/traefik/traefik/pull/13935) [@Tyagiquamar](https://redirect.github.com/Tyagiquamar)) - \[k8s/ingress-nginx] Apply auth-tls client authentication to the whole host ([#14057](https://redirect.github.com/traefik/traefik/pull/14057) [@juliens](https://redirect.github.com/juliens)) - \[k8s/ingress-nginx] Fix cross-namespace check on shared auth-tls-secret TLS options ([#14066](https://redirect.github.com/traefik/traefik/pull/14066) [@juliens](https://redirect.github.com/juliens)) - \[fastproxy] Add a non-regression test for CR/LF in FastProxy request headers ([#13642](https://redirect.github.com/traefik/traefik/pull/13642) [@mturac](https://redirect.github.com/mturac)) - \[fastproxy] Fix concurrent buffer reads on upgraded connections ([#14023](https://redirect.github.com/traefik/traefik/pull/14023) [@juliens](https://redirect.github.com/juliens)) - Bump golang.org/x/net to v0.60.0 ([#14048](https://redirect.github.com/traefik/traefik/pull/14048) [@kevinpollet](https://redirect.github.com/kevinpollet)) Documentation: - \[security] Fix typo in the Request Path page ([#14036](https://redirect.github.com/traefik/traefik/pull/14036) [@SethFalco](https://redirect.github.com/SethFalco)) - \[k8s/crd] Fix broken Kubernetes CRD definitions links in CRD reference pages ([#14047](https://redirect.github.com/traefik/traefik/pull/14047) [@SatvikMishra08](https://redirect.github.com/SatvikMishra08)) - \[k8s] Document the safeNaming impact on cross-provider references ([#13768](https://redirect.github.com/traefik/traefik/pull/13768) [@lazerg](https://redirect.github.com/lazerg)) - \[k8s/gatewayapi] Fix broken links in the Gateway API routing page ([#14072](https://redirect.github.com/traefik/traefik/pull/14072) [@Neffi42](https://redirect.github.com/Neffi42)) - Fix broken anchor links to Restrict the Scope of Service Discovery ([#14056](https://redirect.github.com/traefik/traefik/pull/14056) [@SatvikMishra08](https://redirect.github.com/SatvikMishra08)) - Add the documentation style guide to the Contributing section ([#14061](https://redirect.github.com/traefik/traefik/pull/14061) [@rachana5](https://redirect.github.com/rachana5)) - Remove redundant period in README ([#14068](https://redirect.github.com/traefik/traefik/pull/14068) [@mxmrnn](https://redirect.github.com/mxmrnn)) </details> --- ### Configuration 📅 Schedule: (UTC) - Branch creation - At any time (no schedule defined) - Automerge - At any time (no schedule defined) 🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied. ♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox. 🔕 Ignore: Close this PR and you won't be reminded about this update again. --- - [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check this box --- This PR was generated by [Mend Renovate](https://mend.io/renovate/). View the [repository job log](https://developer.mend.io/github/authelia/authelia). <!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0NC4xNjQuMSIsInVwZGF0ZWRJblZlciI6IjQ0LjE2NC4xIiwidGFyZ2V0QnJhbmNoIjoibWFzdGVyIiwibGFiZWxzIjpbImRlcGVuZGVuY2llcyIsImRvY2tlciJdfQ==--> Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>	2026-10-16 01:22:08 +00:00
renovate[bot]	2ca4302529	build(deps): update traefik docker tag to v2.11.59 (#13476 ) This PR contains the following updates: \| Package \| Update \| Change \| \|---\|---\|---\| \| [traefik](https://hub.docker.com/_/traefik) ([source](https://redirect.github.com/traefik/traefik)) \| patch \| `v2.11.58` → `v2.11.59` \| --- ### Release Notes <details> <summary>traefik/traefik (traefik)</summary> ### [`v2.11.59`](https://redirect.github.com/traefik/traefik/blob/HEAD/CHANGELOG.md#v21159-2026-10-15) [Compare Source](https://redirect.github.com/traefik/traefik/compare/v2.11.58...v2.11.59) [All Commits](https://redirect.github.com/traefik/traefik/compare/v2.11.58...v2.11.59) Bug fixes: - \[server] Reject CONNECT requests regardless of HTTP version ([#14031](https://redirect.github.com/traefik/traefik/pull/14031) [@juliens](https://redirect.github.com/juliens)) - \[server] Reject CONNECT method before reaching the muxer ([#14050](https://redirect.github.com/traefik/traefik/pull/14050) [@juliens](https://redirect.github.com/juliens)) - Bump golang.org/x/net to v0.60.0 ([#14048](https://redirect.github.com/traefik/traefik/pull/14048) [@kevinpollet](https://redirect.github.com/kevinpollet)) </details> --- ### Configuration 📅 Schedule: (UTC) - Branch creation - At any time (no schedule defined) - Automerge - At any time (no schedule defined) 🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied. ♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox. 🔕 Ignore: Close this PR and you won't be reminded about this update again. --- - [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check this box --- This PR was generated by [Mend Renovate](https://mend.io/renovate/). View the [repository job log](https://developer.mend.io/github/authelia/authelia). <!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0NC4xNjQuMSIsInVwZGF0ZWRJblZlciI6IjQ0LjE2NC4xIiwidGFyZ2V0QnJhbmNoIjoibWFzdGVyIiwibGFiZWxzIjpbImRlcGVuZGVuY2llcyIsImRvY2tlciJdfQ==--> Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>	2026-10-16 01:10:27 +00:00
renovate[bot]	e872482949	build(deps): update dependency @eslint-react/eslint-plugin to v5.26.8 (#13474 ) This PR contains the following updates: \| Package \| Change \| [Age](https://docs.renovatebot.com/merge-confidence/) \| [Confidence](https://docs.renovatebot.com/merge-confidence/) \| \|---\|---\|---\|---\| \| [@eslint-react/eslint-plugin](https://redirect.github.com/Rel1cx/eslint-react) ([source](https://redirect.github.com/Rel1cx/eslint-react/tree/HEAD/plugins/eslint-plugin)) \| [`5.26.7` → `5.26.8`](https://renovatebot.com/diffs/npm/@eslint-react%2feslint-plugin/5.26.7/5.26.8) \| ![age](https://developer.mend.io/api/mc/badges/age/npm/@eslint-react%2feslint-plugin/5.26.8?slim=true) \| ![confidence](https://developer.mend.io/api/mc/badges/confidence/npm/@eslint-react%2feslint-plugin/5.26.7/5.26.8?slim=true) \| --- ### Configuration 📅 Schedule: (UTC) - Branch creation - At any time (no schedule defined) - Automerge - At any time (no schedule defined) 🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied. ♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox. 🔕 Ignore: Close this PR and you won't be reminded about this update again. --- - [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check this box --- This PR was generated by [Mend Renovate](https://mend.io/renovate/). View the [repository job log](https://developer.mend.io/github/authelia/authelia). <!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0NC4xNjQuMSIsInVwZGF0ZWRJblZlciI6IjQ0LjE2NC4xIiwidGFyZ2V0QnJhbmNoIjoibWFzdGVyIiwibGFiZWxzIjpbImRlcGVuZGVuY2llcyIsImphdmFzY3JpcHQiXX0=--> Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>	2026-10-16 00:58:22 +00:00
renovate[bot]	b11df02a05	build(deps): update dependency qs to v6.16.1 (#13475 ) This PR contains the following updates: \| Package \| Change \| [Age](https://docs.renovatebot.com/merge-confidence/) \| [Confidence](https://docs.renovatebot.com/merge-confidence/) \| \|---\|---\|---\|---\| \| [qs](https://redirect.github.com/ljharb/qs) \| [`6.16.0` → `6.16.1`](https://renovatebot.com/diffs/npm/qs/6.16.0/6.16.1) \| ![age](https://developer.mend.io/api/mc/badges/age/npm/qs/6.16.1?slim=true) \| ![confidence](https://developer.mend.io/api/mc/badges/confidence/npm/qs/6.16.0/6.16.1?slim=true) \| --- ### Release Notes <details> <summary>ljharb/qs (qs)</summary> ### [`v6.16.1`](https://redirect.github.com/ljharb/qs/blob/HEAD/CHANGELOG.md#6161) [Compare Source](https://redirect.github.com/ljharb/qs/compare/v6.16.0...v6.16.1) - \[Fix] `parse`: do not mutate an object input - \[Fix] `stringify`: stop re-encoding structural separator dots when `encodeDotInKeys` is set ([#564](https://redirect.github.com/ljharb/qs/issues/564)) - \[Fix] `stringify`: `arrayFormat: 'comma'`: pass the full encoder arguments with `encodeValuesOnly` - \[Fix] `utils`: encode `+` as `%2B` in iso-8859-1 mode so values round-trip ([#565](https://redirect.github.com/ljharb/qs/issues/565)) - \[Fix] parse: only convert top-level dots to brackets when allowDots is on ([#621](https://redirect.github.com/ljharb/qs/issues/621)) - \[Fix] `stringify`: ignore inherited array format names ([#622](https://redirect.github.com/ljharb/qs/issues/622)) - \[Fix] `stringify`: `arrayFormat: 'comma'`: do not throw on elements with no callable `toString` - \[Fix] `utils`: `merge`: seed an overflow container's index from its own keys, not just the source - \[Fix] `utils`: `merge`: keep a `strictMerge` conflict container's index and `arrayLimit` correct - \[Fix] `parse`: only treat `[]` as array syntax when it ends the key - \[Perf] `decode`: skip decoders when there is no percent sign ([#583](https://redirect.github.com/ljharb/qs/issues/583)) - \[Robustness] `utils`: `merge`: apply `arrayLimit` to the two-element array built for colliding values - \[Robustness] `parse`: bound the nesting added by repeated `strictMerge` conflicts (credit [@Yeaseen](https://redirect.github.com/Yeaseen)) - \[Docs] document that `qs` and flat parsers disagree about parameter names - \[Docs] clarify that `throwOnLimitExceeded` limits each array, not the total number of values - \[Docs] clarify 6.14.1/6.15.2 parse bracket behavior change ([#567](https://redirect.github.com/ljharb/qs/issues/567), [#568](https://redirect.github.com/ljharb/qs/issues/568)) - \[meta] fix changelog indents - \[actions] set least-privilege `cache-mode` - \[Tests] `utils`: `decode`: add missing cases - \[Tests] `parse`: characterize the `]=` split when an `=` precedes any bracket group ([#620](https://redirect.github.com/ljharb/qs/issues/620)) - \[Tests] `parse`: `allowDots`: cover stray close brackets before a dot - \[Dev Deps] update `@ljharb/eslint-config`, `eslint`, `tape` </details> --- ### Configuration 📅 Schedule: (UTC) - Branch creation - At any time (no schedule defined) - Automerge - At any time (no schedule defined) 🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied. ♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox. 🔕 Ignore: Close this PR and you won't be reminded about this update again. --- - [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check this box --- This PR was generated by [Mend Renovate](https://mend.io/renovate/). View the [repository job log](https://developer.mend.io/github/authelia/authelia). <!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0NC4xNjQuMSIsInVwZGF0ZWRJblZlciI6IjQ0LjE2NC4xIiwidGFyZ2V0QnJhbmNoIjoibWFzdGVyIiwibGFiZWxzIjpbImRlcGVuZGVuY2llcyIsImphdmFzY3JpcHQiXX0=--> Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>	2026-10-16 00:57:51 +00:00
renovate[bot]	afe6ec1047	build(deps): update react-email monorepo to v6.11.2 (#13473 ) This PR contains the following updates: \| Package \| Change \| [Age](https://docs.renovatebot.com/merge-confidence/) \| [Confidence](https://docs.renovatebot.com/merge-confidence/) \| \|---\|---\|---\|---\| \| [@react-email/ui](https://redirect.github.com/resend/react-email) ([source](https://redirect.github.com/resend/react-email/tree/HEAD/packages/ui)) \| [`6.11.1` → `6.11.2`](https://renovatebot.com/diffs/npm/@react-email%2fui/6.11.1/6.11.2) \| ![age](https://developer.mend.io/api/mc/badges/age/npm/@react-email%2fui/6.11.2?slim=true) \| ![confidence](https://developer.mend.io/api/mc/badges/confidence/npm/@react-email%2fui/6.11.1/6.11.2?slim=true) \| \| [react-email](https://redirect.github.com/resend/react-email) ([source](https://redirect.github.com/resend/react-email/tree/HEAD/packages/react-email)) \| [`6.11.1` → `6.11.2`](https://renovatebot.com/diffs/npm/react-email/6.11.1/6.11.2) \| ![age](https://developer.mend.io/api/mc/badges/age/npm/react-email/6.11.2?slim=true) \| ![confidence](https://developer.mend.io/api/mc/badges/confidence/npm/react-email/6.11.1/6.11.2?slim=true) \| --- ### Release Notes <details> <summary>resend/react-email (@react-email/ui)</summary> ### [`v6.11.2`](https://redirect.github.com/resend/react-email/blob/HEAD/packages/ui/CHANGELOG.md#6112) [Compare Source](https://redirect.github.com/resend/react-email/compare/@react-email/ui@6.11.1...@react-email/ui@6.11.2) </details> <details> <summary>resend/react-email (react-email)</summary> ### [`v6.11.2`](https://redirect.github.com/resend/react-email/blob/HEAD/packages/react-email/CHANGELOG.md#6112) [Compare Source](https://redirect.github.com/resend/react-email/compare/react-email@6.11.1...react-email@6.11.2) ##### Patch Changes - [`7190dca`](https://redirect.github.com/resend/react-email/commit/7190dca): Leave the direction marks U+200E and U+200F out of the `<Preview>` padding, so spam filters such as rspamd no longer score it as hidden text. The padding sequence is now `\xa0‌‍`; if you post-process rendered HTML by matching the old sequence, update it. - [`63f159a`](https://redirect.github.com/resend/react-email/commit/63f159a): `<Tailwind>` now inlines the default color for `shadow`, `shadow-md`, `ring-2` and similar classes, so these shadows show in email clients. </details> --- ### Configuration 📅 Schedule: (UTC) - Branch creation - At any time (no schedule defined) - Automerge - At any time (no schedule defined) 🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied. ♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox. 🔕 Ignore: Close this PR and you won't be reminded about these updates again. --- - [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check this box --- This PR was generated by [Mend Renovate](https://mend.io/renovate/). View the [repository job log](https://developer.mend.io/github/authelia/authelia). <!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0NC4xNjQuMSIsInVwZGF0ZWRJblZlciI6IjQ0LjE2NC4xIiwidGFyZ2V0QnJhbmNoIjoibWFzdGVyIiwibGFiZWxzIjpbImRlcGVuZGVuY2llcyIsImphdmFzY3JpcHQiXX0=--> Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>	2026-10-16 00:57:04 +00:00
renovate[bot]	509237c937	build(deps): update dependency i18next to v26.4.5 (#13470 ) This PR contains the following updates: \| Package \| Change \| [Age](https://docs.renovatebot.com/merge-confidence/) \| [Confidence](https://docs.renovatebot.com/merge-confidence/) \| \|---\|---\|---\|---\| \| [i18next](https://www.i18next.com) ([source](https://redirect.github.com/i18next/i18next)) \| [`26.4.4` → `26.4.5`](https://renovatebot.com/diffs/npm/i18next/26.4.4/26.4.5) \| ![age](https://developer.mend.io/api/mc/badges/age/npm/i18next/26.4.5?slim=true) \| ![confidence](https://developer.mend.io/api/mc/badges/confidence/npm/i18next/26.4.4/26.4.5?slim=true) \| --- ### Release Notes <details> <summary>i18next/i18next (i18next)</summary> ### [`v26.4.5`](https://redirect.github.com/i18next/i18next/blob/HEAD/CHANGELOG.md#2645) [Compare Source](https://redirect.github.com/i18next/i18next/compare/v26.4.4...v26.4.5) - fix: `hasLoadedNamespace(ns, { lng })` no longer stays `false` forever when the passed in `lng` is loaded under another code, or not at all. It checked the load state of the raw `lng`, but `loadLanguages()` stores a language under its resolved code (`de-ch` → `de-CH`, `de-CH` → `de` with `load: 'languageOnly'`) and skips a `lng` outside `supportedLngs` entirely (only the fallback gets loaded), so that state never got set. react-i18next's `useTranslation(ns, { lng })` then never became ready: with `useSuspense` it kept throwing an already resolved promise and React retried forever (100% CPU, SSR never finished), without it the load effect re-rendered in a loop. It now checks the code the language is actually loaded under, and for a `lng` outside `supportedLngs` only waits for the fallback, which is also what `t()` resolves to. Calls without `lng` and the `precheck` (react-i18next's `bindI18n: 'languageChanging'`) are unchanged ([react-i18next#1934](https://redirect.github.com/i18next/react-i18next/issues/1934)). </details> --- ### Configuration 📅 Schedule: (UTC) - Branch creation - At any time (no schedule defined) - Automerge - At any time (no schedule defined) 🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied. ♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox. 🔕 Ignore: Close this PR and you won't be reminded about this update again. --- - [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check this box --- This PR was generated by [Mend Renovate](https://mend.io/renovate/). View the [repository job log](https://developer.mend.io/github/authelia/authelia). <!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0NC4xNjQuMSIsInVwZGF0ZWRJblZlciI6IjQ0LjE2NC4xIiwidGFyZ2V0QnJhbmNoIjoibWFzdGVyIiwibGFiZWxzIjpbImRlcGVuZGVuY2llcyIsImphdmFzY3JpcHQiXX0=--> Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>	2026-10-16 00:57:03 +00:00
renovate[bot]	19e031d8f1	build(deps): update dependency i18next-http-backend to v4.0.3 (#13472 ) This PR contains the following updates: \| Package \| Change \| [Age](https://docs.renovatebot.com/merge-confidence/) \| [Confidence](https://docs.renovatebot.com/merge-confidence/) \| \|---\|---\|---\|---\| \| [i18next-http-backend](https://redirect.github.com/i18next/i18next-http-backend) \| [`4.0.2` → `4.0.3`](https://renovatebot.com/diffs/npm/i18next-http-backend/4.0.2/4.0.3) \| ![age](https://developer.mend.io/api/mc/badges/age/npm/i18next-http-backend/4.0.3?slim=true) \| ![confidence](https://developer.mend.io/api/mc/badges/confidence/npm/i18next-http-backend/4.0.2/4.0.3?slim=true) \| --- ### Release Notes <details> <summary>i18next/i18next-http-backend (i18next-http-backend)</summary> ### [`v4.0.3`](https://redirect.github.com/i18next/i18next-http-backend/blob/HEAD/CHANGELOG.md#403) [Compare Source](https://redirect.github.com/i18next/i18next-http-backend/compare/v4.0.2...v4.0.3) Security release. See advisory [GHSA-9jhj-wvmw-cfx5](https://redirect.github.com/i18next/i18next-http-backend/security/advisories/GHSA-9jhj-wvmw-cfx5). - security: refuse a request URL that starts with `//` (or `\`) when the `loadPath` / `addPath` template does not. With a template that puts `{{ns}}` directly after a leading `/` (e.g. `/{{ns}}/{{lng}}.json`), an `ns` value of `/evil.example` passed the per-value checks, because a single `/` is allowed for nested namespaces, but it joined the template's own `/` into `//evil.example/en.json`, a protocol-relative URL that browsers send to another origin. The 4.0.2 `//` check looked at the value only, so it missed this. The interpolated URL is now checked as a whole. The default `/locales/{{lng}}/{{ns}}.json`, templates with an origin, and protocol-relative CDN templates such as `//cdn.example/{{lng}}/{{ns}}.json` are not affected and keep working. </details> --- ### Configuration 📅 Schedule: (UTC) - Branch creation - At any time (no schedule defined) - Automerge - At any time (no schedule defined) 🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied. ♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox. 🔕 Ignore: Close this PR and you won't be reminded about this update again. --- - [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check this box --- This PR was generated by [Mend Renovate](https://mend.io/renovate/). View the [repository job log](https://developer.mend.io/github/authelia/authelia). <!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0NC4xNjQuMSIsInVwZGF0ZWRJblZlciI6IjQ0LjE2NC4xIiwidGFyZ2V0QnJhbmNoIjoibWFzdGVyIiwibGFiZWxzIjpbImRlcGVuZGVuY2llcyIsImphdmFzY3JpcHQiXX0=--> Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>	2026-10-16 00:57:00 +00:00
renovate[bot]	ec857b0a52	build(deps): update dependency @eslint-react/eslint-plugin to v5.26.7 (#13468 ) This PR contains the following updates: \| Package \| Change \| [Age](https://docs.renovatebot.com/merge-confidence/) \| [Confidence](https://docs.renovatebot.com/merge-confidence/) \| \|---\|---\|---\|---\| \| [@eslint-react/eslint-plugin](https://redirect.github.com/Rel1cx/eslint-react) ([source](https://redirect.github.com/Rel1cx/eslint-react/tree/HEAD/plugins/eslint-plugin)) \| [`5.26.5` → `5.26.7`](https://renovatebot.com/diffs/npm/@eslint-react%2feslint-plugin/5.26.5/5.26.7) \| ![age](https://developer.mend.io/api/mc/badges/age/npm/@eslint-react%2feslint-plugin/5.26.7?slim=true) \| ![confidence](https://developer.mend.io/api/mc/badges/confidence/npm/@eslint-react%2feslint-plugin/5.26.5/5.26.7?slim=true) \| --- ### Release Notes <details> <summary>Rel1cx/eslint-react (@eslint-react/eslint-plugin)</summary> ### [`v5.26.7`](https://redirect.github.com/Rel1cx/eslint-react/blob/HEAD/CHANGELOG.md#v5267-2026-10-15) [Compare Source](https://redirect.github.com/Rel1cx/eslint-react/compare/v5.26.6...v5.26.7) ##### 🏗️ Internal - `@eslint-react/core`: collectors now use the node's source range start as the map key, replacing the shared counter, keys are stable across repeated lints, traceable to source positions when debugging, and slightly cheaper than stringified numbers. ([#2033](https://redirect.github.com/Rel1cx/eslint-react/issues/2033)) Full Changelog: <https://github.com/Rel1cx/eslint-react/compare/v5.26.6...v5.26.7> ### [`v5.26.6`](https://redirect.github.com/Rel1cx/eslint-react/blob/HEAD/CHANGELOG.md#v5266-2026-10-14) [Compare Source](https://redirect.github.com/Rel1cx/eslint-react/compare/v5.26.5...v5.26.6) ##### 🏗️ Internal - `@eslint-react/core`: component and hook collectors now use sequential integer keys instead of random `randomBytes` hex keys, removing `node:crypto` from the lint hot path. ([#2032](https://redirect.github.com/Rel1cx/eslint-react/issues/2032)) Thanks to [@kurtextrem](https://redirect.github.com/kurtextrem)! - Bumped `effect` to `4.0.4`, `ts-pattern` to `5.9.2`, `fumadocs-core` and `fumadocs-ui` to `16.17.3`, `lucide-react` to `1.57.0`, `oxlint` to `1.88.0`, `typedoc-plugin-markdown` to `4.14.0`, and `undici` to `8.12.1`. ##### New Contributors - Jacob Groß ([@kurtextrem](https://redirect.github.com/kurtextrem)) made their first contribution in [#2032](https://redirect.github.com/Rel1cx/eslint-react/issues/2032). Full Changelog: <https://github.com/Rel1cx/eslint-react/compare/v5.26.5...v5.26.6> </details> --- ### Configuration 📅 Schedule: (UTC) - Branch creation - At any time (no schedule defined) - Automerge - At any time (no schedule defined) 🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied. ♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox. 🔕 Ignore: Close this PR and you won't be reminded about this update again. --- - [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check this box --- This PR was generated by [Mend Renovate](https://mend.io/renovate/). View the [repository job log](https://developer.mend.io/github/authelia/authelia). <!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0NC4xNjQuMSIsInVwZGF0ZWRJblZlciI6IjQ0LjE2NC4xIiwidGFyZ2V0QnJhbmNoIjoibWFzdGVyIiwibGFiZWxzIjpbImRlcGVuZGVuY2llcyIsImphdmFzY3JpcHQiXX0=--> Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>	2026-10-15 22:38:36 +00:00
renovate[bot]	47aeddd1c6	build(deps): update react monorepo to v19.3.1 (#13471 ) This PR contains the following updates: \| Package \| Change \| [Age](https://docs.renovatebot.com/merge-confidence/) \| [Confidence](https://docs.renovatebot.com/merge-confidence/) \| \|---\|---\|---\|---\| \| [react](https://react.dev/) ([source](https://redirect.github.com/react/react/tree/HEAD/packages/react)) \| [`19.3.0` → `19.3.1`](https://renovatebot.com/diffs/npm/react/19.3.0/19.3.1) \| ![age](https://developer.mend.io/api/mc/badges/age/npm/react/19.3.1?slim=true) \| ![confidence](https://developer.mend.io/api/mc/badges/confidence/npm/react/19.3.0/19.3.1?slim=true) \| \| [react-dom](https://react.dev/) ([source](https://redirect.github.com/react/react/tree/HEAD/packages/react-dom)) \| [`19.3.0` → `19.3.1`](https://renovatebot.com/diffs/npm/react-dom/19.3.0/19.3.1) \| ![age](https://developer.mend.io/api/mc/badges/age/npm/react-dom/19.3.1?slim=true) \| ![confidence](https://developer.mend.io/api/mc/badges/confidence/npm/react-dom/19.3.0/19.3.1?slim=true) \| --- ### Release Notes <details> <summary>react/react (react)</summary> ### [`v19.3.1`](https://redirect.github.com/react/react/releases/tag/v19.3.1): 19.3.1 (October 14th, 2026) [Compare Source](https://redirect.github.com/react/react/compare/v19.3.0...v19.3.1) #### React Server Components - Improve transport protocol ([#37845](https://redirect.github.com/facebook/react/pull/37845) by [@unstubbable](https://redirect.github.com/unstubbable) and [@eps1lon](https://redirect.github.com/eps1lon)) </details> --- ### Configuration 📅 Schedule: (UTC) - Branch creation - At any time (no schedule defined) - Automerge - At any time (no schedule defined) 🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied. ♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox. 🔕 Ignore: Close this PR and you won't be reminded about these updates again. --- - [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check this box --- This PR was generated by [Mend Renovate](https://mend.io/renovate/). View the [repository job log](https://developer.mend.io/github/authelia/authelia). <!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0NC4xNjQuMSIsInVwZGF0ZWRJblZlciI6IjQ0LjE2NC4xIiwidGFyZ2V0QnJhbmNoIjoibWFzdGVyIiwibGFiZWxzIjpbImRlcGVuZGVuY2llcyIsImphdmFzY3JpcHQiXX0=--> Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>	2026-10-15 22:34:55 +00:00
renovate[bot]	c2a9bde9f2	build(deps): update envoyproxy/envoy docker tag to v1.40.0 (#13466 ) This PR contains the following updates: \| Package \| Update \| Change \| \|---\|---\|---\| \| envoyproxy/envoy \| minor \| `v1.39.4` → `v1.40.0` \| --- ### Configuration 📅 Schedule: (UTC) - Branch creation - At any time (no schedule defined) - Automerge - At any time (no schedule defined) 🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied. ♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox. 🔕 Ignore: Close this PR and you won't be reminded about this update again. --- - [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check this box --- This PR was generated by [Mend Renovate](https://mend.io/renovate/). View the [repository job log](https://developer.mend.io/github/authelia/authelia). <!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0NC4xNjQuMSIsInVwZGF0ZWRJblZlciI6IjQ0LjE2NC4xIiwidGFyZ2V0QnJhbmNoIjoibWFzdGVyIiwibGFiZWxzIjpbImRlcGVuZGVuY2llcyIsImRvY2tlciJdfQ==--> Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>	2026-10-15 22:34:40 +00:00
renovate[bot]	743236fd1b	build(deps): update haproxy:3.4.7-alpine docker digest to 251da69 (#13465 ) This PR contains the following updates: \| Package \| Type \| Update \| Change \| \|---\|---\|---\|---\| \| [haproxy](https://hub.docker.com/_/haproxy) ([source](https://redirect.github.com/docker-library/haproxy)) \| final \| digest \| `dc53230` → `251da69` \| --- ### Configuration 📅 Schedule: (UTC) - Branch creation - At any time (no schedule defined) - Automerge - At any time (no schedule defined) 🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied. ♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox. 🔕 Ignore: Close this PR and you won't be reminded about this update again. --- - [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check this box --- This PR was generated by [Mend Renovate](https://mend.io/renovate/). View the [repository job log](https://developer.mend.io/github/authelia/authelia). <!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0NC4xNjQuMSIsInVwZGF0ZWRJblZlciI6IjQ0LjE2NC4xIiwidGFyZ2V0QnJhbmNoIjoibWFzdGVyIiwibGFiZWxzIjpbImRlcGVuZGVuY2llcyIsImRvY2tlciJdfQ==--> Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>	2026-10-15 22:34:11 +00:00
renovate[bot]	9e70273ab4	build(deps): update authelia/base:latest docker digest to b008bbb (#13467 ) This PR contains the following updates: \| Package \| Type \| Update \| Change \| \|---\|---\|---\|---\| \| authelia/base \| final \| digest \| `bbaa1de` → `b008bbb` \| --- ### Configuration 📅 Schedule: (UTC) - Branch creation - At any time (no schedule defined) - Automerge - At any time (no schedule defined) 🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied. ♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox. 🔕 Ignore: Close this PR and you won't be reminded about this update again. --- - [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check this box --- This PR was generated by [Mend Renovate](https://mend.io/renovate/). View the [repository job log](https://developer.mend.io/github/authelia/authelia). <!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0NC4xNjQuMSIsInVwZGF0ZWRJblZlciI6IjQ0LjE2NC4xIiwidGFyZ2V0QnJhbmNoIjoibWFzdGVyIiwibGFiZWxzIjpbImRlcGVuZGVuY2llcyIsImRvY2tlciJdfQ==--> Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>	2026-10-15 22:34:04 +00:00
renovate[bot]	bcf6b06c77	build(deps): update dependency lucide-react to v1.57.0 (#13464 ) This PR contains the following updates: \| Package \| Change \| [Age](https://docs.renovatebot.com/merge-confidence/) \| [Confidence](https://docs.renovatebot.com/merge-confidence/) \| \|---\|---\|---\|---\| \| [lucide-react](https://lucide.dev) ([source](https://redirect.github.com/lucide-icons/lucide/tree/HEAD/packages/lucide-react)) \| [`1.55.0` → `1.57.0`](https://renovatebot.com/diffs/npm/lucide-react/1.55.0/1.57.0) \| ![age](https://developer.mend.io/api/mc/badges/age/npm/lucide-react/1.57.0?slim=true) \| ![confidence](https://developer.mend.io/api/mc/badges/confidence/npm/lucide-react/1.55.0/1.57.0?slim=true) \| --- ### Release Notes <details> <summary>lucide-icons/lucide (lucide-react)</summary> ### [`v1.57.0`](https://redirect.github.com/lucide-icons/lucide/releases/tag/1.57.0): Version 1.57.0 [Compare Source](https://redirect.github.com/lucide-icons/lucide/compare/1.56.0...1.57.0) #### What's Changed - feat(icons): added `folder-user` and `folder-user` icons by [@rrod497](https://redirect.github.com/rrod497) in [#4603](https://redirect.github.com/lucide-icons/lucide/pull/4603) - feat(icons): added `calendar-chevrons-left` icon by [@karsa-mistmere](https://redirect.github.com/karsa-mistmere) in [#5001](https://redirect.github.com/lucide-icons/lucide/pull/5001) - feat(icons): added `users-collaboration` icon by [@rrod497](https://redirect.github.com/rrod497) in [#4922](https://redirect.github.com/lucide-icons/lucide/pull/4922) - feat(icons): added `Belarusian ruble` icon by [@js-best](https://redirect.github.com/js-best) in [#4984](https://redirect.github.com/lucide-icons/lucide/pull/4984) - feat(icons): added `circle-fading-play` icon by [@tatianatsiguleva](https://redirect.github.com/tatianatsiguleva) in [#4990](https://redirect.github.com/lucide-icons/lucide/pull/4990) - feat(icons): add `cpu-ai` icon by [@signalgridco](https://redirect.github.com/signalgridco) in [#4992](https://redirect.github.com/lucide-icons/lucide/pull/4992) - feat(icons): added `guitar-electric` icon by [@rrod497](https://redirect.github.com/rrod497) in [#4917](https://redirect.github.com/lucide-icons/lucide/pull/4917) - feat(icons): added `graph-star` icon by [@Nitero](https://redirect.github.com/Nitero) in [#4983](https://redirect.github.com/lucide-icons/lucide/pull/4983) - chore(deps-dev): bump the svelte-deps group with 2 updates by [@dependabot](https://redirect.github.com/dependabot)\[bot] in [#4996](https://redirect.github.com/lucide-icons/lucide/pull/4996) - chore(deps-dev): bump preact from 11.0.0 to 11.0.1 in the preact-deps group by [@dependabot](https://redirect.github.com/dependabot)\[bot] in [#4999](https://redirect.github.com/lucide-icons/lucide/pull/4999) - chore(deps-dev): bump [@vitejs/plugin-react](https://redirect.github.com/vitejs/plugin-react) from 6.1.1 to 6.1.2 in the react-deps group by [@dependabot](https://redirect.github.com/dependabot)\[bot] in [#4995](https://redirect.github.com/lucide-icons/lucide/pull/4995) - feat(icons): added `perfume` icon by [@rrod497](https://redirect.github.com/rrod497) in [#4426](https://redirect.github.com/lucide-icons/lucide/pull/4426) #### New Contributors - [@js-best](https://redirect.github.com/js-best) made their first contribution in [#4984](https://redirect.github.com/lucide-icons/lucide/pull/4984) - [@tatianatsiguleva](https://redirect.github.com/tatianatsiguleva) made their first contribution in [#4990](https://redirect.github.com/lucide-icons/lucide/pull/4990) - [@signalgridco](https://redirect.github.com/signalgridco) made their first contribution in [#4992](https://redirect.github.com/lucide-icons/lucide/pull/4992) - [@Nitero](https://redirect.github.com/Nitero) made their first contribution in [#4983](https://redirect.github.com/lucide-icons/lucide/pull/4983) Full Changelog: <https://github.com/lucide-icons/lucide/compare/1.56.0...1.57.0> ### [`v1.56.0`](https://redirect.github.com/lucide-icons/lucide/releases/tag/1.56.0): Version 1.56.0 [Compare Source](https://redirect.github.com/lucide-icons/lucide/compare/1.55.0...1.56.0) #### What's Changed - feat(icons): added `server-nas` icon by [@benhaube](https://redirect.github.com/benhaube) in [#4537](https://redirect.github.com/lucide-icons/lucide/pull/4537) - fix(icons,categories): fix `notifications` category name and refine `circle-x` tags by [@Rachit315](https://redirect.github.com/Rachit315) in [#4994](https://redirect.github.com/lucide-icons/lucide/pull/4994) - feat(icons): add `message-circle-text` icon by [@ericfennis](https://redirect.github.com/ericfennis) in [#4898](https://redirect.github.com/lucide-icons/lucide/pull/4898) #### New Contributors - [@Rachit315](https://redirect.github.com/Rachit315) made their first contribution in [#4994](https://redirect.github.com/lucide-icons/lucide/pull/4994) Full Changelog: <https://github.com/lucide-icons/lucide/compare/1.55.0...1.56.0> </details> --- ### Configuration 📅 Schedule: (UTC) - Branch creation - At any time (no schedule defined) - Automerge - At any time (no schedule defined) 🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied. ♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox. 🔕 Ignore: Close this PR and you won't be reminded about this update again. --- - [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check this box --- This PR was generated by [Mend Renovate](https://mend.io/renovate/). View the [repository job log](https://developer.mend.io/github/authelia/authelia). <!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0NC4xNjQuMSIsInVwZGF0ZWRJblZlciI6IjQ0LjE2NC4xIiwidGFyZ2V0QnJhbmNoIjoibWFzdGVyIiwibGFiZWxzIjpbImRlcGVuZGVuY2llcyIsImphdmFzY3JpcHQiXX0=--> Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>	2026-10-15 13:26:43 +00:00
renovate[bot]	ba204b64d0	build(deps): update dependency @eslint-react/eslint-plugin to v5.26.5 (#13463 ) This PR contains the following updates: \| Package \| Change \| [Age](https://docs.renovatebot.com/merge-confidence/) \| [Confidence](https://docs.renovatebot.com/merge-confidence/) \| \|---\|---\|---\|---\| \| [@eslint-react/eslint-plugin](https://redirect.github.com/Rel1cx/eslint-react) ([source](https://redirect.github.com/Rel1cx/eslint-react/tree/HEAD/plugins/eslint-plugin)) \| [`5.24.10` → `5.26.5`](https://renovatebot.com/diffs/npm/@eslint-react%2feslint-plugin/5.24.10/5.26.5) \| ![age](https://developer.mend.io/api/mc/badges/age/npm/@eslint-react%2feslint-plugin/5.26.5?slim=true) \| ![confidence](https://developer.mend.io/api/mc/badges/confidence/npm/@eslint-react%2feslint-plugin/5.24.10/5.26.5?slim=true) \| --- ### Release Notes <details> <summary>Rel1cx/eslint-react (@eslint-react/eslint-plugin)</summary> ### [`v5.26.5`](https://redirect.github.com/Rel1cx/eslint-react/blob/HEAD/CHANGELOG.md#v5265-2026-10-13) [Compare Source](https://redirect.github.com/Rel1cx/eslint-react/compare/v5.26.4...v5.26.5) ##### 🐞 Fixes - `react-x/set-state-in-effect`: a `setState` on the right side of a short-circuit operator (`&&`, `\|\|`, `??`) is now exempt when the left operand is ref-derived (ex: `ref.current && setData(1)`), matching the existing ref-gated conditional exemption; a left-side `setState` still runs unconditionally and stays reported. ([#2031](https://redirect.github.com/Rel1cx/eslint-react/issues/2031)) - `react-x/set-state-in-effect`: setup identifiers are now collected from the setup argument of the effect call only; the callee and the deps array are no longer scanned, so a function referenced only in the deps array (ex: `useEffect(setup, [helper])`) is no longer mistaken for the setup and its `setState` calls stay unattributed. ([#2031](https://redirect.github.com/Rel1cx/eslint-react/issues/2031)) - `react-x/set-state-in-effect`: arrow function parameters are no longer collected as callback-body setter references (ex: the `setState` in `useMemo((setState) => ..., [])`); only actual callback bodies are collected (ex: `useMemo(() => setState, [])`). ([#2031](https://redirect.github.com/Rel1cx/eslint-react/issues/2031)) Full Changelog: <https://github.com/Rel1cx/eslint-react/compare/v5.26.4...v5.26.5> ### [`v5.26.4`](https://redirect.github.com/Rel1cx/eslint-react/blob/HEAD/CHANGELOG.md#v5264-2026-10-13) [Compare Source](https://redirect.github.com/Rel1cx/eslint-react/compare/v5.26.3...v5.26.4) ##### 🐞 Fixes - The name lookup now stops at function boundaries, so expression-bodied factory functions and custom hooks (ex: `export const useAnchor = () => useRef(null)`) are no longer misreported; calls inside JSX expressions, computed keys, or class static blocks no longer fall back to the outer variable. ([#2029](https://redirect.github.com/Rel1cx/eslint-react/issues/2029)) Closes [#2026](https://redirect.github.com/Rel1cx/eslint-react/issues/2026). Affected rules: - `react-naming-convention/context-name` - `react-naming-convention/id-name` - `react-naming-convention/ref-name` - The name lookup no longer crosses containers or derived values (ex: `const refs = [useRef(null)]`, `const n = useRef(0) + 1`), so such calls are no longer reported on the enclosing variable; sequence expressions check only the last value, and unresolvable computed keys (ex: `{ [key]: useRef(null) }`) no longer fall back to the outer variable. ([#2030](https://redirect.github.com/Rel1cx/eslint-react/issues/2030)) Affected rules: - `react-naming-convention/context-name` - `react-naming-convention/id-name` - `react-naming-convention/ref-name` Full Changelog: <https://github.com/Rel1cx/eslint-react/compare/v5.26.3...v5.26.4> ### [`v5.26.3`](https://redirect.github.com/Rel1cx/eslint-react/blob/HEAD/CHANGELOG.md#v5263-2026-10-12) [Compare Source](https://redirect.github.com/Rel1cx/eslint-react/compare/v5.26.2...v5.26.3) ##### 🐞 Fixes - An enclosing object literal property key now takes precedence over the outer assignment target when statically known (ex: `const refs = { myRef: useRef(0) }`); computed keys with string literals (ex: `refs["value"] = useRef(null)`) are now checked, and unresolvable computed keys are no longer reported. ([#2028](https://redirect.github.com/Rel1cx/eslint-react/issues/2028)) Affected rules: - `react-naming-convention/context-name` - `react-naming-convention/id-name` - `react-naming-convention/ref-name` - `react-naming-convention/ref-name`: immediate dereferences of the `useRef` result through TypeScript type wrappers (ex: `(useRef(null) as { current: null }).current`, `useRef(null)!.current`) are no longer reported, extending the [#1375](https://redirect.github.com/Rel1cx/eslint-react/issues/1375) fix. ([#2028](https://redirect.github.com/Rel1cx/eslint-react/issues/2028)) Full Changelog: <https://github.com/Rel1cx/eslint-react/compare/v5.26.2...v5.26.3> ### [`v5.26.2`](https://redirect.github.com/Rel1cx/eslint-react/blob/HEAD/CHANGELOG.md#v5262-2026-10-12) [Compare Source](https://redirect.github.com/Rel1cx/eslint-react/compare/v5.26.1...v5.26.2) ##### ✨ New - `react-x/no-unused-props`: improved prop usage detection. Props parameters with default values (ex: `function Component(props: Props = defaultProps)`) are now unwrapped and analyzed, props aliased to a local variable (ex: `const alias = props`) are tracked through the alias, and template literals without substitutions (ex: ``props[`foo`]``) are recognized as static prop keys. ([#2021](https://redirect.github.com/Rel1cx/eslint-react/issues/2021)) ##### 🐞 Fixes - `react-x/no-unused-props`: a component whose used prop keys cannot be fully determined (ex: it passes the whole props object to another function) now marks all of its declared props as used, so a props declaration shared with another fully analyzable component is no longer reported as unused. ([#2021](https://redirect.github.com/Rel1cx/eslint-react/issues/2021)) - `react-x/set-state-in-effect`: ref-derived values that reach the `setState` argument through assignment statements (rather than the declaration initializer) are now recognized; only writes that lexically precede the use and live in the use's own function or an ancestor count. ([#2027](https://redirect.github.com/Rel1cx/eslint-react/issues/2027)) - `react-x/set-state-in-effect`: parameters of a helper invoked from the effect setup are now treated as ref-derived when the call-site argument is ref-derived, matched per call site by parameter definition. ([#2027](https://redirect.github.com/Rel1cx/eslint-react/issues/2027)) - `react-x/set-state-in-effect`: a `.current` read rooted at a function parameter is now recognized as a ref read (ex: `setReferenceElement(anchor?.current)` where `anchor` is a `RefObject` prop); previously only parameters named `ref` or ending in `Ref` were recognized. ([#2027](https://redirect.github.com/Rel1cx/eslint-react/issues/2027)) - `react-x/no-unused-class-component-members`: public methods (including function-valued properties) of an exported class component are no longer reported as unused, as they may be part of the component's imperative API invoked by consumers through refs. Data fields, `private`/`protected` members, and members of non-exported classes are still reported. ([#2024](https://redirect.github.com/Rel1cx/eslint-react/issues/2024)) ##### 🏗️ Internal - Ordered message ids by first usage and unified default/suggestion message id naming across `react-dom`, `react-jsx`, `react-web-api`, and `react-x` rules. ([#2022](https://redirect.github.com/Rel1cx/eslint-react/issues/2022)) Full Changelog: <https://github.com/Rel1cx/eslint-react/compare/v5.26.1...v5.26.2> ### [`v5.26.1`](https://redirect.github.com/Rel1cx/eslint-react/blob/HEAD/CHANGELOG.md#v5261-2026-10-12) [Compare Source](https://redirect.github.com/Rel1cx/eslint-react/compare/v5.26.0...v5.26.1) ##### 🏗️ Internal - Renamed the internal suggestion message id from `"replace"` to `"suggest"`. Affected rules: - `react-x/no-context-provider` - `react-x/no-forward-ref` - `react-x/no-use-context` - `react-x/immutability`: moved context-dependent helpers from `helpers.ts` into `origins.ts` and `effects.ts` to match the fact-based implementation pattern. - `react-x/globals`: moved `resolveToFunction` from `helpers.ts` to `origins.ts`. - Bumped `effect` to `4.0.3`, `tsl-dx` to `0.14.1`, `@tsconfig/node20` to `20.1.10`, and `@types/node` to `20.19.43`. ##### 📝 Documentation - Refreshed spec diff verification dates and notes for `react-x` rules. Full Changelog: <https://github.com/Rel1cx/eslint-react/compare/v5.26.0...v5.26.1> ### [`v5.26.0`](https://redirect.github.com/Rel1cx/eslint-react/blob/HEAD/CHANGELOG.md#v5260-2026-10-11) [Compare Source](https://redirect.github.com/Rel1cx/eslint-react/compare/v5.25.0...v5.26.0) ##### ✨ New - Lowered the minimum required Node.js version from `>=22.0.0` to `>=20.19.0`. ([#2020](https://redirect.github.com/Rel1cx/eslint-react/issues/2020)) Full Changelog: <https://github.com/Rel1cx/eslint-react/compare/v5.25.0...v5.26.0> ### [`v5.25.0`](https://redirect.github.com/Rel1cx/eslint-react/blob/HEAD/CHANGELOG.md#v5250-2026-10-11) [Compare Source](https://redirect.github.com/Rel1cx/eslint-react/compare/v5.24.10...v5.25.0) ##### ✨ New - `react-dom/no-unsafe-target-blank`: added an `allowReferrer` option (default: `false`). When enabled, `rel="noopener"` alone is accepted and the suggested fix adds `rel="noopener"` instead of `rel="noreferrer noopener"`, preserving referrer information while still requiring an explicit token. ([#2019](https://redirect.github.com/Rel1cx/eslint-react/issues/2019)) Closes [#2012](https://redirect.github.com/Rel1cx/eslint-react/issues/2012). ##### 🏗️ Internal - `@eslint-react/ast`: added `hasParent` and `hasEnclosingTryBlock` shortcuts to `Traverse`. ([#2016](https://redirect.github.com/Rel1cx/eslint-react/issues/2016)) - `@eslint-react/ast`: renamed the `types` module to `tree` and narrowed the `Extract.unwrap` result type. ([#2017](https://redirect.github.com/Rel1cx/eslint-react/issues/2017)) - `@eslint-react/core`: removed the unused `REACT_BUILTIN_HOOK_NAMES` constant. - Bumped `tsdown` to `0.23.1`, `@effect/platform-node` to `4.0.3`, `pnpm` to `12.11.2`, `@types/node` to `26.6.5`, `setup-uv` to `v10.3.0`, and `fumadocs` and `lucide-react` in the website. Full Changelog: <https://github.com/Rel1cx/eslint-react/compare/v5.24.10...v5.25.0> </details> --- ### Configuration 📅 Schedule: (UTC) - Branch creation - At any time (no schedule defined) - Automerge - At any time (no schedule defined) 🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied. ♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox. 🔕 Ignore: Close this PR and you won't be reminded about this update again. --- - [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check this box --- This PR was generated by [Mend Renovate](https://mend.io/renovate/). View the [repository job log](https://developer.mend.io/github/authelia/authelia). <!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0NC4xNjQuMSIsInVwZGF0ZWRJblZlciI6IjQ0LjE2NC4xIiwidGFyZ2V0QnJhbmNoIjoibWFzdGVyIiwibGFiZWxzIjpbImRlcGVuZGVuY2llcyIsImphdmFzY3JpcHQiXX0=--> Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>	2026-10-15 13:26:09 +00:00
renovate[bot]	49cd0572e1	build(deps): update actions/create-github-app-token action to v3.3.0 (#13462 ) This PR contains the following updates: \| Package \| Type \| Update \| Change \| \|---\|---\|---\|---\| \| [actions/create-github-app-token](https://redirect.github.com/actions/create-github-app-token) \| action \| minor \| `v3.2.0` → `v3.3.0` \| --- ### Release Notes <details> <summary>actions/create-github-app-token</summary> ### [`v3.3.0`](https://redirect.github.com/actions/create-github-app-token/releases/tag/v3.3.0) [Compare Source](https://redirect.github.com/actions/create-github-app-token/compare/v3.2.0...v3.3.0) ##### Features - update permission inputs ([#399](https://redirect.github.com/actions/create-github-app-token/issues/399)) ([a47236f](https://redirect.github.com/actions/create-github-app-token/commit/a47236f79f79fcbc3532af49fe3a5ded89529b6e)) ##### Bug Fixes - deps: bump nested undici from 6.24.0 to 6.29.0 ([#403](https://redirect.github.com/actions/create-github-app-token/issues/403)) ([12461a3](https://redirect.github.com/actions/create-github-app-token/commit/12461a3a794e67c032f1eff5bb95ece9427eb4fb)) - deps: bump the production-dependencies group across 1 directory with 3 updates ([#395](https://redirect.github.com/actions/create-github-app-token/issues/395)) ([a69c19d](https://redirect.github.com/actions/create-github-app-token/commit/a69c19ddfdf8e1ab093900e0064524ce9309c807)) </details> --- ### Configuration 📅 Schedule: (UTC) - Branch creation - At any time (no schedule defined) - Automerge - At any time (no schedule defined) 🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied. ♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox. 🔕 Ignore: Close this PR and you won't be reminded about this update again. --- - [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check this box --- This PR was generated by [Mend Renovate](https://mend.io/renovate/). View the [repository job log](https://developer.mend.io/github/authelia/authelia). <!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0NC4xNTYuMyIsInVwZGF0ZWRJblZlciI6IjQ0LjE1Ni4zIiwidGFyZ2V0QnJhbmNoIjoibWFzdGVyIiwibGFiZWxzIjpbImRlcGVuZGVuY2llcyIsImdpdGh1Yl9hY3Rpb25zIl19--> Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>	2026-10-15 11:37:43 +00:00
renovate[bot]	30e60234e0	build(deps): update vitest monorepo to v5.0.4 (#13461 ) This PR contains the following updates: \| Package \| Change \| [Age](https://docs.renovatebot.com/merge-confidence/) \| [Confidence](https://docs.renovatebot.com/merge-confidence/) \| \|---\|---\|---\|---\| \| [@vitest/coverage-istanbul](https://vitest.dev/guide/coverage) ([source](https://redirect.github.com/vitest-dev/vitest/tree/HEAD/packages/coverage-istanbul)) \| [`5.0.3` → `5.0.4`](https://renovatebot.com/diffs/npm/@vitest%2fcoverage-istanbul/5.0.3/5.0.4) \| ![age](https://developer.mend.io/api/mc/badges/age/npm/@vitest%2fcoverage-istanbul/5.0.4?slim=true) \| ![confidence](https://developer.mend.io/api/mc/badges/confidence/npm/@vitest%2fcoverage-istanbul/5.0.3/5.0.4?slim=true) \| \| [@vitest/ui](https://vitest.dev/guide/ui) ([source](https://redirect.github.com/vitest-dev/vitest/tree/HEAD/packages/ui)) \| [`5.0.3` → `5.0.4`](https://renovatebot.com/diffs/npm/@vitest%2fui/5.0.3/5.0.4) \| ![age](https://developer.mend.io/api/mc/badges/age/npm/@vitest%2fui/5.0.4?slim=true) \| ![confidence](https://developer.mend.io/api/mc/badges/confidence/npm/@vitest%2fui/5.0.3/5.0.4?slim=true) \| \| [vitest](https://vitest.dev) ([source](https://redirect.github.com/vitest-dev/vitest/tree/HEAD/packages/vitest)) \| [`5.0.3` → `5.0.4`](https://renovatebot.com/diffs/npm/vitest/5.0.3/5.0.4) \| ![age](https://developer.mend.io/api/mc/badges/age/npm/vitest/5.0.4?slim=true) \| ![confidence](https://developer.mend.io/api/mc/badges/confidence/npm/vitest/5.0.3/5.0.4?slim=true) \| --- ### Release Notes <details> <summary>vitest-dev/vitest (@vitest/coverage-istanbul)</summary> ### [`v5.0.4`](https://redirect.github.com/vitest-dev/vitest/releases/tag/v5.0.4) [Compare Source](https://redirect.github.com/vitest-dev/vitest/compare/v5.0.3...v5.0.4) ##### 🚀 Features - experimental: - Tag cache directories with CACHEDIR.TAG - by [@lifeiscontent](https://redirect.github.com/lifeiscontent) in [#11461](https://redirect.github.com/vitest-dev/vitest/issues/11461) [<samp>(a8ea3)</samp>](https://redirect.github.com/vitest-dev/vitest/commit/a8ea3c8fd) - Support `test.ui.theme` option - by [@sheremet-va](https://redirect.github.com/sheremet-va) in [#11499](https://redirect.github.com/vitest-dev/vitest/issues/11499) [<samp>(1da66)</samp>](https://redirect.github.com/vitest-dev/vitest/commit/1da66405d) - Highlight selector multiple matches in trace view - by [@hi-ogawa](https://redirect.github.com/hi-ogawa), Hiroshi Ogawa and Claude Opus 5.5 in [#11489](https://redirect.github.com/vitest-dev/vitest/issues/11489) [<samp>(5abba)</samp>](https://redirect.github.com/vitest-dev/vitest/commit/5abba1e1b) - Print how many tests were affected and a total when running `--changed` - by [@sheremet-va](https://redirect.github.com/sheremet-va) in [#11424](https://redirect.github.com/vitest-dev/vitest/issues/11424) [<samp>(a2336)</samp>](https://redirect.github.com/vitest-dev/vitest/commit/a23368585) - Add an option to cache dependencies instead of statically parsing them - by [@sheremet-va](https://redirect.github.com/sheremet-va) in [#11515](https://redirect.github.com/vitest-dev/vitest/issues/11515) [<samp>(c0601)</samp>](https://redirect.github.com/vitest-dev/vitest/commit/c06012ac8) - Add fit and zoom controls to trace viewer - by [@hi-ogawa](https://redirect.github.com/hi-ogawa), Hiroshi Ogawa and Claude Opus 5.5 in [#11490](https://redirect.github.com/vitest-dev/vitest/issues/11490) [<samp>(f5dd9)</samp>](https://redirect.github.com/vitest-dev/vitest/commit/f5dd99ed0) ##### 🐞 Bug Fixes - Fail the run on git and location filter errors - by [@sheremet-va](https://redirect.github.com/sheremet-va) in [#11430](https://redirect.github.com/vitest-dev/vitest/issues/11430) [<samp>(30d03)</samp>](https://redirect.github.com/vitest-dev/vitest/commit/30d0304d2) - Enable fsModuleCache by default - by [@sheremet-va](https://redirect.github.com/sheremet-va) in [#11435](https://redirect.github.com/vitest-dev/vitest/issues/11435) [<samp>(ad208)</samp>](https://redirect.github.com/vitest-dev/vitest/commit/ad208cc29) - Track project files and mocks with --changed - by [@sheremet-va](https://redirect.github.com/sheremet-va) in [#11432](https://redirect.github.com/vitest-dev/vitest/issues/11432) [<samp>(b0f2b)</samp>](https://redirect.github.com/vitest-dev/vitest/commit/b0f2b3bb9) - Refactor caching, fix `:` in project and change the shape of `results` cache - by [@sheremet-va](https://redirect.github.com/sheremet-va) in [#11453](https://redirect.github.com/vitest-dev/vitest/issues/11453) [<samp>(9673c)</samp>](https://redirect.github.com/vitest-dev/vitest/commit/9673c49a4) - Keep full `$` string values when `taskTitleValueFormatTruncate` is 0 - by [@hi-ogawa](https://redirect.github.com/hi-ogawa), Hiroshi Ogawa and Claude Opus 5.5 in [#11485](https://redirect.github.com/vitest-dev/vitest/issues/11485) [<samp>(4f7e1)</samp>](https://redirect.github.com/vitest-dev/vitest/commit/4f7e1799b) - Resolve node builtins in client environments - by [@sheremet-va](https://redirect.github.com/sheremet-va) in [#11417](https://redirect.github.com/vitest-dev/vitest/issues/11417) [<samp>(56b31)</samp>](https://redirect.github.com/vitest-dev/vitest/commit/56b319ac6) - Fix module graph builtin externals after [#11421](https://redirect.github.com/vitest-dev/vitest/issues/11421) - by [@hi-ogawa](https://redirect.github.com/hi-ogawa), Hiroshi Ogawa and Claude Opus 5.5 in [#11491](https://redirect.github.com/vitest-dev/vitest/issues/11491) and [#11421](https://redirect.github.com/vitest-dev/vitest/issues/11421) [<samp>(008e1)</samp>](https://redirect.github.com/vitest-dev/vitest/commit/008e184cb) - Wrap module mocks during in-source testing - by [@sheremet-va](https://redirect.github.com/sheremet-va) in [#11505](https://redirect.github.com/vitest-dev/vitest/issues/11505) [<samp>(36d19)</samp>](https://redirect.github.com/vitest-dev/vitest/commit/36d19cb00) - Handle line endings in snapshot - by [@sheremet-va](https://redirect.github.com/sheremet-va) in [#11522](https://redirect.github.com/vitest-dev/vitest/issues/11522) [<samp>(4c468)</samp>](https://redirect.github.com/vitest-dev/vitest/commit/4c468aa40) - Respect root in projects - by [@sheremet-va](https://redirect.github.com/sheremet-va) in [#11521](https://redirect.github.com/vitest-dev/vitest/issues/11521) [<samp>(26642)</samp>](https://redirect.github.com/vitest-dev/vitest/commit/26642f793) - Resolve mocks in directories with spaces - by [@sheremet-va](https://redirect.github.com/sheremet-va) in [#11539](https://redirect.github.com/vitest-dev/vitest/issues/11539) [<samp>(caaef)</samp>](https://redirect.github.com/vitest-dev/vitest/commit/caaef9416) - api: - Publish the api token atomically - by [@umairnawaz333](https://redirect.github.com/umairnawaz333) in [#11323](https://redirect.github.com/vitest-dev/vitest/issues/11323) [<samp>(6f990)</samp>](https://redirect.github.com/vitest-dev/vitest/commit/6f990fef1) - browser: - Close the mock route interception race - by [@cplieger](https://redirect.github.com/cplieger) and [@sheremet-va](https://redirect.github.com/sheremet-va) in [#8339](https://redirect.github.com/vitest-dev/vitest/issues/8339) and [#11083](https://redirect.github.com/vitest-dev/vitest/issues/11083) [<samp>(d6620)</samp>](https://redirect.github.com/vitest-dev/vitest/commit/d6620fae6) - Allow toHaveTextContent without arguments - by [@nomadical](https://redirect.github.com/nomadical) in [#11425](https://redirect.github.com/vitest-dev/vitest/issues/11425) [<samp>(8ebcf)</samp>](https://redirect.github.com/vitest-dev/vitest/commit/8ebcf5f8a) - Apply API options without browser config - by [@sheremet-va](https://redirect.github.com/sheremet-va) in [#10852](https://redirect.github.com/vitest-dev/vitest/issues/10852) [<samp>(ad055)</samp>](https://redirect.github.com/vitest-dev/vitest/commit/ad055837b) - Preserve undefined command arguments - by [@sheremet-va](https://redirect.github.com/sheremet-va) and [@AriPerkkio](https://redirect.github.com/AriPerkkio) in [#11497](https://redirect.github.com/vitest-dev/vitest/issues/11497) [<samp>(1576d)</samp>](https://redirect.github.com/vitest-dev/vitest/commit/1576d3d89) - Wait for setup mocks before importing a test file - by [@kasperpeulen](https://redirect.github.com/kasperpeulen) in [#11520](https://redirect.github.com/vitest-dev/vitest/issues/11520) [<samp>(b61d1)</samp>](https://redirect.github.com/vitest-dev/vitest/commit/b61d1ced3) - Avoid extra scroll outside the iframe - by [@sheremet-va](https://redirect.github.com/sheremet-va) in [#11523](https://redirect.github.com/vitest-dev/vitest/issues/11523) [<samp>(662e8)</samp>](https://redirect.github.com/vitest-dev/vitest/commit/662e8a363) - Run browser instances as workers - by [@sheremet-va](https://redirect.github.com/sheremet-va) in [#11525](https://redirect.github.com/vitest-dev/vitest/issues/11525) [<samp>(bf04b)</samp>](https://redirect.github.com/vitest-dev/vitest/commit/bf04b9ccc) - ⚠️ This can degrade performance if you have a custom `maxWorkers` setting. Previously, it was applied incorrectly and could lead to Vitest using too many resources. For example, a lower number would still open too many browsers. Fixing it means Vitest opens less instances by default now. - Open one cdp session per tester - by [@sheremet-va](https://redirect.github.com/sheremet-va) in [#11542](https://redirect.github.com/vitest-dev/vitest/issues/11542) [<samp>(69e63)</samp>](https://redirect.github.com/vitest-dev/vitest/commit/69e6369f6) - Clean up unmocked and pending mocks - by [@sheremet-va](https://redirect.github.com/sheremet-va) in [#11537](https://redirect.github.com/vitest-dev/vitest/issues/11537) [<samp>(5c955)</samp>](https://redirect.github.com/vitest-dev/vitest/commit/5c9552173) - coverage: - V8 browser memory leak between test files - by [@AriPerkkio](https://redirect.github.com/AriPerkkio) in [#11466](https://redirect.github.com/vitest-dev/vitest/issues/11466) [<samp>(2297d)</samp>](https://redirect.github.com/vitest-dev/vitest/commit/2297d93a8) - `allowExternal` fails to include uncovered files - by [@AriPerkkio](https://redirect.github.com/AriPerkkio) in [#11513](https://redirect.github.com/vitest-dev/vitest/issues/11513) [<samp>(4ef00)</samp>](https://redirect.github.com/vitest-dev/vitest/commit/4ef000a93) - Filenames containing brackets incorrectly showing as uncovered - by [@AriPerkkio](https://redirect.github.com/AriPerkkio) in [#11531](https://redirect.github.com/vitest-dev/vitest/issues/11531) [<samp>(0fa80)</samp>](https://redirect.github.com/vitest-dev/vitest/commit/0fa80f53c) - Istanbul coverage wrong when module transform warmups - by [@AriPerkkio](https://redirect.github.com/AriPerkkio) in [#11529](https://redirect.github.com/vitest-dev/vitest/issues/11529) [<samp>(9f61d)</samp>](https://redirect.github.com/vitest-dev/vitest/commit/9f61dcca2) - deps: - Update all non-major dependencies - by [@sheremet-va](https://redirect.github.com/sheremet-va) in [#11167](https://redirect.github.com/vitest-dev/vitest/issues/11167) [<samp>(c74e0)</samp>](https://redirect.github.com/vitest-dev/vitest/commit/c74e099a9) - expect: - Fix `Map` and `Set` deep equality in some assertions - by [@hi-ogawa](https://redirect.github.com/hi-ogawa), Hiroshi Ogawa and Claude Opus 5.5 in [#11402](https://redirect.github.com/vitest-dev/vitest/issues/11402) [<samp>(b4e79)</samp>](https://redirect.github.com/vitest-dev/vitest/commit/b4e79fd7a) - Check value in chai-style returned - by [@sheremet-va](https://redirect.github.com/sheremet-va) in [#11500](https://redirect.github.com/vitest-dev/vitest/issues/11500) [<samp>(1aca0)</samp>](https://redirect.github.com/vitest-dev/vitest/commit/1aca02a21) - mocker: - Fix native loader mocking edge cases - by [@sheremet-va](https://redirect.github.com/sheremet-va) in [#11540](https://redirect.github.com/vitest-dev/vitest/issues/11540) [<samp>(cd423)</samp>](https://redirect.github.com/vitest-dev/vitest/commit/cd423ba04) - pretty-format: - Support boxed symbols - by [@lehni](https://redirect.github.com/lehni) in [#11445](https://redirect.github.com/vitest-dev/vitest/issues/11445) and [#11446](https://redirect.github.com/vitest-dev/vitest/issues/11446) [<samp>(eba44)</samp>](https://redirect.github.com/vitest-dev/vitest/commit/eba44926e) - reporters: - Junit to strip ANSI sequences from all XML attributes - by [@meganemura](https://redirect.github.com/meganemura) and Claude Opus 5.5 in [#11407](https://redirect.github.com/vitest-dev/vitest/issues/11407) [<samp>(e1a73)</samp>](https://redirect.github.com/vitest-dev/vitest/commit/e1a731470) - runner: - Don't cache failed fixture setups - by [@hamed-bavar](https://redirect.github.com/hamed-bavar) in [#11237](https://redirect.github.com/vitest-dev/vitest/issues/11237) and [#11238](https://redirect.github.com/vitest-dev/vitest/issues/11238) [<samp>(4ee66)</samp>](https://redirect.github.com/vitest-dev/vitest/commit/4ee66c021) - typecheck: - Use typescript pool in toTestSpecification - by [@sheremet-va](https://redirect.github.com/sheremet-va) in [#11451](https://redirect.github.com/vitest-dev/vitest/issues/11451) [<samp>(5f273)</samp>](https://redirect.github.com/vitest-dev/vitest/commit/5f2739e74) - ui: - Remove duplicate browser-open call opening two tabs - by [@feastyr69](https://redirect.github.com/feastyr69) in [#11356](https://redirect.github.com/vitest-dev/vitest/issues/11356) and [#11358](https://redirect.github.com/vitest-dev/vitest/issues/11358) [<samp>(d7e13)</samp>](https://redirect.github.com/vitest-dev/vitest/commit/d7e1315c1) - Simplify explorer filtering + fix nested tests when search matches a suite - by [@hi-ogawa](https://redirect.github.com/hi-ogawa), Hiroshi Ogawa, Codex and Claude Opus 5.5 in [#11262](https://redirect.github.com/vitest-dev/vitest/issues/11262) [<samp>(a627b)</samp>](https://redirect.github.com/vitest-dev/vitest/commit/a627be498) - Store module graph once per environment - by [@hi-ogawa](https://redirect.github.com/hi-ogawa), Hiroshi Ogawa and Claude Opus 5.5 in [#11421](https://redirect.github.com/vitest-dev/vitest/issues/11421) [<samp>(af903)</samp>](https://redirect.github.com/vitest-dev/vitest/commit/af903c65e) - Mount index.html handler on the ui base path - by [@hi-ogawa](https://redirect.github.com/hi-ogawa), Hiroshi Ogawa and Claude Opus 5.5 in [#11517](https://redirect.github.com/vitest-dev/vitest/issues/11517) [<samp>(1bc24)</samp>](https://redirect.github.com/vitest-dev/vitest/commit/1bc2495c7) - Center split pane resize handle - by [@hi-ogawa](https://redirect.github.com/hi-ogawa), Hiroshi Ogawa and Claude Opus 5.5 in [#11506](https://redirect.github.com/vitest-dev/vitest/issues/11506) [<samp>(e658b)</samp>](https://redirect.github.com/vitest-dev/vitest/commit/e658b9b6a) - vm: - Bind `this` to `module.exports` - by [@sheremet-va](https://redirect.github.com/sheremet-va) in [#11504](https://redirect.github.com/vitest-dev/vitest/issues/11504) [<samp>(b618a)</samp>](https://redirect.github.com/vitest-dev/vitest/commit/b618afd5c) ##### 🏎 Performance - Reuse fsModuleCache when filtering by source - by [@sheremet-va](https://redirect.github.com/sheremet-va) in [#11428](https://redirect.github.com/vitest-dev/vitest/issues/11428) [<samp>(7ebd9)</samp>](https://redirect.github.com/vitest-dev/vitest/commit/7ebd95fdd) - spy: Reset only mocks that were called or reconfigured - by [@johan-gorter](https://redirect.github.com/johan-gorter) and Claude Opus 5.5 in [#11197](https://redirect.github.com/vitest-dev/vitest/issues/11197) [<samp>(28ef9)</samp>](https://redirect.github.com/vitest-dev/vitest/commit/28ef93df2) ##### [View changes on GitHub](https://redirect.github.com/vitest-dev/vitest/compare/v5.0.3...v5.0.4) </details> --- ### Configuration 📅 Schedule: (UTC) - Branch creation - At any time (no schedule defined) - Automerge - At any time (no schedule defined) 🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied. ♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox. 🔕 Ignore: Close this PR and you won't be reminded about these updates again. --- - [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check this box --- This PR was generated by [Mend Renovate](https://mend.io/renovate/). View the [repository job log](https://developer.mend.io/github/authelia/authelia). <!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0NC4xNTYuMyIsInVwZGF0ZWRJblZlciI6IjQ0LjE1Ni4zIiwidGFyZ2V0QnJhbmNoIjoibWFzdGVyIiwibGFiZWxzIjpbImRlcGVuZGVuY2llcyIsImphdmFzY3JpcHQiXX0=--> Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>	2026-10-15 11:33:22 +00:00
renovate[bot]	e08fcd1e9a	build(deps): update nginx docker tag to v1.31.7 (#13460 ) This PR contains the following updates: \| Package \| Update \| Change \| \|---\|---\|---\| \| [nginx](https://hub.docker.com/_/nginx) ([source](https://redirect.github.com/nginx/docker-nginx)) \| patch \| `1.31.6-alpine` → `1.31.7-alpine` \| --- ### Release Notes <details> <summary>nginx/docker-nginx (nginx)</summary> ### [`v1.31.7`](https://redirect.github.com/nginx/docker-nginx/compare/1.31.6...1.31.7) [Compare Source](https://redirect.github.com/nginx/docker-nginx/compare/1.31.6...1.31.7) </details> --- ### Configuration 📅 Schedule: (UTC) - Branch creation - At any time (no schedule defined) - Automerge - At any time (no schedule defined) 🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied. ♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox. 🔕 Ignore: Close this PR and you won't be reminded about these updates again. --- - [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check this box --- This PR was generated by [Mend Renovate](https://mend.io/renovate/). View the [repository job log](https://developer.mend.io/github/authelia/authelia). <!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0NC4xNTYuMyIsInVwZGF0ZWRJblZlciI6IjQ0LjE1Ni4zIiwidGFyZ2V0QnJhbmNoIjoibWFzdGVyIiwibGFiZWxzIjpbImRlcGVuZGVuY2llcyIsImRvY2tlciJdfQ==--> Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>	2026-10-15 08:34:34 +00:00
renovate[bot]	4fc512602d	build(deps): update axllent/mailpit docker tag to v1.31.6 (#13459 ) This PR contains the following updates: \| Package \| Update \| Change \| \|---\|---\|---\| \| [axllent/mailpit](https://mailpit.axllent.org) ([source](https://redirect.github.com/axllent/mailpit)) \| patch \| `v1.31.5` → `v1.31.6` \| --- ### Release Notes <details> <summary>axllent/mailpit</summary> ### [`v1.31.6`](https://redirect.github.com/axllent/mailpit/blob/HEAD/CHANGELOG.md#v1316) [Compare Source](https://redirect.github.com/axllent/mailpit/compare/v1.31.5...v1.31.6) ##### Fix - Remove expired envelope cache entries and clear them on auto-prune ([#748](https://redirect.github.com/axllent/mailpit/issues/748)) </details> --- ### Configuration 📅 Schedule: (UTC) - Branch creation - At any time (no schedule defined) - Automerge - At any time (no schedule defined) 🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied. ♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox. 🔕 Ignore: Close this PR and you won't be reminded about these updates again. --- - [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check this box --- This PR was generated by [Mend Renovate](https://mend.io/renovate/). View the [repository job log](https://developer.mend.io/github/authelia/authelia). <!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0NC4xNTYuMyIsInVwZGF0ZWRJblZlciI6IjQ0LjE1Ni4zIiwidGFyZ2V0QnJhbmNoIjoibWFzdGVyIiwibGFiZWxzIjpbImRlcGVuZGVuY2llcyIsImRvY2tlciJdfQ==--> Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>	2026-10-15 08:34:10 +00:00
renovate[bot]	aaa46b6775	build(deps): update node.js to 6f08a52 (#13457 ) This PR contains the following updates: \| Package \| Type \| Update \| Change \| \|---\|---\|---\|---\| \| [node](https://hub.docker.com/_/node) ([source](https://redirect.github.com/nodejs/node)) \| final \| digest \| `143494b` → `6f08a52` \| \| [node](https://hub.docker.com/_/node) ([source](https://redirect.github.com/nodejs/node)) \| stage \| digest \| `143494b` → `6f08a52` \| --- ### Configuration 📅 Schedule: (UTC) - Branch creation - At any time (no schedule defined) - Automerge - At any time (no schedule defined) 🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied. ♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox. 🔕 Ignore: Close this PR and you won't be reminded about these updates again. --- - [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check this box --- This PR was generated by [Mend Renovate](https://mend.io/renovate/). View the [repository job log](https://developer.mend.io/github/authelia/authelia). <!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0NC4xNTYuMyIsInVwZGF0ZWRJblZlciI6IjQ0LjE1Ni4zIiwidGFyZ2V0QnJhbmNoIjoibWFzdGVyIiwibGFiZWxzIjpbImRlcGVuZGVuY2llcyIsImRvY2tlciJdfQ==--> Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>	2026-10-15 04:31:16 +00:00
renovate[bot]	3fb19cc8b2	build(deps): update haproxy docker tag to v3.4.7 (#13458 ) This PR contains the following updates: \| Package \| Type \| Update \| Change \| \|---\|---\|---\|---\| \| [haproxy](https://hub.docker.com/_/haproxy) ([source](https://redirect.github.com/docker-library/haproxy)) \| final \| patch \| `3.4.6-alpine` → `3.4.7-alpine` \| --- ### Configuration 📅 Schedule: (UTC) - Branch creation - At any time (no schedule defined) - Automerge - At any time (no schedule defined) 🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied. ♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox. 🔕 Ignore: Close this PR and you won't be reminded about this update again. --- - [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check this box --- This PR was generated by [Mend Renovate](https://mend.io/renovate/). View the [repository job log](https://developer.mend.io/github/authelia/authelia). <!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0NC4xNTYuMyIsInVwZGF0ZWRJblZlciI6IjQ0LjE1Ni4zIiwidGFyZ2V0QnJhbmNoIjoibWFzdGVyIiwibGFiZWxzIjpbImRlcGVuZGVuY2llcyIsImRvY2tlciJdfQ==--> Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>	2026-10-15 04:30:20 +00:00
renovate[bot]	3045057c73	build(deps): update typescript-eslint monorepo to v8.71.2 (#13456 ) This PR contains the following updates: \| Package \| Change \| [Age](https://docs.renovatebot.com/merge-confidence/) \| [Confidence](https://docs.renovatebot.com/merge-confidence/) \| \|---\|---\|---\|---\| \| [@typescript-eslint/eslint-plugin](https://typescript-eslint.io/packages/eslint-plugin) ([source](https://redirect.github.com/typescript-eslint/typescript-eslint/tree/HEAD/packages/eslint-plugin)) \| [`8.71.1` → `8.71.2`](https://renovatebot.com/diffs/npm/@typescript-eslint%2feslint-plugin/8.71.1/8.71.2) \| ![age](https://developer.mend.io/api/mc/badges/age/npm/@typescript-eslint%2feslint-plugin/8.71.2?slim=true) \| ![confidence](https://developer.mend.io/api/mc/badges/confidence/npm/@typescript-eslint%2feslint-plugin/8.71.1/8.71.2?slim=true) \| \| [@typescript-eslint/parser](https://typescript-eslint.io/packages/parser) ([source](https://redirect.github.com/typescript-eslint/typescript-eslint/tree/HEAD/packages/parser)) \| [`8.71.1` → `8.71.2`](https://renovatebot.com/diffs/npm/@typescript-eslint%2fparser/8.71.1/8.71.2) \| ![age](https://developer.mend.io/api/mc/badges/age/npm/@typescript-eslint%2fparser/8.71.2?slim=true) \| ![confidence](https://developer.mend.io/api/mc/badges/confidence/npm/@typescript-eslint%2fparser/8.71.1/8.71.2?slim=true) \| --- ### Release Notes <details> <summary>typescript-eslint/typescript-eslint (@typescript-eslint/eslint-plugin)</summary> ### [`v8.71.2`](https://redirect.github.com/typescript-eslint/typescript-eslint/blob/HEAD/packages/eslint-plugin/CHANGELOG.md#8712-2026-10-12) [Compare Source](https://redirect.github.com/typescript-eslint/typescript-eslint/compare/v8.71.1...v8.71.2) ##### 🩹 Fixes - eslint-plugin: \[prefer-optional-chain] safe fix when the chain ends with a strict null comparison ([#12805](https://redirect.github.com/typescript-eslint/typescript-eslint/pull/12805)) - eslint-plugin: \[no-unnecessary-type-parameters] parenthesize constraint in optional tuple elements ([#12995](https://redirect.github.com/typescript-eslint/typescript-eslint/pull/12995)) - eslint-plugin: \[no-unused-vars] ignore type-only refs for after-used ([#12977](https://redirect.github.com/typescript-eslint/typescript-eslint/pull/12977)) - eslint-plugin: \[no-unnecessary-type-parameters] count instantiated mapped type templates ([#12974](https://redirect.github.com/typescript-eslint/typescript-eslint/pull/12974)) - eslint-plugin: \[no-unused-vars] avoid false-positives when not using our parser ([#12989](https://redirect.github.com/typescript-eslint/typescript-eslint/pull/12989)) ##### ❤️ Thank You - Abraham Guo - Brad Zacher [@bradzacher](https://redirect.github.com/bradzacher) - Josh Goldberg - Vinccool96 - Younsang Na [@nayounsang](https://redirect.github.com/nayounsang) See [GitHub Releases](https://redirect.github.com/typescript-eslint/typescript-eslint/releases/tag/v8.71.2) for more information. You can read about our [versioning strategy](https://typescript-eslint.io/users/versioning) and [releases](https://typescript-eslint.io/users/releases) on our website. </details> <details> <summary>typescript-eslint/typescript-eslint (@typescript-eslint/parser)</summary> ### [`v8.71.2`](https://redirect.github.com/typescript-eslint/typescript-eslint/blob/HEAD/packages/parser/CHANGELOG.md#8712-2026-10-12) [Compare Source](https://redirect.github.com/typescript-eslint/typescript-eslint/compare/v8.71.1...v8.71.2) This was a version bump only for parser to align it with other projects, there were no code changes. See [GitHub Releases](https://redirect.github.com/typescript-eslint/typescript-eslint/releases/tag/v8.71.2) for more information. You can read about our [versioning strategy](https://typescript-eslint.io/users/versioning) and [releases](https://typescript-eslint.io/users/releases) on our website. </details> --- ### Configuration 📅 Schedule: (UTC) - Branch creation - At any time (no schedule defined) - Automerge - At any time (no schedule defined) 🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied. ♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox. 🔕 Ignore: Close this PR and you won't be reminded about these updates again. --- - [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check this box --- This PR was generated by [Mend Renovate](https://mend.io/renovate/). View the [repository job log](https://developer.mend.io/github/authelia/authelia). <!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0NC4xNTYuMyIsInVwZGF0ZWRJblZlciI6IjQ0LjE1Ni4zIiwidGFyZ2V0QnJhbmNoIjoibWFzdGVyIiwibGFiZWxzIjpbImRlcGVuZGVuY2llcyIsImphdmFzY3JpcHQiXX0=--> Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>	2026-10-14 20:49:13 +00:00
renovate[bot]	3359b4b6ea	build(deps): update openid conformance suite to release-v5.3.3 (#13455 ) This PR contains the following updates: \| Package \| Type \| Update \| Change \| \|---\|---\|---\|---\| \| [openid/conformance-suite](https://gitlab.com/openid/conformance-suite) \| \| patch \| `release-v5.3.2` → `release-v5.3.3` \| \| registry.gitlab.com/openid/conformance-suite \| final \| patch \| `release-v5.3.2` → `release-v5.3.3` \| --- ### Release Notes <details> <summary>openid/conformance-suite</summary> ### [`vrelease-v5.3.3`](https://gitlab.com/openid/conformance-suite/tags/release-v5.3.3) [Compare Source](https://gitlab.com/openid/conformance-suite/compare/release-v5.3.2...release-v5.3.3) ![OpenID Logo](https://openid.net/wp-content/uploads/2024/09/openid_white_320.png) Release date: 2026-10-14 ##### Test changes - !2332 - FAPI1/2/CIBA: Accept a connection closed without a response as a TLS rejection - !2334 - Publish decoy JWKs instead of letting SetRsaAltServerJwks discard them - !2333 - Add OID4VP wallet test for a DCQL claim the credential lacks - !2330 - Warn under HAIP when credential digests do not use SHA-256 - !2327 - VCI: Validate the typ of the client attestation and its PoP - !2336 - VCI wallet: warn on several proofs when batch issuance is not advertised - !2338 - VCI wallet: check the requested scope names a credential configuration ##### Bug fixes - !2312 - Stop Safari users getting redirected to apple-touch-icon after login - !2326 - Fix UI additions/fixes not becoming visible to users until they explicitly reload pages - !2329 - Finish a placeholder-waiting test as soon as its screenshot is uploaded - !2331 - VP and VCI: correct test summaries that describe the wrong behaviour - !2337 - VP/VCI: Fix modules being offered for combinations they're not valid for - !2344 - Omit consent businessEntity when CNPJ is empty ##### Other - !2328 - Add summary results on the plan page (admins only currently) - !2347 - Bump version to 5.3.3 </details> --- ### Configuration 📅 Schedule: (UTC) - Branch creation - At any time (no schedule defined) - Automerge - At any time (no schedule defined) 🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied. ♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox. 🔕 Ignore: Close this PR and you won't be reminded about these updates again. --- - [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check this box --- This PR was generated by [Mend Renovate](https://mend.io/renovate/). View the [repository job log](https://developer.mend.io/github/authelia/authelia). <!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0NC4xNTYuMyIsInVwZGF0ZWRJblZlciI6IjQ0LjE1Ni4zIiwidGFyZ2V0QnJhbmNoIjoibWFzdGVyIiwibGFiZWxzIjpbImRlcGVuZGVuY2llcyIsImRvY2tlciJdfQ==--> Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>	2026-10-14 20:48:55 +00:00
renovate[bot]	a23c9db3cd	build(deps): update dependency prettier to v3.9.10 (#13451 ) This PR contains the following updates: \| Package \| Change \| [Age](https://docs.renovatebot.com/merge-confidence/) \| [Confidence](https://docs.renovatebot.com/merge-confidence/) \| \|---\|---\|---\|---\| \| [prettier](https://prettier.io) ([source](https://redirect.github.com/prettier/prettier)) \| [`3.9.9` → `3.9.10`](https://renovatebot.com/diffs/npm/prettier/3.9.9/3.9.10) \| ![age](https://developer.mend.io/api/mc/badges/age/npm/prettier/3.9.10?slim=true) \| ![confidence](https://developer.mend.io/api/mc/badges/confidence/npm/prettier/3.9.9/3.9.10?slim=true) \| --- ### Release Notes <details> <summary>prettier/prettier (prettier)</summary> ### [`v3.9.10`](https://redirect.github.com/prettier/prettier/blob/HEAD/CHANGELOG.md#3910) [Compare Source](https://redirect.github.com/prettier/prettier/compare/3.9.9...3.9.10) [diff](https://redirect.github.com/prettier/prettier/compare/3.9.9...3.9.10) ##### Markdown: Update `micromark-extension-gfm-table` to fix the table parse issue on performance ([#20266](https://redirect.github.com/prettier/prettier/pull/20266) by [@fisker](https://redirect.github.com/fisker)) See [micromark/micromark-extension-gfm-table@`4f43ead`](https://redirect.github.com/micromark/micromark-extension-gfm-table/commit/4f43ead37b786bc531d924530d4ab4c714886267) for details. </details> --- ### Configuration 📅 Schedule: (UTC) - Branch creation - At any time (no schedule defined) - Automerge - At any time (no schedule defined) 🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied. ♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox. 🔕 Ignore: Close this PR and you won't be reminded about this update again. --- - [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check this box --- This PR was generated by [Mend Renovate](https://mend.io/renovate/). View the [repository job log](https://developer.mend.io/github/authelia/authelia). <!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0NC4xNTYuMyIsInVwZGF0ZWRJblZlciI6IjQ0LjE1Ni4zIiwidGFyZ2V0QnJhbmNoIjoibWFzdGVyIiwibGFiZWxzIjpbImRlcGVuZGVuY2llcyIsImphdmFzY3JpcHQiXX0=--> Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>	2026-10-14 20:48:28 +00:00
renovate[bot]	e74e9426af	build(deps): update dependency happy-dom to v20.14.6 (#13428 ) This PR contains the following updates: \| Package \| Change \| [Age](https://docs.renovatebot.com/merge-confidence/) \| [Confidence](https://docs.renovatebot.com/merge-confidence/) \| \|---\|---\|---\|---\| \| [happy-dom](https://redirect.github.com/capricorn86/happy-dom) \| [`20.14.5` → `20.14.6`](https://renovatebot.com/diffs/npm/happy-dom/20.14.5/20.14.6) \| ![age](https://developer.mend.io/api/mc/badges/age/npm/happy-dom/20.14.6?slim=true) \| ![confidence](https://developer.mend.io/api/mc/badges/confidence/npm/happy-dom/20.14.5/20.14.6?slim=true) \| --- ### Release Notes <details> <summary>capricorn86/happy-dom (happy-dom)</summary> ### [`v20.14.6`](https://redirect.github.com/capricorn86/happy-dom/releases/tag/v20.14.6) [Compare Source](https://redirect.github.com/capricorn86/happy-dom/compare/v20.14.5...v20.14.6) ##### 👷‍♂️ Patch fixes - Fixes cookie scope forgery vulnerability - By [@capricorn86](https://redirect.github.com/capricorn86) </details> --- ### Configuration 📅 Schedule: (UTC) - Branch creation - At any time (no schedule defined) - Automerge - At any time (no schedule defined) 🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied. ♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox. 🔕 Ignore: Close this PR and you won't be reminded about this update again. --- - [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check this box --- This PR was generated by [Mend Renovate](https://mend.io/renovate/). View the [repository job log](https://developer.mend.io/github/authelia/authelia). <!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0NC4xMzQuMSIsInVwZGF0ZWRJblZlciI6IjQ0LjEzNC4xIiwidGFyZ2V0QnJhbmNoIjoibWFzdGVyIiwibGFiZWxzIjpbImRlcGVuZGVuY2llcyIsImphdmFzY3JpcHQiXX0=--> Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>	2026-10-14 20:48:21 +00:00
renovate[bot]	f39fc5745d	build(deps): update envoyproxy/envoy docker tag to v1.39.4 (#13453 ) This PR contains the following updates: \| Package \| Update \| Change \| \|---\|---\|---\| \| envoyproxy/envoy \| patch \| `v1.39.3` → `v1.39.4` \| --- ### Configuration 📅 Schedule: (UTC) - Branch creation - At any time (no schedule defined) - Automerge - At any time (no schedule defined) 🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied. ♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox. 🔕 Ignore: Close this PR and you won't be reminded about this update again. --- - [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check this box --- This PR was generated by [Mend Renovate](https://mend.io/renovate/). View the [repository job log](https://developer.mend.io/github/authelia/authelia). <!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0NC4xNTYuMyIsInVwZGF0ZWRJblZlciI6IjQ0LjE1Ni4zIiwidGFyZ2V0QnJhbmNoIjoibWFzdGVyIiwibGFiZWxzIjpbImRlcGVuZGVuY2llcyIsImRvY2tlciJdfQ==--> Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>	2026-10-14 20:32:55 +00:00
renovate[bot]	f3abc23321	build(deps): update authelia/base:latest docker digest to bbaa1de (#13450 ) This PR contains the following updates: \| Package \| Type \| Update \| Change \| \|---\|---\|---\|---\| \| authelia/base \| final \| digest \| `9ad873f` → `bbaa1de` \| --- ### Configuration 📅 Schedule: (UTC) - Branch creation - At any time (no schedule defined) - Automerge - At any time (no schedule defined) 🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied. ♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox. 🔕 Ignore: Close this PR and you won't be reminded about this update again. --- - [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check this box --- This PR was generated by [Mend Renovate](https://mend.io/renovate/). View the [repository job log](https://developer.mend.io/github/authelia/authelia). <!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0NC4xNTYuMyIsInVwZGF0ZWRJblZlciI6IjQ0LjE1Ni4zIiwidGFyZ2V0QnJhbmNoIjoibWFzdGVyIiwibGFiZWxzIjpbImRlcGVuZGVuY2llcyIsImRvY2tlciJdfQ==--> Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>	2026-10-14 20:32:19 +00:00
renovate[bot]	3863d84155	build(deps): update dependency eslint-plugin-prettier to v5.5.7 (#13452 ) This PR contains the following updates: \| Package \| Change \| [Age](https://docs.renovatebot.com/merge-confidence/) \| [Confidence](https://docs.renovatebot.com/merge-confidence/) \| \|---\|---\|---\|---\| \| [eslint-plugin-prettier](https://redirect.github.com/prettier/eslint-plugin-prettier) \| [`5.5.6` → `5.5.7`](https://renovatebot.com/diffs/npm/eslint-plugin-prettier/5.5.6/5.5.7) \| ![age](https://developer.mend.io/api/mc/badges/age/npm/eslint-plugin-prettier/5.5.7?slim=true) \| ![confidence](https://developer.mend.io/api/mc/badges/confidence/npm/eslint-plugin-prettier/5.5.6/5.5.7?slim=true) \| --- ### Release Notes <details> <summary>prettier/eslint-plugin-prettier (eslint-plugin-prettier)</summary> ### [`v5.5.7`](https://redirect.github.com/prettier/eslint-plugin-prettier/blob/HEAD/CHANGELOG.md#557) [Compare Source](https://redirect.github.com/prettier/eslint-plugin-prettier/compare/v5.5.6...v5.5.7) ##### Patch Changes - [#796](https://redirect.github.com/prettier/eslint-plugin-prettier/pull/796) [`7e53ecd`](https://redirect.github.com/prettier/eslint-plugin-prettier/commit/7e53ecd882fe6f0f74150cb0a539776b64182b3e) Thanks [@OskarEichler](https://redirect.github.com/OskarEichler)! - Fix fallback diagnostic locations for all supported line endings. - [#805](https://redirect.github.com/prettier/eslint-plugin-prettier/pull/805) [`1b7c433`](https://redirect.github.com/prettier/eslint-plugin-prettier/commit/1b7c43322ce0eb3ee7495d91481613d39d97af52) Thanks [@JounQin](https://redirect.github.com/JounQin)! - Report a clear error when the sync worker fails to load, so a missing `prettier` dependency now fails fast with `Cannot find package 'prettier'` instead of hanging ESLint indefinitely. </details> --- ### Configuration 📅 Schedule: (UTC) - Branch creation - At any time (no schedule defined) - Automerge - At any time (no schedule defined) 🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied. ♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox. 🔕 Ignore: Close this PR and you won't be reminded about this update again. --- - [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check this box --- This PR was generated by [Mend Renovate](https://mend.io/renovate/). View the [repository job log](https://developer.mend.io/github/authelia/authelia). <!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0NC4xNTYuMyIsInVwZGF0ZWRJblZlciI6IjQ0LjE1Ni4zIiwidGFyZ2V0QnJhbmNoIjoibWFzdGVyIiwibGFiZWxzIjpbImRlcGVuZGVuY2llcyIsImphdmFzY3JpcHQiXX0=--> Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>	2026-10-14 20:31:58 +00:00
renovate[bot]	92425402f4	build(deps): update dependency postcss to v8.5.30 (#13449 ) This PR contains the following updates: \| Package \| Change \| [Age](https://docs.renovatebot.com/merge-confidence/) \| [Confidence](https://docs.renovatebot.com/merge-confidence/) \| \|---\|---\|---\|---\| \| [postcss](https://postcss.org/) ([source](https://redirect.github.com/postcss/postcss)) \| [`8.5.29` → `8.5.30`](https://renovatebot.com/diffs/npm/postcss/8.5.29/8.5.30) \| ![age](https://developer.mend.io/api/mc/badges/age/npm/postcss/8.5.30?slim=true) \| ![confidence](https://developer.mend.io/api/mc/badges/confidence/npm/postcss/8.5.29/8.5.30?slim=true) \| --- ### Release Notes <details> <summary>postcss/postcss (postcss)</summary> ### [`v8.5.30`](https://redirect.github.com/postcss/postcss/blob/HEAD/CHANGELOG.md#8530) [Compare Source](https://redirect.github.com/postcss/postcss/compare/8.5.29...8.5.30) - Fix broken map on `</style>` escaping (by [@Rufflet](https://redirect.github.com/Rufflet)). </details> --- ### Configuration 📅 Schedule: (UTC) - Branch creation - At any time (no schedule defined) - Automerge - At any time (no schedule defined) 🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied. ♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox. 🔕 Ignore: Close this PR and you won't be reminded about these updates again. --- - [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check this box --- This PR was generated by [Mend Renovate](https://mend.io/renovate/). View the [repository job log](https://developer.mend.io/github/authelia/authelia). <!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0NC4xNTYuMyIsInVwZGF0ZWRJblZlciI6IjQ0LjE1Ni4zIiwidGFyZ2V0QnJhbmNoIjoibWFzdGVyIiwibGFiZWxzIjpbImRlcGVuZGVuY2llcyIsImphdmFzY3JpcHQiXX0=--> Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>	2026-10-14 12:55:53 +00:00
renovate[bot]andAmir Zarrinkafsh	b20833cc7e	build(deps): update authelia/base:latest docker digest to 9ad873f (#13436 ) This PR contains the following updates: \| Package \| Type \| Update \| Change \| \|---\|---\|---\|---\| \| authelia/base \| final \| digest \| `80f157f` → `9ad873f` \| --- ### Configuration 📅 Schedule: (UTC) - Branch creation - At any time (no schedule defined) - Automerge - At any time (no schedule defined) 🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied. ♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox. 🔕 Ignore: Close this PR and you won't be reminded about this update again. --- - [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check this box --- This PR was generated by [Mend Renovate](https://mend.io/renovate/). View the [repository job log](https://developer.mend.io/github/authelia/authelia). <!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0NC4xMzQuMSIsInVwZGF0ZWRJblZlciI6IjQ0LjE1NS4yIiwidGFyZ2V0QnJhbmNoIjoibWFzdGVyIiwibGFiZWxzIjpbImRlcGVuZGVuY2llcyIsImRvY2tlciJdfQ==--> Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com> Co-authored-by: Amir Zarrinkafsh <3339418+nightah@users.noreply.github.com>	2026-10-14 12:55:06 +00:00
renovate[bot]andAmir Zarrinkafsh	d0d2d26dd1	build(deps): update dependency vite to v8.3.4 (#13429 ) This PR contains the following updates: \| Package \| Change \| [Age](https://docs.renovatebot.com/merge-confidence/) \| [Confidence](https://docs.renovatebot.com/merge-confidence/) \| \|---\|---\|---\|---\| \| [vite](https://vite.dev) ([source](https://redirect.github.com/vitejs/vite/tree/HEAD/packages/vite)) \| [`8.3.3` → `8.3.4`](https://renovatebot.com/diffs/npm/vite/8.3.3/8.3.4) \| ![age](https://developer.mend.io/api/mc/badges/age/npm/vite/8.3.4?slim=true) \| ![confidence](https://developer.mend.io/api/mc/badges/confidence/npm/vite/8.3.3/8.3.4?slim=true) \| --- ### Release Notes <details> <summary>vitejs/vite (vite)</summary> ### [`v8.3.4`](https://redirect.github.com/vitejs/vite/blob/HEAD/packages/vite/CHANGELOG.md#small-834-2026-10-08-small) [Compare Source](https://redirect.github.com/vitejs/vite/compare/v8.3.3...v8.3.4) ##### Features - bundled-dev: support `import.meta.hot.acceptExports` ([#23463](https://redirect.github.com/vitejs/vite/issues/23463)) ([bc0f21c](https://redirect.github.com/vitejs/vite/commit/bc0f21c56a2e003a4d2dd23ccb9da3ec8c706c4e)) ##### Bug Fixes - avoid mutating hmr defaults (fix [#23575](https://redirect.github.com/vitejs/vite/issues/23575)) ([#23576](https://redirect.github.com/vitejs/vite/issues/23576)) ([574d5e3](https://redirect.github.com/vitejs/vite/commit/574d5e351905fe99891364d03c2440531378f7fd)) - build: correct preloads when chunkImportMap is enabled with non-root base ([#23698](https://redirect.github.com/vitejs/vite/issues/23698)) ([2a8c0f0](https://redirect.github.com/vitejs/vite/commit/2a8c0f05c76e35c43ab3560984a5103c8db8dbcd)) - build: wait for in-flight stylesheets in preload helper (fix [#23652](https://redirect.github.com/vitejs/vite/issues/23652)) ([#23662](https://redirect.github.com/vitejs/vite/issues/23662)) ([036b745](https://redirect.github.com/vitejs/vite/commit/036b74599b2fe1d8c61475371b856ceb88d26963)) - bundled-dev: serve `/@vite/client` and stub `@vite/env` ([#23664](https://redirect.github.com/vitejs/vite/issues/23664)) ([5afc5a8](https://redirect.github.com/vitejs/vite/commit/5afc5a8876624888fc1e8f43fed1c85c4b0e830b)) - client: skip rewriting unchanged adopted styles ([#23697](https://redirect.github.com/vitejs/vite/issues/23697)) ([fa71469](https://redirect.github.com/vitejs/vite/commit/fa7146938b0ca703653c90c20907191a01c032ba)) - css: resolve imported preprocessors from their file path with lightningcss ([#23688](https://redirect.github.com/vitejs/vite/issues/23688)) ([cf52011](https://redirect.github.com/vitejs/vite/commit/cf52011c46409a4a45f3d74bba631b8f005c4bc9)) - deps: update all non-major dependencies ([#23648](https://redirect.github.com/vitejs/vite/issues/23648)) ([8a4c19c](https://redirect.github.com/vitejs/vite/commit/8a4c19cfc035f2dd203f2fa6d00ab9256a5e77c9)) - deps: update rolldown-related dependencies ([#23649](https://redirect.github.com/vitejs/vite/issues/23649)) ([794516d](https://redirect.github.com/vitejs/vite/commit/794516d50cff80e405bc9b3e5faac1c82987566c)) - dev: a restart requested during a restart used to be dropped (fix [#23392](https://redirect.github.com/vitejs/vite/issues/23392)) ([#23484](https://redirect.github.com/vitejs/vite/issues/23484)) ([70d56ea](https://redirect.github.com/vitejs/vite/commit/70d56ea1848909edab416934f3f68ce14343eb73)) - don't treat modules ending with js-like query as js ([#23687](https://redirect.github.com/vitejs/vite/issues/23687)) ([fcb6f12](https://redirect.github.com/vitejs/vite/commit/fcb6f1252a95857823d935f98554b938888d41a0)) - html: avoid adding filesystem root to watcher ([#23689](https://redirect.github.com/vitejs/vite/issues/23689)) ([3a7f2ae](https://redirect.github.com/vitejs/vite/commit/3a7f2aea757d59bae66ad6edf6b321d26a7e6778)) - html: skip caching CSS of chunks in a cycle (fix [#23628](https://redirect.github.com/vitejs/vite/issues/23628)) ([#23636](https://redirect.github.com/vitejs/vite/issues/23636)) ([15d82f7](https://redirect.github.com/vitejs/vite/commit/15d82f7dc679ab9c18d5ce2c3711157c2365ddd1)) - optimizer: scan deep imports with custom extensions ([#23678](https://redirect.github.com/vitejs/vite/issues/23678)) ([8579189](https://redirect.github.com/vitejs/vite/commit/8579189bae8626b6ddab55a09325e209d62e027e)) - remove input option unescaping for now ([#23694](https://redirect.github.com/vitejs/vite/issues/23694)) ([facc2fb](https://redirect.github.com/vitejs/vite/commit/facc2fb1fffce03d9e2dd7011d0bd0eeddc7d0f6)) - server: match static aliases on path boundaries ([#23643](https://redirect.github.com/vitejs/vite/issues/23643)) ([b28db28](https://redirect.github.com/vitejs/vite/commit/b28db28e9e62d9866a9a0f1b22e74589cc180577)) - watcher: normalize file before root check in `ensureWatchedFile` ([#23673](https://redirect.github.com/vitejs/vite/issues/23673)) ([12bb28c](https://redirect.github.com/vitejs/vite/commit/12bb28c22379c8d2fe90088fa0eefbfa2ab3fb80)) ##### Performance Improvements - module-runner: skip cloning call sites that have no source map ([#23646](https://redirect.github.com/vitejs/vite/issues/23646)) ([3d67486](https://redirect.github.com/vitejs/vite/commit/3d674869a50a0bca84a8cc8dc55bd35d57100e37)) ##### Code Refactoring - bundled-dev: import CSS HMR helpers from `/@vite/client` ([#23674](https://redirect.github.com/vitejs/vite/issues/23674)) ([182f5b2](https://redirect.github.com/vitejs/vite/commit/182f5b2a65391da5bee05f9c3df1aeb3794e98d9)) </details> --- ### Configuration 📅 Schedule: (UTC) - Branch creation - At any time (no schedule defined) - Automerge - At any time (no schedule defined) 🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied. ♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox. 🔕 Ignore: Close this PR and you won't be reminded about these updates again. --- - [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check this box --- This PR was generated by [Mend Renovate](https://mend.io/renovate/). View the [repository job log](https://developer.mend.io/github/authelia/authelia). <!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0NC4xMzQuMSIsInVwZGF0ZWRJblZlciI6IjQ0LjEzNC4xIiwidGFyZ2V0QnJhbmNoIjoibWFzdGVyIiwibGFiZWxzIjpbImRlcGVuZGVuY2llcyIsImphdmFzY3JpcHQiXX0=--> Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com> Co-authored-by: Amir Zarrinkafsh <3339418+nightah@users.noreply.github.com>	2026-10-14 12:51:56 +00:00
renovate[bot]	47531860eb	build(deps): update dependency lefthook to v2.2.2 (#13448 ) This PR contains the following updates: \| Package \| Change \| [Age](https://docs.renovatebot.com/merge-confidence/) \| [Confidence](https://docs.renovatebot.com/merge-confidence/) \| \|---\|---\|---\|---\| \| [lefthook](https://redirect.github.com/evilmartians/lefthook) \| [`2.2.1` → `2.2.2`](https://renovatebot.com/diffs/npm/lefthook/2.2.1/2.2.2) \| ![age](https://developer.mend.io/api/mc/badges/age/npm/lefthook/2.2.2?slim=true) \| ![confidence](https://developer.mend.io/api/mc/badges/confidence/npm/lefthook/2.2.1/2.2.2?slim=true) \| --- ### Release Notes <details> <summary>evilmartians/lefthook (lefthook)</summary> ### [`v2.2.2`](https://redirect.github.com/evilmartians/lefthook/blob/HEAD/CHANGELOG.md#222) [Compare Source](https://redirect.github.com/evilmartians/lefthook/compare/v2.2.1...v2.2.2) - fix: cleanup only current stash hash ([#1597](https://redirect.github.com/evilmartians/lefthook/pull/1597)) by [@mrexox](https://redirect.github.com/mrexox) - refactor: simplify mimetype matching ([#1596](https://redirect.github.com/evilmartians/lefthook/pull/1596)) by [@scop](https://redirect.github.com/scop) - packaging: add support for android ([#1591](https://redirect.github.com/evilmartians/lefthook/pull/1591)) by [@mrexox](https://redirect.github.com/mrexox) </details> --- ### Configuration 📅 Schedule: (UTC) - Branch creation - At any time (no schedule defined) - Automerge - At any time (no schedule defined) 🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied. ♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox. 🔕 Ignore: Close this PR and you won't be reminded about this update again. --- - [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check this box --- This PR was generated by [Mend Renovate](https://mend.io/renovate/). View the [repository job log](https://developer.mend.io/github/authelia/authelia). <!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0NC4xNTYuMyIsInVwZGF0ZWRJblZlciI6IjQ0LjE1Ni4zIiwidGFyZ2V0QnJhbmNoIjoibWFzdGVyIiwibGFiZWxzIjpbImRlcGVuZGVuY2llcyIsImphdmFzY3JpcHQiXX0=--> Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>	2026-10-14 12:50:19 +00:00
renovate[bot]	6b95529a69	build(deps): update dependency @types/node to v26.6.5 (#13444 ) This PR contains the following updates: \| Package \| Change \| [Age](https://docs.renovatebot.com/merge-confidence/) \| [Confidence](https://docs.renovatebot.com/merge-confidence/) \| \|---\|---\|---\|---\| \| [@types/node](https://redirect.github.com/DefinitelyTyped/DefinitelyTyped/tree/master/types/node) ([source](https://redirect.github.com/DefinitelyTyped/DefinitelyTyped/tree/HEAD/types/node)) \| [`26.6.4` → `26.6.5`](https://renovatebot.com/diffs/npm/@types%2fnode/26.6.4/26.6.5) \| ![age](https://developer.mend.io/api/mc/badges/age/npm/@types%2fnode/26.6.5?slim=true) \| ![confidence](https://developer.mend.io/api/mc/badges/confidence/npm/@types%2fnode/26.6.4/26.6.5?slim=true) \| --- ### Configuration 📅 Schedule: (UTC) - Branch creation - At any time (no schedule defined) - Automerge - At any time (no schedule defined) 🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied. ♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox. 🔕 Ignore: Close this PR and you won't be reminded about this update again. --- - [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check this box --- This PR was generated by [Mend Renovate](https://mend.io/renovate/). View the [repository job log](https://developer.mend.io/github/authelia/authelia). <!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0NC4xNTUuMiIsInVwZGF0ZWRJblZlciI6IjQ0LjE1NS4yIiwidGFyZ2V0QnJhbmNoIjoibWFzdGVyIiwibGFiZWxzIjpbImRlcGVuZGVuY2llcyIsImphdmFzY3JpcHQiXX0=--> Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>	2026-10-14 12:39:51 +00:00
renovate[bot]	ee5198a99b	build(deps): update dependency i18next to v26.4.4 (#13447 ) This PR contains the following updates: \| Package \| Change \| [Age](https://docs.renovatebot.com/merge-confidence/) \| [Confidence](https://docs.renovatebot.com/merge-confidence/) \| \|---\|---\|---\|---\| \| [i18next](https://www.i18next.com) ([source](https://redirect.github.com/i18next/i18next)) \| [`26.4.2` → `26.4.4`](https://renovatebot.com/diffs/npm/i18next/26.4.2/26.4.4) \| ![age](https://developer.mend.io/api/mc/badges/age/npm/i18next/26.4.4?slim=true) \| ![confidence](https://developer.mend.io/api/mc/badges/confidence/npm/i18next/26.4.2/26.4.4?slim=true) \| --- ### Release Notes <details> <summary>i18next/i18next (i18next)</summary> ### [`v26.4.4`](https://redirect.github.com/i18next/i18next/blob/HEAD/CHANGELOG.md#2644) [Compare Source](https://redirect.github.com/i18next/i18next/compare/v26.4.3...v26.4.4) - fix(security): the nesting regexp no longer backtracks exponentially (ReDoS) on an unclosed `$t(`. Its repeated group had overlapping alternatives (`[^()"']+` inside `(?:...)?`, and inside parentheses `[^()]` also matched quotes), so a string containing `$t(` without a closing `)` made the engine try every way to split the text: about 2x the runtime per extra character, and a \~25 character value hung `t()` for minutes. With the default config this was reachable through any interpolated value (`t('greet', { name: '$t(aaaaaaaaaaaaaaaaaaaaaaaa' })`): escaping does not touch `$`, `t` or `(`, and the `skipOnVariables` check runs the regexp on the interpolated result, so `nest: false` did not help either. Every alternative now starts with a different character (plain char, `"`, `'` or `(`), so there is only one way to match and the cost is linear. Quoted strings and one level of parentheses in nesting options keep working ([#2336](https://redirect.github.com/i18next/i18next/issues/2336)). The only difference: a lone `"` or `'` inside unquoted parentheses within `$t(...)` is no longer matched. Affects 25.3.3 to 26.4.3. See advisory [GHSA-5jr9-983r-c8x4](https://redirect.github.com/i18next/i18next/security/advisories/GHSA-5jr9-983r-c8x4), CVSS 7.5 (`CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H`). Thanks to Anisetti Chaitanya Eshwar Prasad for the responsible disclosure. - fix(security): `nest()` now resolves `$t(...)` in a single pass and no longer nests text that came out of a resolved value. Every nested lookup reset the shared nesting regexp, so the loop started over from the beginning of the string after each match. That had two effects. First, a `$t(...)` inside a variable that the nested lookup deliberately kept literal (default `skipOnVariables: true`) was resolved anyway by the outer loop: with `outer: 'A $t(inner) B'` and `inner: 'Hi {{name}}'`, `t('outer', { name: '$t(secret)' })` rendered the `secret` translation. It now stays `A Hi $t(secret) B`, the same as without the outer nesting; with `skipOnVariables: false` it is still resolved. Second, the cost was quadratic when an unclosed `$t(` preceded many nestings, which matters when an app passes untrusted input as the key itself (`t(userInput)`): 20,000 nestings took \~1.4 s, now \~25 ms. The resolved value is now sliced into the result instead of going through `String.replace`, so `$&`, `` $` ``, `$'` and `$$` stay literal as before (26.4.2). ### [`v26.4.3`](https://redirect.github.com/i18next/i18next/blob/HEAD/CHANGELOG.md#2643) [Compare Source](https://redirect.github.com/i18next/i18next/compare/v26.4.2...v26.4.3) - perf: `ResourceStore.hasLanguageSomeTranslations()` no longer enumerates every key of a large bundle on each call. It ran `Object.keys()` on the whole bundle just to learn whether it had at least one key, and `init()` / `changeLanguage()` reach it three times per instance (once while picking the language, twice via `setResolvedLanguage()`). With large flat bundles and one i18next instance per SSR request reusing the same resources, that showed up as measurable CPU work before any `t()` call. Bundle objects already found non-empty are now remembered in a `WeakSet` shared across instances, so later checks are O(1): 2,000 inits with a 6,800-key bundle went from \~750 ms to \~20 ms, the same as a one-key bundle. Only the non-empty result is cached. No API removes single keys from a bundle, so a non-empty bundle stays non-empty, and empty bundles are re-checked every time, so keys added later (backend loads, `addResource`, `addResourceBundle`, direct or silent changes) count right away. The only edge case: a bundle emptied by hand with `delete` on every key while it is still in the store keeps counting as having translations; use `removeResourceBundle()` for that. Thanks [@dmchoi77](https://redirect.github.com/dmchoi77) for the detailed report ([#2449](https://redirect.github.com/i18next/i18next/issues/2449)). </details> --- ### Configuration 📅 Schedule: (UTC) - Branch creation - At any time (no schedule defined) - Automerge - At any time (no schedule defined) 🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied. ♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox. 🔕 Ignore*: Close this PR and you won't be reminded about this update again. --- - [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check this box --- This PR was generated by [Mend Renovate](https://mend.io/renovate/). View the [repository job log](https://developer.mend.io/github/authelia/authelia). <!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0NC4xNTUuMiIsInVwZGF0ZWRJblZlciI6IjQ0LjE1NS4yIiwidGFyZ2V0QnJhbmNoIjoibWFzdGVyIiwibGFiZWxzIjpbImRlcGVuZGVuY2llcyIsImphdmFzY3JpcHQiXX0=--> Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>	2026-10-14 12:34:20 +00:00
renovate[bot]	832e99fd51	build(deps): update dependency fast-uri to v4.2.2 (#13445 ) This PR contains the following updates: \| Package \| Change \| [Age](https://docs.renovatebot.com/merge-confidence/) \| [Confidence](https://docs.renovatebot.com/merge-confidence/) \| \|---\|---\|---\|---\| \| [fast-uri](https://redirect.github.com/fastify/fast-uri) \| [`4.2.1` → `4.2.2`](https://renovatebot.com/diffs/npm/fast-uri/4.2.1/4.2.2) \| ![age](https://developer.mend.io/api/mc/badges/age/npm/fast-uri/4.2.2?slim=true) \| ![confidence](https://developer.mend.io/api/mc/badges/confidence/npm/fast-uri/4.2.1/4.2.2?slim=true) \| --- ### Release Notes <details> <summary>fastify/fast-uri (fast-uri)</summary> ### [`v4.2.2`](https://redirect.github.com/fastify/fast-uri/releases/tag/v4.2.2) [Compare Source](https://redirect.github.com/fastify/fast-uri/compare/v4.2.1...v4.2.2) #### What's Changed - fix: reject invalid URI reference edges by [@mcollina](https://redirect.github.com/mcollina) in [#221](https://redirect.github.com/fastify/fast-uri/pull/221) - fix: encode invalid host characters by [@mcollina](https://redirect.github.com/mcollina) in [#223](https://redirect.github.com/fastify/fast-uri/pull/223) - fix: preserve dot segments in URN namespace strings by [@mcollina](https://redirect.github.com/mcollina) in [#222](https://redirect.github.com/fastify/fast-uri/pull/222) - ci: enable trusted publishing releases by [@Puppo](https://redirect.github.com/Puppo) in [#225](https://redirect.github.com/fastify/fast-uri/pull/225) - chore: bump playwright-test from 14.1.15 to 15.0.1 by [@dependabot](https://redirect.github.com/dependabot)\[bot] in [#226](https://redirect.github.com/fastify/fast-uri/pull/226) Full Changelog: <https://github.com/fastify/fast-uri/compare/v4.2.1...v4.2.2> </details> --- ### Configuration 📅 Schedule: (UTC) - Branch creation - At any time (no schedule defined) - Automerge - At any time (no schedule defined) 🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied. ♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox. 🔕 Ignore: Close this PR and you won't be reminded about this update again. --- - [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check this box --- This PR was generated by [Mend Renovate](https://mend.io/renovate/). View the [repository job log](https://developer.mend.io/github/authelia/authelia). <!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0NC4xNTUuMiIsInVwZGF0ZWRJblZlciI6IjQ0LjE1NS4yIiwidGFyZ2V0QnJhbmNoIjoibWFzdGVyIiwibGFiZWxzIjpbImRlcGVuZGVuY2llcyIsImphdmFzY3JpcHQiXX0=--> Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>	2026-10-14 12:34:02 +00:00
renovate[bot]	c0709263c5	build(deps): update caddy:2.11.7-builder docker digest to d842fac (#13441 ) This PR contains the following updates: \| Package \| Type \| Update \| Change \| \|---\|---\|---\|---\| \| [caddy](https://hub.docker.com/_/caddy) ([source](https://redirect.github.com/caddyserver/caddy-docker)) \| stage \| digest \| `b25f474` → `d842fac` \| --- ### Configuration 📅 Schedule: (UTC) - Branch creation - At any time (no schedule defined) - Automerge - At any time (no schedule defined) 🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied. ♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox. 🔕 Ignore: Close this PR and you won't be reminded about this update again. --- - [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check this box --- This PR was generated by [Mend Renovate](https://mend.io/renovate/). View the [repository job log](https://developer.mend.io/github/authelia/authelia). <!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0NC4xNTUuMiIsInVwZGF0ZWRJblZlciI6IjQ0LjE1NS4yIiwidGFyZ2V0QnJhbmNoIjoibWFzdGVyIiwibGFiZWxzIjpbImRlcGVuZGVuY2llcyIsImRvY2tlciJdfQ==--> Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>	2026-10-14 12:33:42 +00:00
renovate[bot]	3d7b9cf488	build(deps): update axllent/mailpit docker tag to v1.31.5 (#13443 ) This PR contains the following updates: \| Package \| Update \| Change \| \|---\|---\|---\| \| [axllent/mailpit](https://mailpit.axllent.org) ([source](https://redirect.github.com/axllent/mailpit)) \| patch \| `v1.31.4` → `v1.31.5` \| --- ### Release Notes <details> <summary>axllent/mailpit</summary> ### [`v1.31.5`](https://redirect.github.com/axllent/mailpit/blob/HEAD/CHANGELOG.md#v1315) [Compare Source](https://redirect.github.com/axllent/mailpit/compare/v1.31.4...v1.31.5) ##### Chore - Add gosec #nosec annotations and set explicit Content-Type on error responses - Update Go dependencies - Update node dependencies ##### Fix - Escape `_` and `%` in search terms so they match literally ([#742](https://redirect.github.com/axllent/mailpit/issues/742)) - Match `&` and `\` in address searches ([#743](https://redirect.github.com/axllent/mailpit/issues/743)) - Validate AUTH parameter in MAIL FROM command ([#744](https://redirect.github.com/axllent/mailpit/issues/744)) - MAIL FROM parameters must be space-separated per RFC 5321 ##### Test - Include additional tests for MAIL FROM parameters </details> --- ### Configuration 📅 Schedule: (UTC) - Branch creation - At any time (no schedule defined) - Automerge - At any time (no schedule defined) 🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied. ♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox. 🔕 Ignore: Close this PR and you won't be reminded about these updates again. --- - [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check this box --- This PR was generated by [Mend Renovate](https://mend.io/renovate/). View the [repository job log](https://developer.mend.io/github/authelia/authelia). <!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0NC4xNTUuMiIsInVwZGF0ZWRJblZlciI6IjQ0LjE1NS4yIiwidGFyZ2V0QnJhbmNoIjoibWFzdGVyIiwibGFiZWxzIjpbImRlcGVuZGVuY2llcyIsImRvY2tlciJdfQ==--> Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>	2026-10-14 12:33:29 +00:00
renovate[bot]	95a0c3766a	build(deps): update caddy:2.11.7 docker digest to 685ae3d (#13440 ) This PR contains the following updates: \| Package \| Type \| Update \| Change \| \|---\|---\|---\|---\| \| [caddy](https://hub.docker.com/_/caddy) ([source](https://redirect.github.com/caddyserver/caddy-docker)) \| final \| digest \| `f2a1290` → `685ae3d` \| --- ### Configuration 📅 Schedule: (UTC) - Branch creation - At any time (no schedule defined) - Automerge - At any time (no schedule defined) 🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied. ♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox. 🔕 Ignore: Close this PR and you won't be reminded about this update again. --- - [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check this box --- This PR was generated by [Mend Renovate](https://mend.io/renovate/). View the [repository job log](https://developer.mend.io/github/authelia/authelia). <!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0NC4xNTUuMiIsInVwZGF0ZWRJblZlciI6IjQ0LjE1NS4yIiwidGFyZ2V0QnJhbmNoIjoibWFzdGVyIiwibGFiZWxzIjpbImRlcGVuZGVuY2llcyIsImRvY2tlciJdfQ==--> Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>	2026-10-14 12:32:32 +00:00
renovate[bot]	ef732e809f	build(deps): update pnpm/get.pnpm.io digest to 29fc846 (#13442 ) This PR contains the following updates: \| Package \| Update \| Change \| \|---\|---\|---\| \| pnpm/get.pnpm.io \| digest \| `5f964df` → `29fc846` \| --- ### Configuration 📅 Schedule: (UTC) - Branch creation - At any time (no schedule defined) - Automerge - At any time (no schedule defined) 🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied. ♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox. 🔕 Ignore: Close this PR and you won't be reminded about this update again. --- - [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check this box --- This PR was generated by [Mend Renovate](https://mend.io/renovate/). View the [repository job log](https://developer.mend.io/github/authelia/authelia). <!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0NC4xNTUuMiIsInVwZGF0ZWRJblZlciI6IjQ0LjE1NS4yIiwidGFyZ2V0QnJhbmNoIjoibWFzdGVyIiwibGFiZWxzIjpbImRlcGVuZGVuY2llcyJdfQ==--> Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>	2026-10-14 07:18:11 +00:00
renovate[bot]andAmir Zarrinkafsh	70b553dcbf	build(deps): update dependency lucide-react to v1.55.0 (#13431 ) This PR contains the following updates: \| Package \| Change \| [Age](https://docs.renovatebot.com/merge-confidence/) \| [Confidence](https://docs.renovatebot.com/merge-confidence/) \| \|---\|---\|---\|---\| \| [lucide-react](https://lucide.dev) ([source](https://redirect.github.com/lucide-icons/lucide/tree/HEAD/packages/lucide-react)) \| [`1.53.0` → `1.55.0`](https://renovatebot.com/diffs/npm/lucide-react/1.53.0/1.55.0) \| ![age](https://developer.mend.io/api/mc/badges/age/npm/lucide-react/1.55.0?slim=true) \| ![confidence](https://developer.mend.io/api/mc/badges/confidence/npm/lucide-react/1.53.0/1.55.0?slim=true) \| --- ### Release Notes <details> <summary>lucide-icons/lucide (lucide-react)</summary> ### [`v1.55.0`](https://redirect.github.com/lucide-icons/lucide/releases/tag/1.55.0): Version 1.55.0 [Compare Source](https://redirect.github.com/lucide-icons/lucide/compare/1.54.0...1.55.0) ##### What's Changed - feat(icons): added `mail-dot` icon by [@elenakovelskikh](https://redirect.github.com/elenakovelskikh) in [#3230](https://redirect.github.com/lucide-icons/lucide/pull/3230) - ci(lint): split lint jobs and annotate Prettier and JSON schema errors in PRs by [@ericfennis](https://redirect.github.com/ericfennis) in [#4982](https://redirect.github.com/lucide-icons/lucide/pull/4982) - chore(deps-dev): bump sharp from 0.35.4 to 0.35.5 by [@dependabot](https://redirect.github.com/dependabot)\[bot] in [#4987](https://redirect.github.com/lucide-icons/lucide/pull/4987) - chore(deps): bump next from 16.3.6 to 16.3.8 by [@dependabot](https://redirect.github.com/dependabot)\[bot] in [#4988](https://redirect.github.com/lucide-icons/lucide/pull/4988) - test(lucide): add tests for empty icons error and DocumentFragment root in createIcons by [@grzdev](https://redirect.github.com/grzdev) in [#4967](https://redirect.github.com/lucide-icons/lucide/pull/4967) - feat(icons): added `phone-log` icon by [@Levi-Bensley](https://redirect.github.com/Levi-Bensley) in [#3598](https://redirect.github.com/lucide-icons/lucide/pull/3598) - chore(copilot-instruction): Adjust instruction text to allow more then 4 use-cases by [@ericfennis](https://redirect.github.com/ericfennis) in [#4989](https://redirect.github.com/lucide-icons/lucide/pull/4989) - feat(icons): added `wifi-lock` icon by [@benhaube](https://redirect.github.com/benhaube) in [#4913](https://redirect.github.com/lucide-icons/lucide/pull/4913) - feat(icons): Add `handle-bottom-right` icon by [@ocavue](https://redirect.github.com/ocavue) in [#1793](https://redirect.github.com/lucide-icons/lucide/pull/1793) - test(lucide-react): add tests for DynamicIcon fallback and ref forwarding by [@grzdev](https://redirect.github.com/grzdev) in [#4966](https://redirect.github.com/lucide-icons/lucide/pull/4966) - feat(icons): added `screw` icon by [@edik17](https://redirect.github.com/edik17) in [#4932](https://redirect.github.com/lucide-icons/lucide/pull/4932) - feat(icons): added `user-round-star` icon by [@karsa-mistmere](https://redirect.github.com/karsa-mistmere) in [#3469](https://redirect.github.com/lucide-icons/lucide/pull/3469) - feat(icons): added `shield-house` icon by [@benhaube](https://redirect.github.com/benhaube) in [#4602](https://redirect.github.com/lucide-icons/lucide/pull/4602) ##### New Contributors - [@grzdev](https://redirect.github.com/grzdev) made their first contribution in [#4967](https://redirect.github.com/lucide-icons/lucide/pull/4967) - [@Levi-Bensley](https://redirect.github.com/Levi-Bensley) made their first contribution in [#3598](https://redirect.github.com/lucide-icons/lucide/pull/3598) - [@edik17](https://redirect.github.com/edik17) made their first contribution in [#4932](https://redirect.github.com/lucide-icons/lucide/pull/4932) Full Changelog: <https://github.com/lucide-icons/lucide/compare/1.54.0...1.55.0> ### [`v1.54.0`](https://redirect.github.com/lucide-icons/lucide/releases/tag/1.54.0): Version 1.54.0 [Compare Source](https://redirect.github.com/lucide-icons/lucide/compare/1.53.0...1.54.0) ##### What's Changed - feat(icons): added `lens` icon by [@rrod497](https://redirect.github.com/rrod497) in [#4923](https://redirect.github.com/lucide-icons/lucide/pull/4923) Full Changelog: <https://github.com/lucide-icons/lucide/compare/1.53.0...1.54.0> </details> --- ### Configuration 📅 Schedule: (UTC) - Branch creation - At any time (no schedule defined) - Automerge - At any time (no schedule defined) 🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied. ♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox. 🔕 Ignore: Close this PR and you won't be reminded about this update again. --- - [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check this box --- This PR was generated by [Mend Renovate](https://mend.io/renovate/). View the [repository job log](https://developer.mend.io/github/authelia/authelia). <!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0NC4xMzQuMSIsInVwZGF0ZWRJblZlciI6IjQ0LjEzNC4xIiwidGFyZ2V0QnJhbmNoIjoibWFzdGVyIiwibGFiZWxzIjpbImRlcGVuZGVuY2llcyIsImphdmFzY3JpcHQiXX0=--> Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com> Co-authored-by: Amir Zarrinkafsh <3339418+nightah@users.noreply.github.com>	2026-10-14 03:48:10 +00:00
renovate[bot]andAmir Zarrinkafsh	de79d58f34	build(deps): update openid conformance suite to release-v5.3.2 (#13430 ) This PR contains the following updates: \| Package \| Type \| Update \| Change \| \|---\|---\|---\|---\| \| [openid/conformance-suite](https://gitlab.com/openid/conformance-suite) \| \| patch \| `release-v5.3.1` → `release-v5.3.2` \| \| registry.gitlab.com/openid/conformance-suite \| final \| patch \| `release-v5.3.1` → `release-v5.3.2` \| --- ### Release Notes <details> <summary>openid/conformance-suite (openid/conformance-suite)</summary> ### [`vrelease-v5.3.2`](https://gitlab.com/openid/conformance-suite/tags/release-v5.3.2) [Compare Source](https://gitlab.com/openid/conformance-suite/compare/release-v5.3.1...release-v5.3.2) ![OpenID Logo](https://openid.net/wp-content/uploads/2024/09/openid_white_320.png) ##### Release notes Release date: 2026-10-09 ##### Test changes - !2231 - SSF: Fix spec test gaps to allow for certification - !2257 - VP: RICAL support and VICAL/RICAL self-checks (OID4VP 1.0 Final) - !2261 - Move the emulated Brazil payments endpoints to payments v5 - !2265 - FAPI2-Security-Profile-Final: add and harden no-mtls_endpoint_aliases client coverage - !2268 - FAPI1/2/CIBA: Add negative tests for invalid `private_key_jwt` client assertions - !2285 - VP RICAL follow-up - !2289 - FAPI1/2/CIBA: Publish scopes_supported in all RP tests, validate scopes_supported in OP tests - !2290 - VP verifier: mdoc certificate checks and spec-citation fixes - !2291 - FAPI2 RP: Require OpenID for ConnectID and CBUAE RP certification profiles - !2301 - VP1Final: accept DeviceMac identifiers in deviceauth_alg_values from verifier & send those values in wallet alternate happy flow - !2303 - VP/VCI: Support EU PID in mdoc format, with data element checks and built-in VP wallet query - !2304 - FAPI2 Final RP tests: enforce the PAR request shape for the selected request method - !2307 - OID4VP Wallet: Check request_uri fetched with GET by default/when requested - !2313 - Support logged user names in Brazil CIBA consent tests ##### Bug fixes - !2262 - Fix phone-width layout defects and polish every page for small screens - !2263 - Drop modules whose statically allowed variant values are all conditionally excluded - !2264 - VP1 Final wallet: fix alternate happy flow for unencrypted response modes - !2266 - fix(cts-log-viewer): show a block's header once when rows outside it interrupt it - !2267 - statistics page fixes: include top 20 most active users + show the snapshot time as a date and time - !2269 - A stopped test must not read as passed with warnings - !2273 - Include issuer in Federation OP metadata - !2275 - UI: Ignore a blank order and apply the listing order where it was missing - !2276 - Use the trust anchor's Fetch endpoint in subordinate statements - !2277 - fix(logs): fetch the newest logs first instead of insertion order - !2278 - VCI: give the second client of the multiple-clients test a credential offer of its own - !2280 - Remove two stale Javadoc blocks that break the build on JDK 22+ - !2284 - Poll pending Brazil CIBA resource responses - !2286 - fix: #1997 reduce exp to 23h in the future - !2287 - Show certification package errors in a dialog instead of raw JSON - !2288 - VP: present the verifier's redirect_uri as a URL to visit - !2292 - VP: accept an empty request_uri POST body in the wallet tests - !2294 - BrowserControl: make document.readyState page-load wait null-safe - !2296 - VCI: give the VICAL and RICAL fixture certificates whole-second validity - !2302 - Make REVIEW outrank WARNING whichever is written first - !2311 - VP Wallet: Honour `_sd_alg` when checking SD-JWT presentations - !2316 - Fix some spurious diffs in compare jobs - !2317 - Don't offer the no-mtls-endpoint-aliases client tests for ConnectID - !2319 - Preserve the CIBA certless-ping result after late polling - !2321 - Remove the duplicate Brazil CIBA notification certificate check - !2323 - Fail instead of NPE when id_token has nonce but none was sent ##### Other - !2259 - Point Raidiam mock bank Brazil payments configs at payments v5 & reenable in CI - !2270 - Store the text of referenced specifications under library/specs - !2271 - Add a Dockerfile with the spec-library tooling - !2272 - Open uploaded review screenshots full-size from the log viewer - !2274 - Use a named MongoDB volume for macOS development - !2279 - Improvements to spec library tooling - !2283 - Give the error page the redesigned UI chrome - !2295 - SSF: Fix dangling comment - !2297 - Admin server settings page for the Chile CMF Directorio credentials - !2298 - Let private-link users download individual test logs - !2299 - Log viewer & html export: link requirement chips to the spec section - !2300 - VCI wallet tests: remove stale copies of the FAPI2 Final client test code - !2305 - Upgrade Playwright to 1.63.0 - !2306 - Speedup display of test module results in plan list & plan detail display - !2308 - Guided wizard: add an EU path to the HAIP plans - !2315 - Bump for next release - !2318 - Show whole screenshot in thumbnails; add lightbox to upload page </details> --- ### Configuration 📅 Schedule: (UTC) - Branch creation - At any time (no schedule defined) - Automerge - At any time (no schedule defined) 🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied. ♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox. 🔕 Ignore: Close this PR and you won't be reminded about these updates again. --- - [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check this box --- This PR was generated by [Mend Renovate](https://mend.io/renovate/). View the [repository job log](https://developer.mend.io/github/authelia/authelia). <!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0NC4xMzQuMSIsInVwZGF0ZWRJblZlciI6IjQ0LjEzNC4xIiwidGFyZ2V0QnJhbmNoIjoibWFzdGVyIiwibGFiZWxzIjpbImRlcGVuZGVuY2llcyIsImRvY2tlciJdfQ==--> Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com> Co-authored-by: Amir Zarrinkafsh <3339418+nightah@users.noreply.github.com>	2026-10-14 03:46:40 +00:00
renovate[bot]andAmir Zarrinkafsh	f604b5044e	build(deps): update golang:1.27.2-alpine docker digest to f92b6ef (#13432 ) This PR contains the following updates: \| Package \| Type \| Update \| Change \| \|---\|---\|---\|---\| \| [golang](https://hub.docker.com/_/golang) ([source](https://redirect.github.com/docker-library/golang)) \| stage \| digest \| `85dc106` → `f92b6ef` \| \| [golang](https://hub.docker.com/_/golang) ([source](https://redirect.github.com/docker-library/golang)) \| final \| digest \| `85dc106` → `f92b6ef` \| --- ### Configuration 📅 Schedule: (UTC) - Branch creation - At any time (no schedule defined) - Automerge - At any time (no schedule defined) 🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied. ♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox. 🔕 Ignore: Close this PR and you won't be reminded about these updates again. --- - [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check this box --- This PR was generated by [Mend Renovate](https://mend.io/renovate/). View the [repository job log](https://developer.mend.io/github/authelia/authelia). <!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0NC4xMzQuMSIsInVwZGF0ZWRJblZlciI6IjQ0LjEzNC4xIiwidGFyZ2V0QnJhbmNoIjoibWFzdGVyIiwibGFiZWxzIjpbImRlcGVuZGVuY2llcyIsImRvY2tlciJdfQ==--> Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com> Co-authored-by: Amir Zarrinkafsh <3339418+nightah@users.noreply.github.com>	2026-10-14 03:45:20 +00:00
renovate[bot]andAmir Zarrinkafsh	52d13133b7	build(deps): update dependency @base-ui/react to v1.9.0 (#13433 ) This PR contains the following updates: \| Package \| Change \| [Age](https://docs.renovatebot.com/merge-confidence/) \| [Confidence](https://docs.renovatebot.com/merge-confidence/) \| \|---\|---\|---\|---\| \| [@base-ui/react](https://base-ui.com) ([source](https://redirect.github.com/mui/base-ui/tree/HEAD/packages/react)) \| [`1.8.0` → `1.9.0`](https://renovatebot.com/diffs/npm/@base-ui%2freact/1.8.0/1.9.0) \| ![age](https://developer.mend.io/api/mc/badges/age/npm/@base-ui%2freact/1.9.0?slim=true) \| ![confidence](https://developer.mend.io/api/mc/badges/confidence/npm/@base-ui%2freact/1.8.0/1.9.0?slim=true) \| --- ### Release Notes <details> <summary>mui/base-ui (@base-ui/react)</summary> ### [`v1.9.0`](https://redirect.github.com/mui/base-ui/blob/HEAD/CHANGELOG.md#v190) [Compare Source](https://redirect.github.com/mui/base-ui/compare/v1.8.0...v1.9.0) <!-- generated comparing v1.8.0...master --> Oct 9, 2026 ##### General changes - Export `CssVariables` and `DataAttributes` types ([#5243](https://redirect.github.com/mui/base-ui/issues/5243)) by [@superhooman](https://redirect.github.com/superhooman) - Fix stale focused field state ([#5345](https://redirect.github.com/mui/base-ui/issues/5345)) by [@atomiks](https://redirect.github.com/atomiks) - Fix animation waits retaining detached elements ([#5719](https://redirect.github.com/mui/base-ui/issues/5719)) by [@flaviendelangle](https://redirect.github.com/flaviendelangle) - Keep item registration in sync when items change under Strict Mode ([#5862](https://redirect.github.com/mui/base-ui/issues/5862)) by [@atomiks](https://redirect.github.com/atomiks) - Avoid re-rendering inactive triggers on open and close ([#5865](https://redirect.github.com/mui/base-ui/issues/5865)) by [@atomiks](https://redirect.github.com/atomiks) ##### Accordion - Fix `<Accordion.Trigger>`'s `data-value` and `data-index` attributes ([#5705](https://redirect.github.com/mui/base-ui/issues/5705)) by [@cpruijsen](https://redirect.github.com/cpruijsen) - Apply the native `disabled` attribute to `<Accordion.Trigger>` when using native buttons ([#5607](https://redirect.github.com/mui/base-ui/issues/5607)) by [@atomiks](https://redirect.github.com/atomiks) - Expand `hiddenUntilFound` panels synchronously on `beforematch` ([#5514](https://redirect.github.com/mui/base-ui/issues/5514)) by [@aarongarciah](https://redirect.github.com/aarongarciah) ##### Alert Dialog - Don't associate a programmatically opened popup with a trigger that did not open it ([#5641](https://redirect.github.com/mui/base-ui/issues/5641)) by [@michaldudak](https://redirect.github.com/michaldudak) ##### Autocomplete - Fix `autoHighlight` for asynchronous results ([#5818](https://redirect.github.com/mui/base-ui/issues/5818)) by [@atomiks](https://redirect.github.com/atomiks) - Pass the originating event to `onItemHighlighted`. Pointer events may be `MouseEvent` or `PointerEvent`; typing reports the reason `none` ([#5838](https://redirect.github.com/mui/base-ui/issues/5838)) by [@atomiks](https://redirect.github.com/atomiks) - Decouple automatic unmounting from `actionsRef`. Call `eventDetails.preventUnmountOnClose()` in `onOpenChange` to opt out of automatic unmounting ([#5734](https://redirect.github.com/mui/base-ui/issues/5734)) by [@michaldudak](https://redirect.github.com/michaldudak) ##### Checkbox - Prefer `aria-label` over associated labels ([#5787](https://redirect.github.com/mui/base-ui/issues/5787)) by [@atomiks](https://redirect.github.com/atomiks) ##### Collapsible - Apply the native `disabled` attribute to `<Collapsible.Trigger>` when using native buttons ([#5607](https://redirect.github.com/mui/base-ui/issues/5607)) by [@atomiks](https://redirect.github.com/atomiks) - Finish closing when the render function removes the panel ([#5890](https://redirect.github.com/mui/base-ui/issues/5890)) by [@michaldudak](https://redirect.github.com/michaldudak) - Restore animations when a removed panel reopens ([#5891](https://redirect.github.com/mui/base-ui/issues/5891)) by [@michaldudak](https://redirect.github.com/michaldudak) - Expand `hiddenUntilFound` panels synchronously on `beforematch` ([#5514](https://redirect.github.com/mui/base-ui/issues/5514)) by [@aarongarciah](https://redirect.github.com/aarongarciah) ##### Combobox - Fix stale chip focus after returning to the input ([#5879](https://redirect.github.com/mui/base-ui/issues/5879)) by [@mdm317](https://redirect.github.com/mdm317) - Fix `autoHighlight` for asynchronous results ([#5818](https://redirect.github.com/mui/base-ui/issues/5818)) by [@atomiks](https://redirect.github.com/atomiks) - Decouple automatic unmounting from `actionsRef`. Call `eventDetails.preventUnmountOnClose()` in `onOpenChange` to opt out of automatic unmounting ([#5734](https://redirect.github.com/mui/base-ui/issues/5734)) by [@michaldudak](https://redirect.github.com/michaldudak) - Fix label focus in Shadow DOM ([#5871](https://redirect.github.com/mui/base-ui/issues/5871)) by [@lyzno1](https://redirect.github.com/lyzno1) - Pass the originating event to `onItemHighlighted`. Pointer events may be `MouseEvent` or `PointerEvent`; typing reports the reason `none` ([#5838](https://redirect.github.com/mui/base-ui/issues/5838)) by [@atomiks](https://redirect.github.com/atomiks) - Reset typeahead state when closing without moving focus ([#5816](https://redirect.github.com/mui/base-ui/issues/5816)) by [@mdm317](https://redirect.github.com/mdm317) - Accept readonly arrays for multiple values ([#5710](https://redirect.github.com/mui/base-ui/issues/5710)) by [@MonstraG](https://redirect.github.com/MonstraG) - Share item indicator implementation ([#5728](https://redirect.github.com/mui/base-ui/issues/5728)) by [@flaviendelangle](https://redirect.github.com/flaviendelangle) - Improve mount performance of large lists ([#5819](https://redirect.github.com/mui/base-ui/issues/5819)) by [@atomiks](https://redirect.github.com/atomiks) - Combine item store subscriptions ([#5863](https://redirect.github.com/mui/base-ui/issues/5863)) by [@atomiks](https://redirect.github.com/atomiks) ##### Dialog - Keep parent open when closing a nested dialog in a closed shadow root ([#5780](https://redirect.github.com/mui/base-ui/issues/5780)) by [@atomiks](https://redirect.github.com/atomiks) - Don't associate a programmatically opened popup with a trigger that did not open it ([#5641](https://redirect.github.com/mui/base-ui/issues/5641)) by [@michaldudak](https://redirect.github.com/michaldudak) ##### Drawer - Preserve swipe release velocity after a trailing stationary pointer event ([#5658](https://redirect.github.com/mui/base-ui/issues/5658)) by [@padd60](https://redirect.github.com/padd60) - Fix swipe release velocity on 120 Hz input ([#5845](https://redirect.github.com/mui/base-ui/issues/5845)) by [@atomiks](https://redirect.github.com/atomiks) - Remove excess virtual keyboard scroll space ([#5768](https://redirect.github.com/mui/base-ui/issues/5768)) by [@atomiks](https://redirect.github.com/atomiks) - Avoid excess keyboard spacing in Chrome on iOS ([#5774](https://redirect.github.com/mui/base-ui/issues/5774)) by [@atomiks](https://redirect.github.com/atomiks) - Fix native focus scrolling on iOS 27 ([#5769](https://redirect.github.com/mui/base-ui/issues/5769)) by [@atomiks](https://redirect.github.com/atomiks) - Handle CloseWatcher close requests from the cancel event ([#5770](https://redirect.github.com/mui/base-ui/issues/5770)) by [@atomiks](https://redirect.github.com/atomiks) - Add `x` and `y` options to `data-base-ui-swipe-ignore` ([#5808](https://redirect.github.com/mui/base-ui/issues/5808)) by [@citrus](https://redirect.github.com/citrus) - Scroll instead of swiping when a drag starts on an SVG ([#5844](https://redirect.github.com/mui/base-ui/issues/5844)) by [@atomiks](https://redirect.github.com/atomiks) - Avoid touch event overhead while the drawer is closed ([#5864](https://redirect.github.com/mui/base-ui/issues/5864)) by [@atomiks](https://redirect.github.com/atomiks) - Preserve item taps when dismissing the virtual keyboard ([#5882](https://redirect.github.com/mui/base-ui/issues/5882)) by [@atomiks](https://redirect.github.com/atomiks) - Avoid retaining unmounted drawers in `<Drawer.Provider>` ([#5921](https://redirect.github.com/mui/base-ui/issues/5921)) by [@atomiks](https://redirect.github.com/atomiks) - Don't associate a programmatically opened popup with a trigger that did not open it ([#5641](https://redirect.github.com/mui/base-ui/issues/5641)) by [@michaldudak](https://redirect.github.com/michaldudak) ##### Field - Avoid warnings when an uncontrolled `<Field.Control>`'s `defaultValue` changes ([#5881](https://redirect.github.com/mui/base-ui/issues/5881)) by [@atomiks](https://redirect.github.com/atomiks) - Fix label focus in Shadow DOM ([#5871](https://redirect.github.com/mui/base-ui/issues/5871)) by [@lyzno1](https://redirect.github.com/lyzno1) ##### Menu - Add menu filtering behavior with `<Menu.FilterProvider>`, `<Menu.Input>`, and the `onItemHighlighted` callback (preview) ([#5527](https://redirect.github.com/mui/base-ui/issues/5527), [#5838](https://redirect.github.com/mui/base-ui/issues/5838), [#5840](https://redirect.github.com/mui/base-ui/issues/5840), [#5868](https://redirect.github.com/mui/base-ui/issues/5868)) by [@atomiks](https://redirect.github.com/atomiks) and [@jjenzz](https://redirect.github.com/jjenzz) - Fix nested menus without a root trigger ([#5645](https://redirect.github.com/mui/base-ui/issues/5645)) by [@LukasTy](https://redirect.github.com/LukasTy) - Fix event listener cleanup in `<Menu.Trigger>` ([#5764](https://redirect.github.com/mui/base-ui/issues/5764)) by [@sai6855](https://redirect.github.com/sai6855) - Release parent menu subscriptions when a submenu unmounts ([#5833](https://redirect.github.com/mui/base-ui/issues/5833)) by [@santiago-ramos-02](https://redirect.github.com/santiago-ramos-02) - Pass the native event to `onOpenChange` when an item press closes the menu ([#5789](https://redirect.github.com/mui/base-ui/issues/5789)) by [@michaldudak](https://redirect.github.com/michaldudak) - Close submenu when focus returns through its guard ([#5793](https://redirect.github.com/mui/base-ui/issues/5793)) by [@jjenzz](https://redirect.github.com/jjenzz) - Toggle submenus on repeated trigger activation ([#5824](https://redirect.github.com/mui/base-ui/issues/5824)) by [@jjenzz](https://redirect.github.com/jjenzz) - Reset typeahead state when closing without moving focus ([#5816](https://redirect.github.com/mui/base-ui/issues/5816)) by [@mdm317](https://redirect.github.com/mdm317) - Fix focus guard loop when the trigger is the only tabbable element ([#5733](https://redirect.github.com/mui/base-ui/issues/5733)) by [@atomiks](https://redirect.github.com/atomiks) - Fix hover-out animations when switching between detached triggers ([#4261](https://redirect.github.com/mui/base-ui/issues/4261)) by [@michaldudak](https://redirect.github.com/michaldudak) - Don't start a viewport transition when the trigger remounts while closed ([#5887](https://redirect.github.com/mui/base-ui/issues/5887)) by [@michaldudak](https://redirect.github.com/michaldudak) - Keep transition state consistent when reopening a retained popup ([#5738](https://redirect.github.com/mui/base-ui/issues/5738)) by [@LukasTy](https://redirect.github.com/LukasTy) - Improve mount performance of large lists ([#5819](https://redirect.github.com/mui/base-ui/issues/5819)) by [@atomiks](https://redirect.github.com/atomiks) ##### Number Field - Fire `<NumberField.ScrubArea>`'s `onClick` once per click ([#5889](https://redirect.github.com/mui/base-ui/issues/5889)) by [@michaldudak](https://redirect.github.com/michaldudak) ##### OTP Field - Fix Safari IME composition over-filling slots ([#5098](https://redirect.github.com/mui/base-ui/issues/5098)) by [@atomiks](https://redirect.github.com/atomiks) ##### Popover - Fix focus guard loop when the trigger is the only tabbable element ([#5733](https://redirect.github.com/mui/base-ui/issues/5733)) by [@atomiks](https://redirect.github.com/atomiks) - Fix hover-out animations when switching between detached triggers ([#4261](https://redirect.github.com/mui/base-ui/issues/4261)) by [@michaldudak](https://redirect.github.com/michaldudak) - Don't start a viewport transition when the trigger remounts while closed ([#5887](https://redirect.github.com/mui/base-ui/issues/5887)) by [@michaldudak](https://redirect.github.com/michaldudak) - Keep transition state consistent when reopening a retained popup ([#5738](https://redirect.github.com/mui/base-ui/issues/5738)) by [@LukasTy](https://redirect.github.com/LukasTy) ##### Preview Card - Don't start a viewport transition when the trigger remounts while closed ([#5887](https://redirect.github.com/mui/base-ui/issues/5887)) by [@michaldudak](https://redirect.github.com/michaldudak) ##### Radio Group - Prefer `aria-label` over associated labels ([#5787](https://redirect.github.com/mui/base-ui/issues/5787)) by [@atomiks](https://redirect.github.com/atomiks) - Prevent ignored arrow keys from selecting on refocus ([#5643](https://redirect.github.com/mui/base-ui/issues/5643)) by [@tjdsksro90](https://redirect.github.com/tjdsksro90) - Correct `inputRef` forwarding and cleanup ([#5775](https://redirect.github.com/mui/base-ui/issues/5775)) by [@lyzno1](https://redirect.github.com/lyzno1) ##### Scroll Area - Remove presentational viewport role ([#5813](https://redirect.github.com/mui/base-ui/issues/5813)) by [@sarthakmalik0810](https://redirect.github.com/sarthakmalik0810) ##### Select - Decouple automatic unmounting from `actionsRef`. Call `eventDetails.preventUnmountOnClose()` in `onOpenChange` to opt out of automatic unmounting ([#5734](https://redirect.github.com/mui/base-ui/issues/5734)) by [@michaldudak](https://redirect.github.com/michaldudak) - Fix label focus in Shadow DOM ([#5871](https://redirect.github.com/mui/base-ui/issues/5871)) by [@lyzno1](https://redirect.github.com/lyzno1) - Reset typeahead state when closing without moving focus ([#5816](https://redirect.github.com/mui/base-ui/issues/5816)) by [@mdm317](https://redirect.github.com/mdm317) - Synchronize root props through the store ([#5589](https://redirect.github.com/mui/base-ui/issues/5589)) by [@flaviendelangle](https://redirect.github.com/flaviendelangle) - Share item indicator implementation ([#5728](https://redirect.github.com/mui/base-ui/issues/5728)) by [@flaviendelangle](https://redirect.github.com/flaviendelangle) - Improve mount performance of large lists ([#5819](https://redirect.github.com/mui/base-ui/issues/5819)) by [@atomiks](https://redirect.github.com/atomiks) - Combine item store subscriptions ([#5863](https://redirect.github.com/mui/base-ui/issues/5863)) by [@atomiks](https://redirect.github.com/atomiks) - Accept readonly arrays for multiple values ([#5710](https://redirect.github.com/mui/base-ui/issues/5710)) by [@MonstraG](https://redirect.github.com/MonstraG) ##### Slider - Fix label focus in Shadow DOM ([#5871](https://redirect.github.com/mui/base-ui/issues/5871)) by [@lyzno1](https://redirect.github.com/lyzno1) - End drags on `touchcancel` and `pointercancel` ([#5639](https://redirect.github.com/mui/base-ui/issues/5639)) by [@brijeshb42](https://redirect.github.com/brijeshb42) - Fix touch track taps not firing `onValueCommitted` ([#5779](https://redirect.github.com/mui/base-ui/issues/5779)) by [@atomiks](https://redirect.github.com/atomiks) - Preserve single-element array values on pointer interaction ([#5781](https://redirect.github.com/mui/base-ui/issues/5781)) by [@atomiks](https://redirect.github.com/atomiks) ##### Switch - Prefer `aria-label` over associated labels ([#5787](https://redirect.github.com/mui/base-ui/issues/5787)) by [@atomiks](https://redirect.github.com/atomiks) ##### Tabs - Fix selecting tabs with function values ([#5886](https://redirect.github.com/mui/base-ui/issues/5886)) by [@michaldudak](https://redirect.github.com/michaldudak) ##### Toast - Keep timers paused during overlapping interactions ([#5809](https://redirect.github.com/mui/base-ui/issues/5809)) by [@lyzno1](https://redirect.github.com/lyzno1) ##### Tooltip - Don't start a viewport transition when the trigger remounts while closed ([#5887](https://redirect.github.com/mui/base-ui/issues/5887)) by [@michaldudak](https://redirect.github.com/michaldudak) All contributors of this release in alphabetical order: [@aarongarciah](https://redirect.github.com/aarongarciah), [@atomiks](https://redirect.github.com/atomiks), [@brijeshb42](https://redirect.github.com/brijeshb42), [@citrus](https://redirect.github.com/citrus), [@cpruijsen](https://redirect.github.com/cpruijsen), [@flaviendelangle](https://redirect.github.com/flaviendelangle), [@jjenzz](https://redirect.github.com/jjenzz), [@LukasTy](https://redirect.github.com/LukasTy), [@lyzno1](https://redirect.github.com/lyzno1), [@mdm317](https://redirect.github.com/mdm317), [@michaldudak](https://redirect.github.com/michaldudak), [@MonstraG](https://redirect.github.com/MonstraG), [@padd60](https://redirect.github.com/padd60), [@sai6855](https://redirect.github.com/sai6855), [@santiago-ramos-02](https://redirect.github.com/santiago-ramos-02), [@sarthakmalik0810](https://redirect.github.com/sarthakmalik0810), [@superhooman](https://redirect.github.com/superhooman), [@tjdsksro90](https://redirect.github.com/tjdsksro90) </details> --- ### Configuration 📅 Schedule: (UTC) - Branch creation - At any time (no schedule defined) - Automerge - At any time (no schedule defined) 🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied. ♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox. 🔕 Ignore: Close this PR and you won't be reminded about this update again. --- - [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check this box --- This PR was generated by [Mend Renovate](https://mend.io/renovate/). View the [repository job log](https://developer.mend.io/github/authelia/authelia). <!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0NC4xMzQuMSIsInVwZGF0ZWRJblZlciI6IjQ0LjEzNC4xIiwidGFyZ2V0QnJhbmNoIjoibWFzdGVyIiwibGFiZWxzIjpbImRlcGVuZGVuY2llcyIsImphdmFzY3JpcHQiXX0=--> Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com> Co-authored-by: Amir Zarrinkafsh <3339418+nightah@users.noreply.github.com>	2026-10-14 03:44:02 +00:00
renovate[bot]andAmir Zarrinkafsh	ae679ed436	build(deps): update module github.com/prometheus/client_golang to v1.25.0 (#13435 ) This PR contains the following updates: \| Package \| Change \| [Age](https://docs.renovatebot.com/merge-confidence/) \| [Confidence](https://docs.renovatebot.com/merge-confidence/) \| \|---\|---\|---\|---\| \| [github.com/prometheus/client_golang](https://redirect.github.com/prometheus/client_golang) \| `v1.24.1` → `v1.25.0` \| ![age](https://developer.mend.io/api/mc/badges/age/go/github.com%2fprometheus%2fclient_golang/v1.25.0?slim=true) \| ![confidence](https://developer.mend.io/api/mc/badges/confidence/go/github.com%2fprometheus%2fclient_golang/v1.24.1/v1.25.0?slim=true) \| --- ### Release Notes <details> <summary>prometheus/client_golang (github.com/prometheus/client_golang)</summary> ### [`v1.25.0`](https://redirect.github.com/prometheus/client_golang/releases/tag/v1.25.0) [Compare Source](https://redirect.github.com/prometheus/client_golang/compare/v1.24.1...v1.25.0) ⚠️ This release raises the minimum required Go version to 1.26 and includes breaking API changes in `api/prometheus/v1` (see the \[CHANGE] entries below). ⚠️ #### 1.25.0 / 2026-10-07 - \[CHANGE] Minimum required Go version is now 1.26, only the two latest Go versions (1.26 and 1.27) are supported from now on. [#2138](https://redirect.github.com/prometheus/client_golang/issues/2138) - \[CHANGE] api/prometheus/v1: `Query`, `QueryRange`, `Series`, `LabelNames`, and `LabelValues` now return `Infos` annotations in addition to `Warnings`, matching the Prometheus server's info annotations. This changes the signatures of these methods and of `api.Client`'s `Do`/`DoGetFallback`; custom API client implementations must be updated. [#1963](https://redirect.github.com/prometheus/client_golang/issues/1963) - \[CHANGE] api/prometheus/v1: Rework `TSDBBlocks` result types to align with the Prometheus server's `tsdb.BlockMeta`: `TSDBBlocksResult` now contains `Blocks []TSDBBlockMeta` directly instead of mirroring the full API envelope, nested types are renamed (`TSDBBlockMeta`, `TSDBBlockStats`, `TSDBBlockMetaCompaction`), stat fields are `uint64` with `omitempty` tags, and the optional compaction `parents` field is included. [#1928](https://redirect.github.com/prometheus/client_golang/issues/1928) - \[FEATURE] testutil: Add `GatherAndFormat` to encode a subset of metrics from a Gatherer. [#2091](https://redirect.github.com/prometheus/client_golang/issues/2091) - \[FEATURE] promhttp: Add `HandlerOpts.AcceptedFormats` to customize the formats negotiated from the incoming `Accept` header, enabling opt-in to experimental formats such as OpenMetrics 2.0 without changing default negotiation. [#2146](https://redirect.github.com/prometheus/client_golang/issues/2146) - \[ENHANCEMENT] promhttp: Negotiated metrics responses now include a `Vary` header. [#2142](https://redirect.github.com/prometheus/client_golang/issues/2142) - \[ENHANCEMENT] prometheus: Regenerate the default runtime collector metrics for Go 1.25 and Go 1.26. [#2090](https://redirect.github.com/prometheus/client_golang/issues/2090), [#2095](https://redirect.github.com/prometheus/client_golang/issues/2095) - \[ENHANCEMENT] testutil: Finalize OpenMetrics output in `GatherAndFormat` and `CollectAndFormat` (terminating `# EOF`). [#2125](https://redirect.github.com/prometheus/client_golang/issues/2125) - \[BUGFIX] api: Match complete URL path placeholders only; a `:foo` argument no longer substitutes inside `:foobar`. [#2136](https://redirect.github.com/prometheus/client_golang/issues/2136) - \[BUGFIX] exp/api/remote: Reset the pooled buffer before generic proto marshaling, preventing corrupted remote-write payloads. [#2139](https://redirect.github.com/prometheus/client_golang/issues/2139) - \[BUGFIX] testutil/promlint: Fix "mibi" unit prefix to "mebi". [#2135](https://redirect.github.com/prometheus/client_golang/issues/2135) <details> <summary> What's changed </summary> #### What's Changed * fix: Remove unneeded and broken CI badge by @bwplot[https://github.com/prometheus/client_golang/pull/2057](https://redirect.github.com/prometheus/client_golang/pull/2057)l/2057 * Synchronize common files from prometheus/prometheus by @promb[https://github.com/prometheus/client_golang/pull/2060](https://redirect.github.com/prometheus/client_golang/pull/2060)l/2060 * build(deps): bump the codeql group with 4 updates by @dependabot[bo[https://github.com/prometheus/client_golang/pull/2066](https://redirect.github.com/prometheus/client_golang/pull/2066)l/2066 * build(deps): bump github.com/klauspost/compress from 1.19.0 to 1.19.1 by @dependabot[bo[https://github.com/prometheus/client_golang/pull/2071](https://redirect.github.com/prometheus/client_golang/pull/2071)l/2071 * build(deps): bump golang.org/x/sys from 0.46.0 to 0.47.0 in the golang-org-x group across 1 directory by @dependabot[bo[https://github.com/prometheus/client_golang/pull/2069](https://redirect.github.com/prometheus/client_golang/pull/2069)l/2069 * build(deps): bump github.com/klauspost/compress from 1.19.0 to 1.19.1 in /exp by @dependabot[bo[https://github.com/prometheus/client_golang/pull/2072](https://redirect.github.com/prometheus/client_golang/pull/2072)l/2072 * build(deps): bump github.com/prometheus/common from 0.69.0 to 0.70.1 in /exp by @dependabot[bo[https://github.com/prometheus/client_golang/pull/2073](https://redirect.github.com/prometheus/client_golang/pull/2073)l/2073 * build(deps): bump github.com/prometheus/common from 0.69.0 to 0.70.1 by @dependabot[bo[https://github.com/prometheus/client_golang/pull/2070](https://redirect.github.com/prometheus/client_golang/pull/2070)l/2070 * build(deps): bump google.golang.org/grpc from 1.79.3 to 1.82.1 in /tutorials/whatsup by @dependabot[bo[https://github.com/prometheus/client_golang/pull/2075](https://redirect.github.com/prometheus/client_golang/pull/2075)l/2075 * Pin GitHub Actions by @Supe[https://github.com/prometheus/client_golang/pull/2074](https://redirect.github.com/prometheus/client_golang/pull/2074)l/2074 * build(deps): bump actions/checkout from 7.0.0 to 7.0.1 by @dependabot[bo[https://github.com/prometheus/client_golang/pull/2067](https://redirect.github.com/prometheus/client_golang/pull/2067)l/2067 * promhttp: fix panic on requests with nil URL by @SAY[https://github.com/prometheus/client_golang/pull/2065](https://redirect.github.com/prometheus/client_golang/pull/2065)l/2065 * Return info annotations in addition to warnings in the API by @zenad[https://github.com/prometheus/client_golang/pull/1963](https://redirect.github.com/prometheus/client_golang/pull/1963)l/1963 * build(deps): bump ossf/scorecard-action from 2.4.3 to 2.4.4 by @dependabot[bo[https://github.com/prometheus/client_golang/pull/2082](https://redirect.github.com/prometheus/client_golang/pull/2082)l/2082 * Synchronize common files from prometheus/prometheus by @promb[https://github.com/prometheus/client_golang/pull/2084](https://redirect.github.com/prometheus/client_golang/pull/2084)l/2084 * Synchronize common files from prometheus/prometheus by @promb[https://github.com/prometheus/client_golang/pull/2086](https://redirect.github.com/prometheus/client_golang/pull/2086)l/2086 * Synchronize common files from prometheus/prometheus by @promb[https://github.com/prometheus/client_golang/pull/2088](https://redirect.github.com/prometheus/client_golang/pull/2088)l/2088 * Regenerate Go collector runtime metrics for Go 1.25 and Go 1.26 by @bwplot[https://github.com/prometheus/client_golang/pull/2090](https://redirect.github.com/prometheus/client_golang/pull/2090)l/2090 * go.mod: remove obsolete exclude rule by @thaJezt[https://github.com/prometheus/client_golang/pull/2077](https://redirect.github.com/prometheus/client_golang/pull/2077)l/2077 * Synchronize common files from prometheus/prometheus by @promb[https://github.com/prometheus/client_golang/pull/2093](https://redirect.github.com/prometheus/client_golang/pull/2093)l/2093 * README: document the OpenTelemetry OTLP push bridge by @mvanho[https://github.com/prometheus/client_golang/pull/1987](https://redirect.github.com/prometheus/client_golang/pull/1987)l/1987 * docs: add AGENTS.md contributor and maintainer guide by @bwplot[https://github.com/prometheus/client_golang/pull/2056](https://redirect.github.com/prometheus/client_golang/pull/2056)l/2056 * testutil: add GatherAndFormat helper by @wieg[https://github.com/prometheus/client_golang/pull/2091](https://redirect.github.com/prometheus/client_golang/pull/2091)l/2091 * build(deps): bump the codeql group with 4 updates by @dependabot[bo[https://github.com/prometheus/client_golang/pull/2101](https://redirect.github.com/prometheus/client_golang/pull/2101)l/2101 * build(deps): bump google.golang.org/protobuf from 1.36.11 to 1.36.12 by @dependabot[bo[https://github.com/prometheus/client_golang/pull/2097](https://redirect.github.com/prometheus/client_golang/pull/2097)l/2097 * build(deps): bump github.com/klauspost/compress from 1.19.1 to 1.19.2 by @dependabot[bo[https://github.com/prometheus/client_golang/pull/2098](https://redirect.github.com/prometheus/client_golang/pull/2098)l/2098 * build(deps): bump google.golang.org/protobuf from 1.36.11 to 1.36.12 in /exp by @dependabot[bo[https://github.com/prometheus/client_golang/pull/2099](https://redirect.github.com/prometheus/client_golang/pull/2099)l/2099 * build(deps): bump github.com/klauspost/compress from 1.19.1 to 1.19.2 in /exp by @dependabot[bo[https://github.com/prometheus/client_golang/pull/2100](https://redirect.github.com/prometheus/client_golang/pull/2100)l/2100 * build(deps): bump github.com/prometheus/procfs from 0.21.1 to 0.22.0 in the prometheus group across 1 directory by @dependabot[bo[https://github.com/prometheus/client_golang/pull/2096](https://redirect.github.com/prometheus/client_golang/pull/2096)l/2096 * build(deps): bump google.golang.org/grpc from 1.82.1 to 1.83.1 in /tutorials/whatsup by @dependabot[bo[https://github.com/prometheus/client_golang/pull/2102](https://redirect.github.com/prometheus/client_golang/pull/2102)l/2102 * chore: Update metrics for new Go version by @github-actions[bo[https://github.com/prometheus/client_golang/pull/2095](https://redirect.github.com/prometheus/client_golang/pull/2095)l/2095 * Benchmark json-iter, stdlib json and json/v2 by @liggi[https://github.com/prometheus/client_golang/pull/2107](https://redirect.github.com/prometheus/client_golang/pull/2107)l/2107 * build(deps): bump google.golang.org/grpc from 1.83.1 to 1.83.2 in /tutorials/whatsup by @dependabot[bo[https://github.com/prometheus/client_golang/pull/2112](https://redirect.github.com/prometheus/client_golang/pull/2112)l/2112 * RuleGroup: use stdlib for json decoding, optimize decoding by @liggi[https://github.com/prometheus/client_golang/pull/2109](https://redirect.github.com/prometheus/client_golang/pull/2109)l/2109 * Modernize micro benchmarks: b.Loop and key=value case names by @radianced[https://github.com/prometheus/client_golang/pull/2114](https://redirect.github.com/prometheus/client_golang/pull/2114)l/2114 * QueryResult: use stdlib for envelope decoding by @liggi[https://github.com/prometheus/client_golang/pull/2110](https://redirect.github.com/prometheus/client_golang/pull/2110)l/2110 * Use stdlib to decode apiResult envelope by @liggi[https://github.com/prometheus/client_golang/pull/2111](https://redirect.github.com/prometheus/client_golang/pull/2111)l/2111 * Improve linting by @Supe[https://github.com/prometheus/client_golang/pull/2115](https://redirect.github.com/prometheus/client_golang/pull/2115)l/2115 * Delete unused custom json-iterator marshaling by @liggi[https://github.com/prometheus/client_golang/pull/2121](https://redirect.github.com/prometheus/client_golang/pull/2121)l/2121 * Simplify apiClientImpl#Do error path by @liggi[https://github.com/prometheus/client_golang/pull/2120](https://redirect.github.com/prometheus/client_golang/pull/2120)l/2120 * testutil: finalize OpenMetrics output by @ajavan[https://github.com/prometheus/client_golang/pull/2125](https://redirect.github.com/prometheus/client_golang/pull/2125)l/2125 * build(deps): bump go.opentelemetry.io/otel/sdk from 1.44.0 to 1.45.0 in /tutorials/whatsup by @dependabot[bo[https://github.com/prometheus/client_golang/pull/2124](https://redirect.github.com/prometheus/client_golang/pull/2124)l/2124 * Synchronize common files from prometheus/prometheus by @promb[https://github.com/prometheus/client_golang/pull/2116](https://redirect.github.com/prometheus/client_golang/pull/2116)l/2116 * prometheus: fix revive indent-error-flow lint on Darwin by @bwplot[https://github.com/prometheus/client_golang/pull/2131](https://redirect.github.com/prometheus/client_golang/pull/2131)l/2131 * build(deps): bump go.opentelemetry.io/otel/exporters/otlp/otlptrace from 1.34.0 to 1.45.0 in /tutorials/whatsup by @dependabot[bo[https://github.com/prometheus/client_golang/pull/2123](https://redirect.github.com/prometheus/client_golang/pull/2123)l/2123 * Combine envelope/inner apiResponse decoding, switch to stdlib json by @liggi[https://github.com/prometheus/client_golang/pull/2118](https://redirect.github.com/prometheus/client_golang/pull/2118)l/2118 * build(deps): bump go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc from 1.34.0 to 1.45.0 in /tutorials/whatsup by @dependabot[bo[https://github.com/prometheus/client_golang/pull/2122](https://redirect.github.com/prometheus/client_golang/pull/2122)l/2122 * testutil/promlint: fix "mibi" unit prefix to "mebi" by @ZainnQuresh[https://github.com/prometheus/client_golang/pull/2135](https://redirect.github.com/prometheus/client_golang/pull/2135)l/2135 * all: update prometheus/common to v0.72.0 and apply modernize fixes by @bwplot[https://github.com/prometheus/client_golang/pull/2138](https://redirect.github.com/prometheus/client_golang/pull/2138)l/2138 * limit json-iterator use to Go 1.26 by @liggi[https://github.com/prometheus/client_golang/pull/2128](https://redirect.github.com/prometheus/client_golang/pull/2128)l/2128 * promhttp: add AcceptedFormats option to customize format negotiation by @bwplot[https://github.com/prometheus/client_golang/pull/2146](https://redirect.github.com/prometheus/client_golang/pull/2146)l/2146 * build(deps): bump github.com/klauspost/compress from 1.19.2 to 1.20.1 by @dependabot[bo[https://github.com/prometheus/client_golang/pull/2143](https://redirect.github.com/prometheus/client_golang/pull/2143)l/2143 * build(deps): bump the codeql group with 4 updates by @dependabot[bo[https://github.com/prometheus/client_golang/pull/2145](https://redirect.github.com/prometheus/client_golang/pull/2145)l/2145 * build(deps): bump github.com/klauspost/compress from 1.19.2 to 1.20.1 in /exp by @dependabot[bo[https://github.com/prometheus/client_golang/pull/2144](https://redirect.github.com/prometheus/client_golang/pull/2144)l/2144 * promhttp: vary negotiated metrics responses by @lowga[https://github.com/prometheus/client_golang/pull/2142](https://redirect.github.com/prometheus/client_golang/pull/2142)l/2142 * exp/api/remote: reset pooled buffer before generic marshal by @lowga[https://github.com/prometheus/client_golang/pull/2139](https://redirect.github.com/prometheus/client_golang/pull/2139)l/2139 * api: match complete URL placeholders by @lowga[https://github.com/prometheus/client_golang/pull/2136](https://redirect.github.com/prometheus/client_golang/pull/2136)l/2136 * fix: updates for tsdb blocks handling by @tjh[https://github.com/prometheus/client_golang/pull/1928](https://redirect.github.com/prometheus/client_golang/pull/1928)l/1928 * prometheus: fix modernize lint findings by @kakkoy[https://github.com/prometheus/client_golang/pull/2151](https://redirect.github.com/prometheus/client_golang/pull/2151)l/2151 * build(deps): bump google.golang.org/grpc from 1.82.1 to 1.83.2 in /api/prometheus/v1/paritytest by @dependabot[bo[https://github.com/prometheus/client_golang/pull/2152](https://redirect.github.com/prometheus/client_golang/pull/2152)l/2152 * Cut v1.25.0-rc.0 by @kakkoy[https://github.com/prometheus/client_golang/pull/2154](https://redirect.github.com/prometheus/client_golang/pull/2154)l/2154 * Cut v1.25.0 by @kakkoy[https://github.com/prometheus/client_golang/pull/2164](https://redirect.github.com/prometheus/client_golang/pull/2164)l/2164 #### New Contributors * @SAY-5 made their first contributi[https://github.com/prometheus/client_golang/pull/2065](https://redirect.github.com/prometheus/client_golang/pull/2065)l/2065 * @zenador made their first contributi[https://github.com/prometheus/client_golang/pull/1963](https://redirect.github.com/prometheus/client_golang/pull/1963)l/1963 * @thaJeztah made their first contributi[https://github.com/prometheus/client_golang/pull/2077](https://redirect.github.com/prometheus/client_golang/pull/2077)l/2077 * @mvanhorn made their first contributi[https://github.com/prometheus/client_golang/pull/1987](https://redirect.github.com/prometheus/client_golang/pull/1987)l/1987 * @wieghx made their first contributi[https://github.com/prometheus/client_golang/pull/2091](https://redirect.github.com/prometheus/client_golang/pull/2091)l/2091 * @radianceded made their first contributi[https://github.com/prometheus/client_golang/pull/2114](https://redirect.github.com/prometheus/client_golang/pull/2114)l/2114 * @ajavanma made their first contributi[https://github.com/prometheus/client_golang/pull/2125](https://redirect.github.com/prometheus/client_golang/pull/2125)l/2125 * @ZainnQureshii made their first contributi[https://github.com/prometheus/client_golang/pull/2135](https://redirect.github.com/prometheus/client_golang/pull/2135)l/2135 * @lowgame made their first contributi[https://github.com/prometheus/client_golang/pull/2142](https://redirect.github.com/prometheus/client_golang/pull/2142)l/2142 Full Changelog: <https://github.com/prometheus/client_golang/compare/v1.24.1...v1.25.0> </details> </details> --- ### Configuration 📅 Schedule: (UTC) - Branch creation - At any time (no schedule defined) - Automerge - At any time (no schedule defined) 🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied. ♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox. 🔕 Ignore: Close this PR and you won't be reminded about this update again. --- - [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check this box --- This PR was generated by [Mend Renovate](https://mend.io/renovate/). View the [repository job log](https://developer.mend.io/github/authelia/authelia). <!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0NC4xMzQuMSIsInVwZGF0ZWRJblZlciI6IjQ0LjEzNC4xIiwidGFyZ2V0QnJhbmNoIjoibWFzdGVyIiwibGFiZWxzIjpbImRlcGVuZGVuY2llcyIsImdvIl19--> Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com> Co-authored-by: Amir Zarrinkafsh <3339418+nightah@users.noreply.github.com>	2026-10-14 03:42:49 +00:00

1 2 3 4 5 ...