Update dependencies - #273
Merged
Merged
Conversation
danadajian
approved these changes
Sep 22, 2026
renovate
Bot
force-pushed
the
renovate/dependencies
branch
from
September 22, 2026 14:58
318c3fc to
f70d51b
Compare
danadajian
enabled auto-merge (squash)
September 22, 2026 14:58
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
This PR contains the following updates:
8.10.162→8.10.1631.3.14→1.4.21.18.0→1.20.0v3.0.0→v3.1.0v3.0.0→v3.1.01.15.6→1.16.31.15.6→1.16.33.8.4→3.9.84.4.3→4.6.5Release Notes
axios/axios (axios)
v1.20.0Compare Source
v1.20.0 — August 19, 2026
This release hardens runtime option handling, adds RFC 9110 status-code aliases, fixes Node.js and XHR reliability issues, and refreshes project tooling and documentation.
🔒 Security Fixes
🐛 Bug Fixes
🔧 Maintenance & Chores
🌟 New Contributors
We are thrilled to welcome our new contributors. Thank you for helping improve axios:
Full Changelog (axios/axios@v1.19.0...v1.20.0)
v1.19.0Compare Source
This release raises the form-data security floor, adds configuration and type-system capabilities, and fixes NO_PROXY matching, interceptor errors, progress reporting, and serialization edge cases.
v1.18.1Compare Source
v1.18.1 — June 21, 2026
This release focuses on Node HTTP adapter fixes, safer AxiosError serialisation, runtime/type correctness fixes, documentation updates, and dependency maintenance.
🐛 Bug Fixes
encoder.call(this)receives theAxiosURLSearchParamsinstance correctly. (#11019)🔧 Maintenance & Chores
Documentation: Documented sensitive headers and status transition behaviour, prepared cleaned-up docs, added Deno install instructions, and clarified that request data is request-specific (#11007, #11010, #11023, #11025)
Dependencies: Bumped vite, rollup, form-data, js-yaml, and multer across the root project, docs, smoke tests, and module test workspaces. (#11011, #11012, #11013, #11014, #11015, #11016, #11017, #11026)
🌟 New Contributors
We are thrilled to welcome our new contributors. Thank you for helping improve axios:
Full Changelog
dflook/terraform-fmt (dflook/terraform-fmt)
v3.1.0Compare Source
This is one of a suite of terraform related actions - find them at dflook/terraform-github-actions.
You can see the changes for this release in the CHANGELOG
You can specify the action version as:
@v3.1.0to use exactly this release@v3.1to use the latest patch release for the specific minor version@v3to use the latest patch release for the specific major versionv3.0.1Compare Source
This is one of a suite of terraform related actions - find them at dflook/terraform-github-actions.
You can see the changes for this release in the CHANGELOG
You can specify the action version as:
@v3.0.1to use exactly this release@v3.0to use the latest patch release for the specific minor version@v3to use the latest patch release for the specific major versiondflook/terraform-validate (dflook/terraform-validate)
v3.1.0Compare Source
This is one of a suite of terraform related actions - find them at dflook/terraform-github-actions.
You can see the changes for this release in the CHANGELOG
You can specify the action version as:
@v3.1.0to use exactly this release@v3.1to use the latest patch release for the specific minor version@v3to use the latest patch release for the specific major versionv3.0.1Compare Source
This is one of a suite of terraform related actions - find them at dflook/terraform-github-actions.
You can see the changes for this release in the CHANGELOG
You can specify the action version as:
@v3.0.1to use exactly this release@v3.0to use the latest patch release for the specific minor version@v3to use the latest patch release for the specific major versionhashicorp/terraform (hashicorp/terraform)
v1.16.3Compare Source
1.16.3 (September 16, 2026)
BUG FIXES:
Fix handling of destroy=false around create_before_destroy instances (#39169)
Fix function result comparison when there are multiple marks (#39170)
Filter logic for marks could cause values with multiple marks to erroneously fail validations (#39171)
Fix issue with import provider resolution (#39185)
v1.16.2Compare Source
1.16.2 (September 9, 2026)
BUG FIXES:
v1.16.1Compare Source
1.16.1 (September 2, 2026)
BUG FIXES:
cloud: Fixed a bug causing the CLI to pause indefinitely after a run task failure with pending policy evaluations (#38751)
Support referencing modules containing dynamic sources in Terraform Test (#38950)
stacks: Fixed validation to ensure the provider versions in the lock file and configuration are compatible. (#38829)
Fix panic when import identity references sensitive value (#39013)
import: Fixed a bug where import blocks would be ignored when multiple imports targeted different instances of a resource config using
for_eachorcount. (#39068)state show: Fix a panic when given an attribute path instead of a resource instance address (#39087)
Fix create_before_destroy ordering in some combinations of changes (#39091)
v1.16.0Compare Source
1.16.0 (August 26, 2026)
NEW FEATURES:
Terraform now stores planned private data for providers, allowing provider-specific state to be preserved across plan and apply. (#37986)
terraform_data: The newstoreblock can hold ephemeral and sensitive values across plan and apply. (#38298)Providers can now use nested blocks as computed values (#38305)
import:
importblocks inside modules are now supported. (#38352)Terraform is now available as a pre-built binary for Linux s390x (zLinux). (#38384)
Resource action triggers can now use
on_failuremodes ofhalt,taint, orcontinue. (#38722)ENHANCEMENTS:
state show: The
state showcommand can now produce machine-readable output when supplied with the-jsonflag (#23940)workspace: The
workspace listcommand can now produce machine-readable output when supplied with the-jsonflag (#38397)test: Terraform now reports which resources were left behind when
skip_cleanupis set. (#38449)stacks: Action configurations now have access to a
callersymbol containing the object value of the calling resource. (#38668)Actions can now use
before_destroyandafter_destroyevents. (#38668)cloud: Terraform now displays a summary of policy evaluation outcomes for
planandapplyruns against HCP Terraform. (#38715)policy: Terraform now resolves policy plugin credentials from the configured cloud or remote backend during
init,plan, andapply, rather than requiring the plugin to read credentials itself. (#38716)graph: The
terraform graphcommand can now output graphs in Mermaid format using the-format=mermaidflag. (#38719)Child module outputs with unreferenced deprecated nested attributes no longer return deprecation warnings. (#38778)
Resource
lifecycleblocks now supportdestroy = falseto prevent a resource from being destroyed. (#38784)The
contains()function can now test fornullvalues. (#38792)console: The
terraform consolecommand now accepts an optional-scope=<module address>flag, which can be used to evaluate expressions within the scope of a module or a specific module instance. (#31861)-invokecan now be combined with-targetto specify the calling resource instance when multiple resources trigger the same action. (#38845)The
terraform stackscommand now automatically infers the target hostname from the local credentials file (credentials.tfrc.json) when neitherTF_STACKS_HOSTNAMEnorTF_CLOUD_HOSTNAMEis set (#38896)BUG FIXES:
importblocks now correctly respect provider local names. (#38338)terraform applyno longer panics when the plan contains a no-op change for a deposed resource that haslifecycle.preconditionorlifecycle.postconditionblocks. (#38586)workspace: Terraform now raises an error if an invalid workspace name becomes selected due to out-of-band changes. (#38594)
test: Terraform now raises a warning when a file referenced via the
-filterflag does not exist. (#38603)init: Terraform no longer removes locks from the dependency lock file for providers configured as
dev_override. (#38634)init: Terraform now warns when unmanaged providers are in use and may impact provider installation. (#38656)
Actions are now invoked with respect to all resource dependencies. (#38668)
Terraform now returns the correct error when an
importtarget exists in state but has no corresponding configuration. (#38782)The
merge()function no longer panics when passednullobjects. (#38792)Allow underscores in provider source address namespaces, so private registry provider addresses are no longer rejected as invalid (#38894)
test: Optional ephemeral values do not have to be set at plan time (#38974)
NOTES:
-upgradeand-lockfile=readonlyflags are now raised earlier in the init process. (#38561)UPGRADE NOTES:
bastion_host_keyis now correctly applied by provisioners. Review your provisioner configurations to verify the configured key is correct before upgrading. (#38318)Previous Releases
For information on prior major and minor releases, refer to their changelogs:
v1.15.9Compare Source
1.15.9 (August 19, 2026)
BUG FIXES:
list,import,backend, andcloud) (#38994)NOTES:
.terraformignorefrom upload to a Terraform Enterprise or HCP Terraform during a run (#39036)v1.15.8Compare Source
1.15.8 (July 8, 2026)
BUG FIXES:
terraform initerror when installing providers sourced from a service-discovery alias advertised by the configured backend (such aslocalterraform.com)NOTES:
command/init: Provider installation was changed to enable future enhancements in the area. This effectively reverses the log message changes from v1.15.
initializing_provider_plugin_messageis being re-introduced to replace the short-lived two message typesinitializing_provider_plugin_from_config_message&initializing_provider_plugin_from_state_message. The change should not have any significant end-user impact aside from the command output. (#38838)command/init: Provider installation was changed to enable future enhancements in the area. This partially reverses the init event order changes from v1.15; module installation will now occur after the backend is initialized. The change should not have any significant end-user impact aside from the command output. (#38838)
v1.15.7Compare Source
1.15.7 (June 24, 2026)
BUG FIXES:
Add concurrency safety to configs.Parser and SourceBundleParser (#38745)
Fix submodule variable validation during init (#38770)
prettier/prettier (prettier)
v3.9.8Compare Source
v3.9.7Compare Source
🔗 Changelog
v3.9.6Compare Source
v3.9.5Compare Source
diff
Markdown: Cap ordered list mark at 999,999,999 (#19351 by @tats-u)
CommonMark parsers only support ordered list item numbers up to 999,999,999.
With this change, Prettier now caps the ordered list item number at 999,999,999 to ensure that the output is correctly parsed as an ordered list by CommonMark parsers. Numbers larger than 999,999,999 are not parsed as list item numbers and are left unchanged in the output:
Markdown: Avoid corrupting empty link with title (#19487 by @andersk)
Do not remove
<>from an inline link or image with an empty URL and a title, as this removal would change its interpretation.Less: Remove extra spaces after
[in map lookups (#19503 by @kovsu)CSS: Prevent addition space in
type()with+(#19516 by @bigandy)This fixes the addition space before
+in CSStype()declaration. For exampletype(<number>+)was being converted intotype(<number> +)which is invalid CSS and does not work.Less: Remove spaces between merge markers and colons (#19517 by @kovsu)
Markdown: Preserve wiki links with aliases (#19527 by @kovsu)
TypeScript: Fix comments being dropped on shorthand
typeimport/export specifiers (#19565 by @kirkwaiblinger)Miscellaneous: Preserving comments'
placementproperty (#19567 by @Janther)Prettier@3.9.0 deleted an undocumented property on comments, which was already used by plugins,
comment.placementis now available again after comment attach.Flow: Stop enforcing empty module declaration to break (#19568 by @fisker)
Angular: Support expression for exhaustive typechecking (#19571 by @fisker)
TypeScript: Ignore comments inside mapped type when checking type parameter comments (#19572 by @fisker)
Less: Fix adjacent block comments being corrupted (#19574 by @kovsu)
JavaScript: Handle dangling comments in
SwitchStatement(#19581 by @fisker)TypeScript: Remove space in comment-only object type (#19583 by @fisker)
v3.9.4Compare Source
v3.9.3Compare Source
v3.9.2Compare Source
v3.9.1Compare Source
v3.9.0Compare Source
diff
🔗 Release Notes
v3.8.5Compare Source
colinhacks/zod (zod)
v4.6.5Compare Source
Commits:
d2b135cdocs: add the 4.6.x patch highlights to the 4.6 postf1448f7docs: fold the 4.6.x patch highlights into the 4.6 post's own sectionsde65a5cdocs: lead the properties section with the check and add a Zod Mini tab (#6598)56222cdfeat(instanceof): key the .properties() shape off the instance type (#6600)ca0229aRevert "feat: add z.currencyCode() over a vendored ISO 4217 list, refreshed weekly by CI (#6595)"cc4cd4eRevert "Revert "feat: add z.currencyCode() over a vendored ISO 4217 list, refreshed weekly by CI (#6595)""0f3f5ee4.6.559bbc03chore: re-pin the integration peers to the workspace zod after the 4.6.5 bumpv4.6.4Compare Source
A patch on top of 4.6.3.
d6bc1e30feat: addz.currencyCode()over a vendored ISO 4217 list, refreshed weekly by CI (#6595)ad32d751perf:z.url()rejects an invalid URL withURL.canParse()instead of a throwing constructor, about 50x faster; fewer allocations on the validation path (#6588)2bb08717chore: re-pin the integration peers to the workspace zod after the 4.6.4 bumpf6e1701achore(deps): bump next to 15.5.25 and vite to 7.3.6 (#6153)v4.6.3Compare Source
A patch on top of 4.6.2.
413cce9afix(v4): make z.properties() a check again (#6594) — removes the standalonez.properties()schema from 4.6.0;z.instanceof().properties()and.check(...z.properties())are unchanged75d63ee1docs: show only the.properties()method form in the 4.6 post46da9572docs: match the error-message examples to what the parsers emitv4.6.2Compare Source
Commits:
a00c3f3docs: use Trigger.dev's brand-kit lockups for the platinum card0c483c5docs: Zod 4.6 announcement post (#6546)9446b5cfix: preserve undefined prefault outputs and object keys (#6587)e359f734.6.2v4.6.1Compare Source
A patch on top of 4.6.0.
b12aa523fix: preserve unique tags with defaulted discriminators (#6582) — closes #6577dd9c36fafix(v4): defer recursive object index inference (#6580)3b154992feat(lang): add Tajik (tg) locale (#6581) by @ismoil772efa8b80ci: give the npm wait a real budget and drop the back-publish path (#6583)v4.6.0Compare Source
Commits:
908c9e1fix(docs): retry the GitHub stars fetch and log the real status93186cadocs(wiki): drop the zod-compiler benchmark (#6505)8ce9e8dfeat(mini): publish Zod Mini as the standalone @zod/mini package (#6491)2956c4cchore(mini): sync @zod/mini to 4.5.4abd41addocs(wiki): move plans and comparisons into a gitignored internal/ (#6506)8106573chore(docs): build with Turbopackc7ec94dci: check zod and @zod/mini lockstep on npm after every publish (#6507)c46eeffchore: narrow blanket biome-ignore comments (#6504)a0898b4ci: wait hours for npm to serve a publish, not ten minutes (#6502)1c0bce0docs: bring the 4.5 charts and worked examples into the docs pages70eb2c0docs: drop the traits section and the compilation feature bullet43b9bfcdocs: drop the bound-methods section from the Zod package pagecd4f9a6perf(v4): report Standard Schema issues without constructing a ZodError (#6509)f3cb364docs: surface the blog on the home page and in the sidebarf3e7c72fix(docs): render the docs 404 page inside the (doc) layout oncef412178ci: publish @zod/mini to JSR in lockstep with npm (#6510)5ff9566Stop re-exporting the compile internals from zod/v4/core (#6511)40b4d0bfix(ci): read zod's latest version with npm view when picking the backfill dist-taga6b4939Mark the compile internals @internal instead of hiding them (#6518)3195ed0docs: label the memory chart like the compile chart8cd1250docs: center the memory chart callout labelsff56a55docs: center the memory chart callout labels and pad them off the numberfb2fedfdocs: tighten the memory chart callout, pad the canvas, say "less memory"93f3ab3docs: replace the blog navbar's GitHub icon with a star-count pill7ae49d6docs: drop the circle around the star pill's GitHub mark and center it on the pill's arcb801439bench: add typebox (compiled and dynamic) to the moltar cross-library harness1ec6b7cdocs: add an RSS feed to the blog at /blog/rss.xml08ba069perf(v4): read Luhn digits with charCodeAt instead of string indexing (#6529)319f47fEmit a length-aware base64url pattern in toJSONSchema (#6527)a2a019aAccept enum-typed targets in z.toZod (#6528)74f9a6ddocs: drop the toZod enum block from basics and pin the page's curation rule in a commentf83ab51fix(v4): reject component-only strings from z.emoji() (#6532)84dd3b0perf: build literal and enum pattern regexes lazily (#6531)0227e53docs: bump the star pill's GitHub mark to 20px68a609aWiden literal inputs in property check types (#6520)2ec972erefactor: collapse toZod's enum leaf normalizer to a dummy union (#6533)bc1157edocs: use a Response example for z.properties()07c43e2Keep the runtime base64 regexes linear so composed parse paths cannot overflow (#6534)bec73beperf(v4): build the safeParse error on first read (#6519)bf99021perf: move util.cached's accessor to a prototype (#6537)69f2a7fCollapse toZod's normalizer and move its docs to the API reference (#6539)abfb389feat(v4): make z.properties() a schema, and give z.instanceof() a .properties() method (#6536)51caf01refactor: collapse cachedInternal back into cached (#6540)81ded99perf: answer z.validate from the compiled fast path on invalid input (#6538)eca9687fix(v4): enforce the six JSON Schema keywords fromJSONSchema silently dropped (#6535)68aca3ddocs: cover the 4.5 API surface that never made it into the reference18e71c7Rename the JSON Schemaprocesshelper so bundler polyfills cannot collide (#6541)90269c6Keep a numeric TS enum's reverse-mapping keys out of.options(#6542)4d73088Release the parsed input once a failing safeParse builds its error (#6543)cafbee4fix(v4): parse recursive schemas built by a factory ([Configuration
📅 Schedule: (UTC)
* 0-3 * * 1)🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.
♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.
👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.