Update all non-major dependencies by renovate[bot] · Pull Request #187 · nvuillam/node-java-caller

renovate · 2026-08-11T23:28:13Z

This PR contains the following updates:

Package	Change	Type	Update
eslint (source)	`10.8.1` → `10.10.0`	devDependencies	minor
globals	`17.9.0` → `17.12.0`	devDependencies	minor
js-yaml	`5.2.3` → `5.4.1`	overrides	minor
oxsecurity/megalinter	`v10.0.0` → `v10.1.0`	action	minor
serialize-javascript	`7.1.0` → `7.1.1`	overrides	patch

Release Notes

eslint/eslint (eslint)

sindresorhus/globals (globals)

`v17.12.0`

Compare Source

Update globals (2026-09-01) (#353) 50a2119
Add __webpack_layer__ global (#351) 779a11a

`v17.11.0`

Compare Source

`v17.10.0`

Compare Source

nodeca/js-yaml (js-yaml)

`v5.4.1`

Compare Source

`v5.4.0`

Compare Source

Added

Added the scalarStyleRules dumper option to customize string formatting.
See Scalar styling for details.

Changed

[breaking] Flattened the low-level AST node style representation. Scalar
and collection nodes now use SCALAR_STYLE and COLLECTION_STYLE values;
explicit tags use the separate tagged property. Alias nodes now contain
only kind and anchor. This only affects code that directly constructs or
edits AST nodes.
[breaking] The sortKeys option was rewritten using AST mutation to avoid
side effects.
Reworked scalar style selection. This can change formatting without changing
loaded values; in particular, whitespace-only strings are now double-quoted.

Fixed

Accept a byte order mark at the start of each document in a stream, #791.
Produce valid flow mappings with quoteFlowKeys and flowSkipColonSpace,
including alias and property-only keys, #786.
Preserve empty scalar items when converting block sequences to flow style.
Do not apply the 1024-character simple-key limit to flow mapping keys.
Count Unicode code points, rather than UTF-16 code units, for the
1024-character simple-key limit.
Add an explicit document-end marker after keep-chomped block scalars when
needed to preserve trailing newlines.

`v5.3.0`

Compare Source

This release focuses on reworking the documentation and making small
architectural improvements before moving forward.

Added

Added completely new documentation.
Exported DUMP_SCHEMA, the default schema used by the dumper.
Added YAMLException.throwAt() for throwing an error at a source position.

Changed

Changed flat constant exports to grouped exports: EVENT_ID, SCALAR_STYLE,
COLLECTION_STYLE, and CHOMPING_MODE, along with their value types. The old
exports are still preserved, but deprecated.
Made identify mandatory for custom tag definitions. Use
identify: () => false for load-only tags.

Deprecated

Deprecated flat constant exports. Use grouped ones instead.

Removed

Removed the MERGE_KEY export (not used anymore after last fixes).

Fixed

Validate << sequence items at merge time, so aliased merge sources are
checked too.
Resolve << outside of a mapping key as the plain string '<<', matching
v4, instead of leaking an internal symbol into the result.

oxsecurity/megalinter (oxsecurity/megalinter)

`v10.1.0`

Compare Source

Core
- MegaLinter now prints a crash traceback when it is killed by a fatal signal (SIGSEGV, SIGBUS…), instead of exiting silently with no clue about what happened (#8779)
- The LLM Advisor supports a new provider, OrcaRouter, an OpenAI-compatible AI gateway: set LLM_PROVIDER: orcarouter and ORCAROUTER_API_KEY in your environment to get fix suggestions routed through OrcaRouter (see the OrcaRouter provider page) (#8826)
New linters
- biome, one fast toolchain linting, formatting and sorting imports of JavaScript, TypeScript, JSX, TSX, JSON, CSS and GraphQL files, available as JAVASCRIPT_BIOME, TYPESCRIPT_BIOME, JSX_BIOME, TSX_BIOME, JSON_BIOME, CSS_BIOME and GRAPHQL_BIOME (#8706)
  - Activated only when a biome.json or biome.jsonc configuration file is found in the repository
  - Supports APPLY_FIXES (safe fixes with --write) and native SARIF output
  - EXCLUDED_DIRECTORIES are forwarded in project lint mode through a generated configuration extending the workspace one
- ApexGuru, the AI-driven engine of Salesforce Code Analyzer, available as SALESFORCE_CODE_ANALYZER_APEXGURU (#8820)
  - Detects SOQL inefficiencies, critical anti-patterns and scalability hotspots in your .cls and .trigger files, with line-level highlights, severity ratings and suggested fixes
  - The analysis runs in a connected Salesforce org, not locally: store the auth url of the target org in a CI secret named SFDX_AUTH_URL, and MegaLinter logs in to that org before the scan
  - The scan is sent to that org explicitly, so a .sfdx/sfdx-config.json left at the root of the repository, usually naming a long gone scratch org, can not hijack it
  - Inactive by default: it activates only when SFDX_AUTH_URL is defined, so nothing changes for existing Salesforce projects
  - Requires ApexGuru to be enabled on the org: it needs Scale Center, and is available for Unlimited Edition production orgs, full copy sandboxes, Signature orgs and Scale Test customers
  - A run where the engine could not analyze anything is reported as an error rather than a silent success, together with the reason and how to fix it
  - Supports native SARIF output, like the other Code Analyzer engines
- tofu fmt, the built-in formatter of OpenTofu (the MPL-2.0 licensed fork of Terraform), available as TERRAFORM_TOFU_FMT (#8729)
  - Analyzes .tofu files only, the OpenTofu specific extension, so it never doubles up with TERRAFORM_TERRAFORM_FMT which keeps .tf
  - To format your .tf files with OpenTofu instead, set TERRAFORM_TOFU_FMT_FILE_EXTENSIONS: [".tofu", ".tf", ".tfvars"] and DISABLE_LINTERS: [TERRAFORM_TERRAFORM_FMT]
  - Supports APPLY_FIXES to rewrite files in the canonical OpenTofu style
- tofu validate, the built-in validator of OpenTofu, available as TERRAFORM_TOFU_VALIDATE (#8793)
  - Reports what formatters and rule-based linters can not see: unsupported or missing arguments, wrong attribute types, references to undeclared variables, locals or outputs, and broken module input contracts
  - Analyzes .tofu files only, like TERRAFORM_TOFU_FMT, leaving .tf free for a future terraform validate linter. To validate .tf files, set TERRAFORM_TOFU_VALIDATE_FILE_EXTENSIONS: [".tofu", ".tf"]
  - Validates one whole module per directory, so every .tf and .tofu file of a selected directory is parsed and can produce diagnostics
  - Every directory is initialized with tofu init -backend=false beforehand, so no state is read, no state lock is taken and no cloud credentials are needed
  - Set TERRAFORM_TOFU_VALIDATE_INIT_ARGUMENTS to change those initialization arguments, for example adding -lockfile=readonly to have an out-of-sync .terraform.lock.hcl reported as an error instead of being updated
Disabled linters
- COFFEE_COFFEELINT is disabled: CoffeeScript tooling is discontinued, and coffeelint can not receive EXCLUDED_DIRECTORIES in project lint mode (it has no exclusion option and reads .coffeelintignore only from its working directory). The linter will be removed in a future version (#8720)
- GRAPHQL_GRAPHQL_SCHEMA_LINTER is disabled: graphql-schema-linter is unmaintained, with no release or commit since May 2022, and its peer dependency range pins graphql to ^15 || ^16, which held the whole GraphQL install back from graphql v17. Use GRAPHQL_BIOME to lint your GraphQL files. The linter will be removed in a future version (#8894)
Re-enabled linters
- spectral is back as API_SPECTRAL, together with the API descriptor, to lint your OpenAPI, AsyncAPI and Arazzo specifications (#8717)
  - It was removed in v10.0.0 because it crashed at startup on every run: the cause has been found and fixed
  - Nothing to change in your configuration: API_SPECTRAL works again in ENABLE_LINTERS / DISABLE_LINTERS, and the default ruleset file is still .spectral.yaml
Linters enhancements
- TERRAFORM_TFLINT now documents the tflint native GITHUB_TOKEN_github_com variable to authenticate plugin downloads on github.com, which is the recommended way to fix tflint --init failures when your GITHUB_TOKEN targets a GitHub Enterprise instance (#8795)
  - Set your github.com token in GITHUB_TOKEN_github_com, then list it in TERRAFORM_TFLINT_UNSECURED_ENV_VARIABLES: tflint gives it priority over GITHUB_TOKEN, which other linters and reporters keep using
  - PAT_GITHUB_COM is deprecated: it still works and now logs a warning, and will be removed in a future major release
- CLOJURE_CLJSTYLE now forwards EXCLUDED_DIRECTORIES through its native repeatable --ignore argument, instead of a temporary .cljstyle written in your repository. Exclusions are now also applied when your repository already has a .cljstyle config, whose own ignore patterns are preserved (#8720)
- SQL_SQLFLUFF does not receive EXCLUDED_DIRECTORIES in project lint mode anymore: sqlfluff reads path exclusions only from a .sqlfluffignore, .sqlfluff or pyproject.toml located inside the analyzed sources, where MegaLinter used to write a temporary file. List the directories to skip in your own .sqlfluffignore, or keep the default list_of_files lint mode where MegaLinter filters the files itself (#8720)
- SARIF output is now available for 13 more linters: zizmor, bicep_linter, cppcheck, clj-kondo, roslynator, htmlhint, protolint, sqlfluff, swiftlint, osv-scanner, trufflehog, jscpd and lintr. Enable it the same way as any other SARIF-capable linter, with SARIF_REPORTER: true (optionally scoped with SARIF_REPORTER_LINTERS) (#8715)
  - The 4 Salesforce Code Analyzer engines (SALESFORCE_CODE_ANALYZER_APEX, _AURA, _LWC, _FLOW) also gained SARIF output: their report switches from CSV to SARIF automatically when SARIF reporting is requested
  - csharp_roslynator is bumped from 0.12.0 to 0.13.0, the first release including its SARIF output support
  - clj-kondo's upstream SARIF output currently nests the region property one level too deep, which may affect line/column display in strict SARIF consumers (clj-kondo/clj-kondo#2345)
- Prettier linters (JSON_PRETTIER, YAML_PRETTIER, JAVASCRIPT_PRETTIER, TYPESCRIPT_PRETTIER) now tell you how to install a Prettier plugin when one declared in your .prettierrc fails to load with Cannot find package ... imported from noop.js (#6980)
  - Prettier v3 resolves plugins with a native ESM import() from the workspace and ignores NODE_PATH, so plugins installed with the default cwd: root land in /node-deps where Prettier never looks for them
  - The guidance surfaced in the log is to install them through <LINTER_KEY>_PRE_COMMANDS with cwd: workspace, which keeps plain package names in .prettierrc so the very same config still works when you run Prettier locally without MegaLinter
Fixes
- MegaLinter does not crash anymore with This module only works with the 'fork' start method right after Processing linters on [N] parallel cores, which made every v10.0.0 run fail unless PARALLEL: false was set (#8808)
  - The PARALLEL: false workaround is not needed anymore, on the main image as well as on custom flavors
  - Messages logged by linters running in parallel are back in the console and in megalinter.log, including the extra output of LOG_LEVEL: DEBUG
- PAT_GITHUB_COM is now hidden from the linters commands, like every other credential variable (#8795)
  - The GitHub Personal Access Token used by TERRAFORM_TFLINT was sent in cleartext to every linter, as it matched no pattern of SECURED_ENV_VARIABLES_DEFAULT
  - The default list now hides any variable named PAT, PAT_* or *_PAT (PAT_GITHUB_COM, AZURE_PAT...), and tflint --init still receives the real token
  - Add such a variable to <LINTER_KEY>_UNSECURED_ENV_VARIABLES if one of your linters really needs to read it
- Fixed random Segmentation fault crashes of MegaLinter itself, which stopped the whole run with no error message (#8733). MegaLinter threads now get a full-size stack instead of the 128 KiB default of the Alpine images
- Fixed leaked git processes when APPLY_FIXES is active: one was left behind by every fixer linter, which could exhaust the available file descriptors on long runs (#8779)
- Fixed random crashes of project-mode linters (REPOSITORY_TRIVY, REPOSITORY_GRYPE, REPOSITORY_SYFT…) caused by MegaLinter writing temporary ignore files inside the analyzed sources: a file appearing then disappearing while another linter walked the repository aborted its scan (walk dir error: ... no such file or directory). MegaLinter now writes only in REPORT_OUTPUT_FOLDER, never in your sources (#8720)
- EXCLUDED_DIRECTORIES and ADDITIONAL_EXCLUDED_DIRECTORIES are now forwarded to project lint mode linters even when the directory is nested, not only when it sits at the root of your repository (#8806)
  - A directory like infrastructure/cdk.out was previously scanned anyway, for example by REPOSITORY_BETTERLEAKS, which reported findings in generated files
  - Excluded entries are now looked up the same way MegaLinter filters files: by directory name, at any nesting level
  - Nothing changes when the excluded directory does not exist in your repository: it is still not sent to the linters
  - This also covers PYTHON_BANDIT, YAML_V8R, CSHARP_DOTNET_FORMAT, VBDOTNET_DOTNET_FORMAT and REPOSITORY_LS_LINT, whose exclusions are anchored on the repository root: they now receive the path of each nested directory found
  - A ^-anchored FILTER_REGEX_EXCLUDE keeps excluding root-level directories only: ^docs/ does not silence findings in packages/a/docs anymore
  - Looking up the excluded directories never descends into an excluded directory, and costs no extra repository scan: it reuses the one MegaLinter already does to list your files, and falls back to a single scan when only changed files are analyzed
- REPOSITORY_TRUFFLEHOG does not silently skip findings anymore in a directory whose name merely ends with an excluded one: with dist excluded, secrets in my-dist/ were not reported (#8811)
- REPORT_OUTPUT_FOLDER is now always excluded from what linters analyze, even when you override EXCLUDED_DIRECTORIES, and even when the folder does not exist yet when a linter starts (#8720)
- The API reporter variables (API_REPORTER, API_REPORTER_URL…) are not flagged as deprecated anymore in the configuration JSON schema: they were collateral damage of the removal of the API descriptor in v10.0.0, and IDEs displayed them as obsolete (#8718)
- REPOSITORY_BETTERLEAKS does not crash the whole MegaLinter run anymore when REPOSITORY_BETTERLEAKS_PR_COMMITS_SCAN: true is used on Azure Pipelines with the default shallow checkout (#8732)
  - The target branch commit is now searched across several reference spellings, so a branch available only locally is found too
  - When the Pull Request commit range can not be determined — on any platform — betterleaks now logs a warning explaining how to fix your checkout and scans the whole repository, instead of aborting the run
  - The Pull Request scan setup documentation lost when gitleaks was replaced by betterleaks is restored on the betterleaks page: checkout depth for each platform, Azure Pipelines variables to forward to the container, and how to compute the SHAs yourself (#8731)
- The REPOSITORY_BETTERLEAKS Pull Request scan variables (REPOSITORY_BETTERLEAKS_PR_COMMITS_SCAN, REPOSITORY_BETTERLEAKS_PR_SOURCE_SHA, REPOSITORY_BETTERLEAKS_PR_TARGET_SHA) are now declared in the configuration JSON schema, so your IDE stops flagging them as unknown keys in .mega-linter.yml (#8805)
- Bitbucket Pipelines is now recognized as a Pull Request context: PULL_REQUEST optimizations that were silently skipped there are applied again (#8780)
  - REPOSITORY_CHECKOV and REPOSITORY_BETTERLEAKS only analyze the Pull Request changes when asked to
  - Set BITBUCKET_PR_ID in your pipeline (Bitbucket provides it on Pull Request builds) to benefit from it
- A run where all linters pass does not exit with an error anymore when MegaLinter can not list the files updated by the linters (#8649)
  - Happens on a read-only workspace whose repository uses git-lfs: the required LFS filter has nowhere to write its temporary files, so the git diff used to detect updated files exits 128
  - MegaLinter now logs a warning naming the workspace and the failed command, reports no updated source file, and completes the run. The UPDATED_SOURCES_REPORTER: false workaround is not needed anymore
- REPOSITORY_CHECKOV does not fail anymore with argument -f/--file: expected at least one argument in a Pull Request where no file has been updated (#8802)
  - With VALIDATE_ALL_CODEBASE: false, checkov is now skipped when the Pull Request contains no updated file, instead of scanning the whole project or building an invalid command
  - Any linter using the list_of_files lint mode with no file to analyze is skipped the same way, instead of being called with an empty list of files
Reporters
- Linters reporting in SARIF format no longer show No output available in Pull Request comments and summaries: the details section now names the SARIF report to open and links the MegaLinter artifacts (#8730)
  - Applies to the GitHub, GitLab, Azure and Bitbucket comment reporters and to the markdown summary
  - The link points where the reporter already links its detailed reports, so it follows REPORTERS_ACTION_RUN_URL when you set it
Doc
- Comments are back at the bottom of every documentation page, powered by Giscus and backed by MegaLinter GitHub Discussions: ask a question or share a tip right from the page it applies to. The previous utteranc.es widget had silently stopped rendering
- megalinter.io gets a dark mode: use the toggle in the header, or let it follow your system preference (#8848)
- Refreshed look and feel, aligned with the OX Security brand: navy, indigo and lime replace the previous purple palette, and the Satoshi typeface is now actually loaded (it was silently falling back to the default font) (#8848)
- New Docker pulls per month graph, showing the growth of MegaLinter adoption since October 2020, displayed in the README and on the Flavors statistics page (#8698)
- Refreshed the MegaLinter references in linters documentation (linter_megalinter_ref_url): verified all existing links, updated moved pages (ktlint, robocop, csharpier, zizmor, ruff, proselint), and opened 47 suggestion PRs on linters repositories that did not mention MegaLinter yet (#8701, #8777)
- New Security linting with ESLint section in the JAVASCRIPT_ES and TYPESCRIPT_ES documentation: states that no security plugin is bundled, shows the PRE_COMMANDS recipe and the createRequire reference needed under flat config, and lists commonly used plugins. Closes the gap left by the "Security Issues (with security plugins)" line, which previously named no plugin and had no working example (#8712)
mega-linter-runner
- Node.js 22 or higher is now required (was 20) (#8710)
- 8 npm dependencies removed (chalk, fs-extra, which, uuid, find-package-json, simple-git, mem-fs, assert), replaced by Node.js built-in modules: faster npx mega-linter-runner startup and a smaller supply-chain attack surface (#8710)
- Fixed mega-linter-runner --version displaying error instead of the version when the npm_package_version environment variable is not set (#8710)
Agent Skills
- The MegaLinter agent plugin now ships its three sub-agents to GitHub Copilot clients (VS Code, Copilot CLI, the Copilot app) (#8821)
  - Agent Plugins 1.0 standardizes skills but not sub-agents, so Copilot loads them from com.github.copilot/agents: the plugin now carries them there, generated from the Claude Code definitions so the two can not drift
  - megalinter-setup installs them correctly outside the plugin too: on Copilot the file name must end with .agent.md in .github/agents/, and the model: haiku override must be dropped
  - The skills stop guessing how they were installed from the skill naming, which only some platforms namespace: the install mode is now read from the filesystem, and you are asked when it stays ambiguous
  - The licence frontmatter key of the four skills is corrected to license, the spelling agents actually read
- megalinter-check now handles the commit MegaLinter pushes itself when the repository uses APPLY_FIXES_MODE: commit (#8713)
  - CI providers ignore pushes made with the CI token, so the branch used to stay stuck on the stale checks of the run that produced the fixes
  - The commit is amended with a 🤖 prefix and re-pushed with --force-with-lease, which re-triggers the checks (you are asked first on the default branch)
  - Nothing is amended when another commit landed after the auto-fix one, when it was already amended, or when you have local commits left to push — a normal push already re-triggers the checks in those cases
- megalinter-setup can now set up a custom flavor repository on request, from creating the repository to publishing and maintaining the image (#8713)
  - It first looks for a custom flavor you already own or administer, to reuse or extend it instead of maintaining a second one
- megalinter-setup in upgrade mode now also updates the installed skills and sub-agents (npx skills update), so the guidance you run matches the MegaLinter version you just upgraded to (#8713)
- The MegaLinter skills are now installable as an agent plugin, so one command brings the four skills and the three sub-agents at once, and keeps them updated (#8791)
  - Claude Code: /plugin marketplace add oxsecurity/megalinter then /plugin install megalinter@megalinter
  - Cursor, GitHub Copilot, Codex, Gemini CLI and Antigravity each have their own install command, listed on the Coding Agents (Plugins) page
  - The sub-agents ship with the plugin on Claude Code and Cursor; elsewhere the skills install alone and run inline
  - npx skills add oxsecurity/megalinter/skills keeps working for every other coding agent
Dev
- REPOSITORY_TRUFFLEHOG tests no longer depend on a third-party endpoint. The good and bad fixtures differed only by a basic-auth credential that trufflehog validated over the network, so the whole test suite went red whenever the runner could not reach that site (#8848)
  - The fixtures now differ by what is detected, the good ones carrying no secret material at all, and the tests drop --only-verified, which stays the production default
  - The .wireit poison fixture gains a private key, so the excluded-directories forwarding guard actually fires instead of being vacuous
- The documentation site is now built with Zensical, the successor of Material for MkDocs, replacing mkdocs, mkdocs-material and mkdocs-glightbox (#8848)
  - mkdocs.yml stays the configuration file, so .automation/build.py nav generation is unchanged; hatch run docs:serve and hatch run docs:build now call zensical
  - Versioned deploys still use mike, from the Zensical-compatible fork squidfunk/mike pinned to a commit SHA and watched by a new Renovate custom manager
  - The Check MkDocs generation workflow becomes Check documentation generation (test-docs.yml) and also runs on docs/** changes
  - Three long-dead pieces of documentation configuration were found and removed or fixed on the way: the disqus template block (Material has no such block, so comments never rendered), the Satoshi, sans-serif theme font (one quoted family name that matched nothing), and the h1[content~=Home] CSS rule (h1 has no content attribute)
- Parallel linters logging does not depend on the multiprocessing start method anymore: init_worker() installs a QueueHandler on the worker root logger, built from the queue and the level passed by process_linters_parallel(), instead of relying on the handlers a forked worker inherits (#8808)
  - Python 3.14 changed the default start method on Linux from fork to forkserver: workers then started with no handler and the default WARNING level, so their records were lost or written directly to their own stdout, bypassing the queue listener and the log file
  - The AssertionError crash itself came from multiprocessing_logging.install_mp_handler(), which asserts the fork start method; the dependency was already dropped in this version
  - New parallel_logging_test.py runs a worker with every start method available on the platform and checks that its records reach the main process handlers
- replacement_env_vars is now declared in the MegaLinter configuration JSON schema (command_info definition, with its var_src / var_dest items) and documented in the Pre-commands page: it was implemented but validated by nothing, as additionalProperties is unset (#8812)
  - pre_post_factory.build_command_env() extracts the child environment build from run_command(), and resolves var_src from the raw configuration instead of the already secured environment, so a secured source variable is not copied as HIDDEN_BY_MEGALINTER
- Crash diagnostics: megalinter.run.enable_crash_diagnostics() enables faulthandler and raises the thread stack size to 8 MiB (the glibc default) before any thread is started, and worker processes enable faulthandler too. musl gives threads a 128 KiB stack and CPython below 3.14.7 miscomputed its stack guard there (cpython#148260), so C-level recursion in a thread - such as pickling the linter object graph in the multiprocessing.Pool handler threads, which reaches the whole Megalinter instance through Linter.master - crashed the process with SIGSEGV instead of raising RecursionError (#8779)
  - Verified on python:3.14.6-alpine: pickling a deeply nested object in a thread exits with signal 11, and either raising the thread stack size or moving to python:3.14.7-alpine turns it into a plain RecursionError
  - faulthandler can not report a stack overflow itself (the handler has no stack left to run on), which is why the crash in #8733 left no output at all; it does report every other fatal signal
- The Docker images assert a Python 3.14.7 floor at build time, the first release carrying the CPython musl thread stack fixes. The python:3.14-alpine3.24 tag stays floating because renovate.json5 scopes the dockerfile manager away from the main Dockerfile, whose FROM lines are generated from descriptors (#8779)
- Retired the cli_lint_mode_project_exclude_workspace_file_name descriptor property and the write_workspace_generated_file() helper, and removed the property from the descriptor JSON schema so a future descriptor can not silently reintroduce a write inside the analyzed sources. Exclusion forwarding now offers three mechanisms only: native CLI flag, generated ignore file in the report folder, generated config via manage_excluded_directories_config() (#8720)
- Deprecation flags of removed linters are now reversible in the configuration JSON schema: build.py clears the deprecated flag and the (deprecated) title prefix of variables whose linter or descriptor is back, instead of only ever adding them (#8718)
- New megalinter/ci_providers/ package, mirroring the api_providers pattern: CiProvider base class plus CiProviderAzurePipelines, CiProviderGithubActions and CiProviderGitlab, exposing get_pr_commit_shas() and a platform specific get_pr_commit_shas_hint() (#8780)
  - ci_providers.get_pr_ci_provider() returns the provider matching the current Pull Request context, falling back to the neutral base provider so callers never handle a missing provider
  - The Azure Pipelines and GitHub Pull Request SHA lookups moved out of BetterleaksLinter, which keeps only the orchestration, and are now covered by ci_providers_test.py outside Docker
- CI platform knowledge is concentrated in megalinter/ci_providers/ instead of being spread across utils, utils_reporter, MegaLinter and the reporters (#8780)
  - reporters/jenkins_ci_vars.py becomes ci_providers/CiProviderJenkins.py: it was never a reporter, it is called from Megalinter.__init__
  - New CiProviderBitbucket, and every provider implements is_current(), so get_ci_provider() resolves the platform running the build
  - CiProvider exposes get_repo_name(), get_branch_name(), get_job_url(), log_section_start/end(), set_output(), publish_job_summary() and markdown_supports_html_details
  - utils.get_git_context_info() and utils_reporter.log_section_start/end() delegate to the provider instead of their platform if/elif chains, and the GitHub run URL (built in 3 places), the Bitbucket step URL (2 places) and the Azure BUILD_BUILDID/BUILD_BUILD_ID fallback are deduplicated
  - utils.is_ci() and utils.is_pr() were missing Bitbucket Pipelines; new utils.is_bitbucket_pr()
  - The comment reporters (GithubCommentReporter, GitlabCommentReporter, AzureCommentReporter, BitbucketCommentReporter) and GithubStatusReporter now get their repository, Pull Request number, tokens, API urls and headers from their provider instead of reading platform variables themselves; they keep only the comment transport and rendering
  - Each reporter instantiates its own platform provider directly rather than calling get_ci_provider(): under Jenkins the running platform is Jenkins, which maps its variables onto the other platforms', so a factory lookup would disable the comment reporters there
  - CiProviderAzurePipelines owns the repository id resolution (SYSTEM_PULLREQUEST_SOURCEREPOSITORYURI parsing, API lookup, BUILD_REPOSITORY_ID fallback) and build_git_api_url(); CiProviderGitlab owns the merge request iid resolution and the python-gitlab auth options
  - GitHub keeps get_auth_token() (GITHUB_TOKEN) and get_user_auth_token() (PAT) separate on purpose: commit statuses need the statuses:write scope that the documented fine-grained PAT does not carry
- spectral is installed in its own node_modules tree (/node-deps-spectral) instead of the shared /node-deps one, which is what made it crash: @prantlf/jsonlint pins ajv to exactly 8.17.1 and so owns the hoisted root copy, while @stoplight/spectral-core requires ajv >= 8.18.0 and gets a nested one, so its hoisted ajv-errors bound to the other ajv instance and ajv generated invalid JavaScript (SyntaxError: Unexpected token ':' at new Function). Any npm linter sharing the tree with an exact-pinned transitive dependency can hit the same trap (#8718)
- 6 Python dependencies removed from the MegaLinter runtime, replaced by standard library equivalents: commentjson, terminaltables and multiprocessing_logging (unmaintained), plus termcolor, regex and the obsolete importlib-metadata backport (#8710)
- Shared linter definitions: linter entries duplicated across several descriptors (eslint, prettier, v8r, dotnet-format, cpplint, cppcheck, clang-format) are now factorized in megalinter/descriptors/shared/*.megalinter-linter.yml files, referenced from descriptors with the new linter-level extends property (shallow merge, descriptor entry properties override the shared ones) (#8705)
- Docker pulls monthly chart: the auto-update workflow now regenerates docs/assets/images/docker-pulls-monthly.svg (new pulls per month since October 2020, all images and registries), via the new .automation/docker_pulls_chart.py called by build.py after the pull counters update (#8698)
  - Historical monthly points are frozen in .automation/generated/docker-pulls-monthly.json (built once from the tracked stats plus a Web Archive reconstruction of the collection gaps); the script only appends newly completed months computed from flavors-stats.json
- Docker pull counters now also track the standalone megalinter-only-* images: their download counts are stored in flavors-stats.json and included in the README badge total (#8698)
- New descriptor activation_rules type variable_is_set, activating a linter as soon as a variable holds a value. The existing variable type can only compare a variable to a fixed expected_value, which can not express "a credential is present" - the condition SALESFORCE_CODE_ANALYZER_APEXGURU needs on SFDX_AUTH_URL (#8820)
  - Linter tests gated on such a variable skip themselves when it is missing, instead of failing: LinterTestRoot.skip_if_required_variables_missing() guards the per-lint-mode and SARIF tests, while the version and help tests keep running since they need no credential
- The release build stages newly generated documentation pages too: build.py staged only already-tracked files (git add -u), so a page created for the first time was left out of the release commit and 404ed on megalinter.io — as docs/licenses/rumdl.md and docs/licenses/zizmor.md still do since v10.0.0
CI
- The generated linter guides in skills/megalinter-fix/linters/ are excluded from the markdown linters: their error-format regexes end with a significant space that markdownlint --fix strips, which corrupted the documented regex and left the working tree dirty, failing the auto-fix commit step on every pull request (#8848)
- Supply-chain hardening of dependency updates: Renovate (minimumReleaseAge) and Dependabot (cooldown) now wait until a release is at least 7 days old before proposing an upgrade, so compromised releases can be caught by the community first. Security fixes are not delayed and still open immediately (#8710)
- New Check agent plugins manifests workflow validating the agent plugin manifests on every change to them or to skills/: .automation/validate_agent_plugins.py checks the root plugin.json against the published Agent Plugins 1.0 schema and keeps the per-vendor manifests consistent with it, then claude plugin validate ./ --strict checks the Claude Code marketplace and plugin manifests (#8791)
- The auto-update workflow patch-bumps the agent plugin version when it regenerates the skills: the plugin follows its own release train, since its fix guides change far more often than MegaLinter is released. plugin.json is the single source of truth, mirrored into the per-vendor manifests by .automation/agent_plugin_manifests.py (called by build.py) (#8791)
- The test workflows forward the SFDX_AUTH_URL repository secret to the test container, so the SALESFORCE_CODE_ANALYZER_APEXGURU lint tests can reach a connected org. The secret is not exposed on pull requests from forked repositories, where those tests skip themselves (#8820)
- The Auto-Update Linters workflow is fixed: entrypoint.sh still installed the MkDocs documentation stack, so build.sh aborted with zensical: command not found since the Zensical migration and no linter version update pull request could be created (#8901)
Linter versions upgrades (44)
- ansible-lint from 26.6.0 to 26.8.0
- biome from 2.5.7 to 2.5.11
- cfn-lint from 1.54.0 to 1.55.1
- checkov from 3.3.9 to 3.3.15
- clippy from 0.1.97 to 0.1.98
- code-analyzer-apex from 5.15.0 to 5.16.0
- code-analyzer-aura from 5.15.0 to 5.16.0
- code-analyzer-flow from 5.15.0 to 5.16.0
- code-analyzer-lwc from 5.15.0 to 5.16.0
- cspell from 10.0.1 to 10.1.1
- djlint from 1.44.1 to 1.44.2
- editorconfig-checker from 3.10.0 to 3.11.1
- eslint from 10.8.0 to 10.9.1
- golangci-lint from 2.12.2 to 2.13.2
- grype from 0.116.1 to 0.118.0
- jscpd from 5.0.14 to 5.0.16
- kingfisher from 1.112.0 to 2.0.0
- npm-package-json-lint from 10.4.1 to 11.0.0
- php-cs-fixer from 3.95.18 to 3.95.23
- phpstan from 2.2.8 to 2.2.9
- powershell from 7.6.4 to 7.6.5
- powershell_formatter from 7.6.4 to 7.6.5
- protolint from 0.56.4 to 0.57.0
- pylint from 4.0.6 to 4.0.7
- pyright from 1.1.411 to 1.1.413
- revive from 1.15.0 to 1.16.0
- robocop from 8.6.0 to 9.0.0
- roslynator from 0.12.0.0 to 0.13.0.0
- rubocop from 1.89.0 to 1.90.0
- ruff from 0.16.2 to 0.16.5
- ruff-format from 0.16.2 to 0.16.5
- rumdl from 0.2.52 to 0.2.62
- secretlint from 13.0.4 to 13.0.5
- semgrep from 1.172.0 to 1.175.0
- snakemake from 9.25.1 to 9.26.1
- spectral from 6.15.0 to 6.16.3
- swiftlint from 0.65.0 to 0.65.1
- syft from 1.50.0 to 1.51.1
- terraform-fmt from 1.15.8 to 1.16.0
- terragrunt from 1.1.2 to 1.1.4
- trivy from 0.73.0 to 0.74.0
- trivy-sbom from 0.73.0 to 0.74.0
- trufflehog from 3.96.0 to 3.97.1
- vale from 3.17.1 to 3.18.0

yahoo/serialize-javascript (serialize-javascript)

`v7.1.1`

Compare Source

What's Changed

fix: fix XSS bypass via split </script payload across function bodies by @okuryu in #226
release: v7.1.1 by @okuryu in #227

Full Changelog: yahoo/serialize-javascript@v7.1.0...v7.1.1

Configuration

📅 Schedule: (UTC)

Branch creation
- At any time (no schedule defined)
Automerge
- At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

If you want to rebase/retry this PR, check this box

This PR was generated by Mend Renovate. View the repository job log.

github-actions · 2026-08-11T23:30:38Z

✅⚠️MegaLinter analysis: Success with warnings

Descriptor	Linter	Files	Errors	Warnings	Elapsed time
⚠️ ACTION	actionlint	4	2	0	0.1s
✅ ACTION	zizmor	4	0	0	1.85s
✅ COPYPASTE	jscpd	yes	no	no	0.87s
✅ JAVASCRIPT	eslint	11	0	0	1.94s
✅ JSON	jsonlint	9	0	0	0.37s
✅ JSON	npm-package-json-lint	yes	no	no	0.5s
✅ JSON	prettier	9	0	0	0.77s
✅ JSON	v8r	9	0	0	15.81s
⚠️ MARKDOWN	markdownlint	7	18	0	0.95s
⚠️ MARKDOWN	markdown-table-formatter	7	1	0	0.35s
✅ REPOSITORY	betterleaks	yes	no	no	0.72s
✅ REPOSITORY	checkov	yes	no	no	23.0s
✅ REPOSITORY	git_diff	yes	no	no	0.02s
✅ REPOSITORY	grype	yes	no	no	63.88s
✅ REPOSITORY	osv-scanner	yes	no	no	0.5s
✅ REPOSITORY	secretlint	yes	no	no	1.39s
✅ REPOSITORY	syft	yes	no	no	2.01s
✅ REPOSITORY	trivy	yes	no	no	10.93s
✅ REPOSITORY	trivy-sbom	yes	no	no	0.42s
✅ REPOSITORY	trufflehog	yes	no	no	4.84s
✅ SPELL	cspell	40	0	0	4.05s
⚠️ SPELL	lychee	27	4	0	0.93s
✅ TYPESCRIPT	eslint	1	0	0	0.38s
✅ TYPESCRIPT	prettier	1	0	0	0.43s
⚠️ TYPESCRIPT	ts-standard	1	1	0	0.43s
✅ YAML	prettier	9	0	0	0.5s
✅ YAML	v8r	9	0	0	7.26s
✅ YAML	yamllint	9	0	0	0.55s

Detailed Issues

⚠️ ACTION / actionlint - 2 errors

.github/workflows/github-dependents-info.yml:55:9: shellcheck reported issue in this script: SC2086:info:1:15: Double quote to prevent globbing and word splitting [shellcheck]
   |
55 |         run: sudo chown -R $USER:$USER .
   |         ^~~~
.github/workflows/github-dependents-info.yml:55:9: shellcheck reported issue in this script: SC2086:info:1:21: Double quote to prevent globbing and word splitting [shellcheck]
   |
55 |         run: sudo chown -R $USER:$USER .
   |         ^~~~

⚠️ SPELL / lychee - 4 errors

📝 Summary
---------------------
🔍 Total...........75
🔗 Unique..........63
✅ Successful......24
⏳ Timeouts.........0
🔀 Redirected.......7
👻 Excluded........47
❓ Unknown..........0
🚫 Errors...........4
⛔ Unsupported......4

Errors in README.md
[403] https://npmjs.org/package/java-caller (at 5:1) | Rejected status code: 403 Forbidden | Followed 1 redirect. Redirects: https://npmjs.org/package/java-caller --[301]--> https://www.npmjs.com/package/java-caller
[403] https://npmjs.org/package/java-caller (at 6:1) | Rejected status code: 403 Forbidden | Followed 1 redirect. Redirects: https://npmjs.org/package/java-caller --[301]--> https://www.npmjs.com/package/java-caller
[403] https://www.npmjs.com/package/java-caller (at 4:1) | Rejected status code: 403 Forbidden
[403] https://www.npmjs.com/package/njre (at 16:145) | Rejected status code: 403 Forbidden

Hint: Followed 7 redirects. You might want to consider replacing redirecting URLs with the resolved URLs. Use verbose mode (`-v`/`-vv`) to see redirection details.
Hint: You can configure accepted/rejected response codes with `-a` or `--accept`

⚠️ MARKDOWN / markdown-table-formatter - 1 error

1 files contain markdown tables to format:
- README.md

⚠️ MARKDOWN / markdownlint - 18 errors

CHANGELOG.md:7:401 error MD013/line-length Line length [Expected: 400; Actual: 442]
CODE_OF_CONDUCT.md:58:44 error MD034/no-bare-urls Bare URL used [Context: "nicolas.vuillamy@gmail.com"]
CODE_OF_CONDUCT.md:71:14 error MD034/no-bare-urls Bare URL used [Context: "https://www.contributor-covena..."]
CODE_OF_CONDUCT.md:76:1 error MD034/no-bare-urls Bare URL used [Context: "https://www.contributor-covena..."]
README.md:66:13 error MD060/table-column-style Table column style [Table pipe is missing space to the left for style "compact"]
README.md:66:27 error MD060/table-column-style Table column style [Table pipe is missing space to the left for style "compact"]
README.md:66:37 error MD060/table-column-style Table column style [Table pipe is missing space to the left for style "compact"]
README.md:66:47 error MD060/table-column-style Table column style [Table pipe is missing space to the left for style "compact"]
README.md:66:1 error MD060/table-column-style Table column style [Table pipe is missing space to the right for style "compact"]
README.md:66:13 error MD060/table-column-style Table column style [Table pipe is missing space to the right for style "compact"]
README.md:66:27 error MD060/table-column-style Table column style [Table pipe is missing space to the right for style "compact"]
README.md:66:37 error MD060/table-column-style Table column style [Table pipe is missing space to the right for style "compact"]
README.md:67:361 error MD055/table-pipe-style Table pipe style [Expected: leading_and_trailing; Actual: leading_only; Missing trailing pipe]
README.md:69:123 error MD060/table-column-style Table column style [Table pipe has extra space to the left for style "compact"]
README.md:73:315 error MD055/table-pipe-style Table pipe style [Expected: leading_and_trailing; Actual: leading_only; Missing trailing pipe]
README.md:74:310 error MD055/table-pipe-style Table pipe style [Expected: leading_and_trailing; Actual: leading_only; Missing trailing pipe]
README.md:75:208 error MD055/table-pipe-style Table pipe style [Expected: leading_and_trailing; Actual: leading_only; Missing trailing pipe]
README.md:76:233 error MD055/table-pipe-style Table pipe style [Expected: leading_and_trailing; Actual: leading_only; Missing trailing pipe]

⚠️ TYPESCRIPT / ts-standard - 1 error

Unable to locate the project file. A project file (tsconfig.json or tsconfig.eslint.json) is required in order to use ts-standard.

See detailed reports in MegaLinter artifacts

Show us your support by starring ⭐ the repository

github-actions · 2026-08-11T23:30:39Z

❌MegaLinter analysis: Error

Descriptor	Linter	Files	Errors	Warnings	Elapsed time
⚠️ ACTION	actionlint	4	2	0	0.07s
✅ ACTION	zizmor	4	0	0	1.97s
✅ COPYPASTE	jscpd	yes	no	no	0.88s
✅ JAVASCRIPT	eslint	11	0	0	0.85s
✅ JSON	jsonlint	9	0	0	0.11s
✅ JSON	npm-package-json-lint	yes	no	no	0.5s
✅ JSON	prettier	9	0	0	0.49s
✅ JSON	v8r	9	0	0	16.21s
⚠️ MARKDOWN	markdownlint	7	18	0	0.72s
⚠️ MARKDOWN	markdown-table-formatter	7	1	0	0.26s
✅ REPOSITORY	betterleaks	yes	no	no	0.79s
✅ REPOSITORY	checkov	yes	no	no	21.96s
✅ REPOSITORY	git_diff	yes	no	no	0.02s
✅ REPOSITORY	grype	yes	no	no	66.86s
❌ REPOSITORY	osv-scanner	yes	1	no	0.59s
✅ REPOSITORY	secretlint	yes	no	no	1.11s
✅ REPOSITORY	syft	yes	no	no	1.96s
✅ REPOSITORY	trivy	yes	no	no	13.13s
✅ REPOSITORY	trivy-sbom	yes	no	no	0.28s
✅ REPOSITORY	trufflehog	yes	no	no	3.49s
✅ SPELL	cspell	40	0	0	3.56s
⚠️ SPELL	lychee	27	4	0	1.1s
✅ TYPESCRIPT	eslint	1	0	0	0.33s
✅ TYPESCRIPT	prettier	1	0	0	0.4s
⚠️ TYPESCRIPT	ts-standard	1	1	0	0.39s
✅ YAML	prettier	9	0	0	0.49s
✅ YAML	v8r	9	0	0	7.75s
✅ YAML	yamllint	9	0	0	0.6s

Detailed Issues

❌ REPOSITORY / osv-scanner - 1 error

Scanning dir .
Starting filesystem walk for root: /
Scanned package-lock.json file and found 161 packages
End status: 31 dirs visited, 82 inodes visited, 1 Extract calls, 6.927551ms elapsed, 6.927652ms wall time

Total 1 package affected by 1 known vulnerability (0 Critical, 0 High, 1 Medium, 0 Low, 0 Unknown) from 1 ecosystem.
1 vulnerability can be fixed.

+-------------------------------------+------+-----------+---------------------+---------+---------------+-------------------+
| OSV URL                             | CVSS | ECOSYSTEM | PACKAGE             | VERSION | FIXED VERSION | SOURCE            |
+-------------------------------------+------+-----------+---------------------+---------+---------------+-------------------+
| https://osv.dev/GHSA-p498-v437-472g | 5.7  | npm       | @humanfs/node (dev) | 0.16.7  | 0.16.8        | package-lock.json |
+-------------------------------------+------+-----------+---------------------+---------+---------------+-------------------+

⚠️ ACTION / actionlint - 2 errors

.github/workflows/github-dependents-info.yml:55:9: shellcheck reported issue in this script: SC2086:info:1:15: Double quote to prevent globbing and word splitting [shellcheck]
   |
55 |         run: sudo chown -R $USER:$USER .
   |         ^~~~
.github/workflows/github-dependents-info.yml:55:9: shellcheck reported issue in this script: SC2086:info:1:21: Double quote to prevent globbing and word splitting [shellcheck]
   |
55 |         run: sudo chown -R $USER:$USER .
   |         ^~~~

⚠️ SPELL / lychee - 4 errors

📝 Summary
---------------------
🔍 Total...........75
🔗 Unique..........63
✅ Successful......24
⏳ Timeouts.........0
🔀 Redirected.......7
👻 Excluded........47
❓ Unknown..........0
🚫 Errors...........4
⛔ Unsupported......4

Errors in README.md
[403] https://npmjs.org/package/java-caller (at 5:1) | Rejected status code: 403 Forbidden | Followed 1 redirect. Redirects: https://npmjs.org/package/java-caller --[301]--> https://www.npmjs.com/package/java-caller
[403] https://npmjs.org/package/java-caller (at 6:1) | Rejected status code: 403 Forbidden | Followed 1 redirect. Redirects: https://npmjs.org/package/java-caller --[301]--> https://www.npmjs.com/package/java-caller
[403] https://www.npmjs.com/package/java-caller (at 4:1) | Rejected status code: 403 Forbidden
[403] https://www.npmjs.com/package/njre (at 16:145) | Rejected status code: 403 Forbidden

Hint: Followed 7 redirects. You might want to consider replacing redirecting URLs with the resolved URLs. Use verbose mode (`-v`/`-vv`) to see redirection details.
Hint: You can configure accepted/rejected response codes with `-a` or `--accept`

⚠️ MARKDOWN / markdown-table-formatter - 1 error

1 files contain markdown tables to format:
- README.md

⚠️ MARKDOWN / markdownlint - 18 errors

CHANGELOG.md:7:401 error MD013/line-length Line length [Expected: 400; Actual: 442]
CODE_OF_CONDUCT.md:58:44 error MD034/no-bare-urls Bare URL used [Context: "nicolas.vuillamy@gmail.com"]
CODE_OF_CONDUCT.md:71:14 error MD034/no-bare-urls Bare URL used [Context: "https://www.contributor-covena..."]
CODE_OF_CONDUCT.md:76:1 error MD034/no-bare-urls Bare URL used [Context: "https://www.contributor-covena..."]
README.md:66:13 error MD060/table-column-style Table column style [Table pipe is missing space to the left for style "compact"]
README.md:66:27 error MD060/table-column-style Table column style [Table pipe is missing space to the left for style "compact"]
README.md:66:37 error MD060/table-column-style Table column style [Table pipe is missing space to the left for style "compact"]
README.md:66:47 error MD060/table-column-style Table column style [Table pipe is missing space to the left for style "compact"]
README.md:66:1 error MD060/table-column-style Table column style [Table pipe is missing space to the right for style "compact"]
README.md:66:13 error MD060/table-column-style Table column style [Table pipe is missing space to the right for style "compact"]
README.md:66:27 error MD060/table-column-style Table column style [Table pipe is missing space to the right for style "compact"]
README.md:66:37 error MD060/table-column-style Table column style [Table pipe is missing space to the right for style "compact"]
README.md:67:361 error MD055/table-pipe-style Table pipe style [Expected: leading_and_trailing; Actual: leading_only; Missing trailing pipe]
README.md:69:123 error MD060/table-column-style Table column style [Table pipe has extra space to the left for style "compact"]
README.md:73:315 error MD055/table-pipe-style Table pipe style [Expected: leading_and_trailing; Actual: leading_only; Missing trailing pipe]
README.md:74:310 error MD055/table-pipe-style Table pipe style [Expected: leading_and_trailing; Actual: leading_only; Missing trailing pipe]
README.md:75:208 error MD055/table-pipe-style Table pipe style [Expected: leading_and_trailing; Actual: leading_only; Missing trailing pipe]
README.md:76:233 error MD055/table-pipe-style Table pipe style [Expected: leading_and_trailing; Actual: leading_only; Missing trailing pipe]

⚠️ TYPESCRIPT / ts-standard - 1 error

Unable to locate the project file. A project file (tsconfig.json or tsconfig.eslint.json) is required in order to use ts-standard.

See detailed reports in MegaLinter artifacts

Show us your support by starring ⭐ the repository

renovate · 2026-08-14T18:52:36Z

⚠️ Artifact update problem

Renovate failed to update an artifact related to this branch. You probably do not want to merge this PR as-is.

♻ Renovate will retry this branch, including artifacts, only when one of the following happens:

any of the package files in this branch needs updating, or
the branch becomes conflicted, or
you click the rebase/retry checkbox if found above, or
you rename this PR's title to start with "rebase!" to trigger it manually

The artifact failure details are included below:

File name: package-lock.json

npm warn Unknown env config "store". This will stop working in the next major version of npm. See `npm help npmrc` for supported config options.
npm error code EOVERRIDE
npm error Override for js-yaml@5.4.1 conflicts with direct dependency
npm error A complete log of this run can be found in: /runner/cache/others/npm/_logs/2026-09-05T16_36_41_385Z-debug-0.log

renovate Bot changed the title ~~Update dependency globals to v17.10.0~~ Update dependency globals to v17.11.0 Aug 12, 2026

renovate Bot force-pushed the renovate/all-minor-patch branch from fa4646a to 77fd348 Compare August 12, 2026 15:42

renovate Bot changed the title ~~Update dependency globals to v17.11.0~~ Update all non-major dependencies Aug 14, 2026

Update all non-major dependencies

6ea1e12

renovate Bot force-pushed the renovate/all-minor-patch branch from 77fd348 to 6ea1e12 Compare September 5, 2026 16:36

Navigation Menu

Uh oh!

Update all non-major dependencies - #187

Update all non-major dependencies#187
renovate[bot] wants to merge 1 commit into
mainfrom
renovate/all-minor-patch

renovate Bot commented Aug 11, 2026 •

edited

Loading

Uh oh!

github-actions Bot commented Aug 11, 2026

Uh oh!

github-actions Bot commented Aug 11, 2026 •

edited

Loading

Uh oh!

renovate Bot commented Aug 14, 2026 •

edited

Loading

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants

Uh oh!

Conversation

renovate Bot commented Aug 11, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Release Notes

Added

Changed

Fixed

Added

Changed

Deprecated

Removed

Fixed

What's Changed

Configuration

Uh oh!

github-actions Bot commented Aug 11, 2026

✅⚠️MegaLinter analysis: Success with warnings

Detailed Issues

Uh oh!

github-actions Bot commented Aug 11, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

❌MegaLinter analysis: Error

Detailed Issues

Uh oh!

renovate Bot commented Aug 14, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

⚠️ Artifact update problem

File name: package-lock.json

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants

renovate Bot commented Aug 11, 2026 •

edited

Loading

github-actions Bot commented Aug 11, 2026 •

edited

Loading

renovate Bot commented Aug 14, 2026 •

edited

Loading