chore(deps): update all-minor-updates - autoclosed #4
No Assignees
Notifications
Due Date
No due date set.
Dependencies
No dependencies set.
Reference: lucasoskorep/mta-sign#4
Reference in New Issue
Block a user
Delete Branch "renovate/minor"
Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?
This PR contains the following updates:
19.2.9→19.2.1010.4.23→10.4.241.13.2→1.13.416.1.4→16.1.616.1.4→16.1.6v25.4.0→25.5.010.28.1→10.28.219.2.3→19.2.419.2.3→19.2.44.1.0→4.12.0Release Notes
postcss/autoprefixer (autoprefixer)
v10.4.24Compare Source
axios/axios (axios)
v1.13.4Compare Source
Overview
The release addresses issues discovered in v1.13.3 and includes significant CI/CD improvements.
Full Changelog: v1.13.3...v1.13.4
What's New in v1.13.4
Bug Fixes
Infrastructure & CI/CD
refactor: ci and build (#7340) (8ff6c19)
chore: codegen and some updates to workflows (76cf77b)
Migration Notes
Breaking Changes
None in this release.
Deprecations
None in this release.
Contributors
Thank you to all contributors who made this release possible! Special thanks to:
v1.13.3Compare Source
Bug Fixes
Features
undefinedas a value in AxiosRequestConfig (#5560) (095033c)Reverts
Contributors to this release
vercel/next.js (eslint-config-next)
v16.1.6Compare Source
Core Changes
Credits
Huge thanks to @mischnic, @wyattjoh, and @ztanner for helping!
v16.1.5Compare Source
Please refer the following changelogs for more information about this security release:
https://vercel.com/changelog/summaries-of-cve-2025-59471-and-cve-2025-59472
https://vercel.com/changelog/summary-of-cve-2026-23864
nodejs/node (node)
v25.5.0: 2026-01-26, Version 25.5.0 (Current), @aduh95Compare Source
Notable Changes
99a4e51f93] - crypto: update root certificates to NSS 3.119 (Node.js GitHub Bot) #61419fbe4da5725] - (SEMVER-MINOR) deps: add LIEF as a dependency (Joyee Cheung) #611670feab0f083] - (SEMVER-MINOR) deps: add tools and scripts to pull LIEF as a dependency (Joyee Cheung) #61167e91b296001] - (SEMVER-MINOR) fs: add ignore option to fs.watch (Matteo Collina) #61433b351910af1] - (SEMVER-MINOR) sea: add--build-seato generate SEA directly with Node.js binary (Joyee Cheung) #61167957292e233] - (SEMVER-MINOR) sea: split sea binary manipulation code (Joyee Cheung) #61167f289817ff8] - (SEMVER-MINOR) sqlite: enable defensive mode by default (Bart Louwers) #61266069f3603e2] - (SEMVER-MINOR) sqlite: add sqlite prepare options args (Guilherme Araújo) #613115a984b9a09] - src: use node- prefix on thread names (Stewart X Addison) #6130775c06bc2a8] - (SEMVER-MINOR) test: migrate to--build-seain existing SEA tests (Joyee Cheung) #61167cabd58f1cb] - (SEMVER-MINOR) test: use fixture directories for sea tests (Joyee Cheung) #61167ff1fcabfc9] - (SEMVER-MINOR) test_runner: support expecting a test-case to fail (Jacob Smith) #60669Commits
778a56f3c9] - assert,util: fix deep comparison for sets and maps with mixed types (Ruben Bridgewater) #6138832cd18e37f] - async_hooks: enabledHooksExist shall return if hooks are enabled (Gerhard Stöbich) #61054482b2568bc] - benchmark: add SQLite benchmarks (Guilherme Araújo) #61401e9a34263bb] - buffer: make methods work on Uint8Array instances (Neal Beeken) #565788255cdefcf] - build: add--shared-nbytesconfigure flag (Antoine du Hamel) #613418dd379d110] - build: update android-patches/trap-handler.h.patch (Mo Luo) #603691b4b5eb0e4] - build: update devcontainer.json to use paired nix env (Joyee Cheung) #6141486e2a763ad] - build: infer cargo mode with gyp var build_type directly (Chengzhong Wu) #613547e211e6942] - build: add embedtest into native suite (Joyee Cheung) #61357637470e79f] - build: fix misplaced comma in ldflags (hqzing) #61294a1a0f77a45] - build: fix crate vendor file checksums on windows (Chengzhong Wu) #61329d597b8e342] - build,tools: fix addon build deadlock on errors (Vladimir Morozov) #61321b5cdc27ba4] - build,win: improve logs when ClangCL is missing (Mike McCready) #61438ef01f0c033] - build,win: update WinGet configurations to Python 3.14 (Mike McCready) #61431d8a1cdeefe] - child_process: treat ipc length header as unsigned uint32 (Ryuhei Shima) #61344588b00fafa] - cluster: fix port reuse between cluster (Ryuhei Shima) #6014199a4e51f93] - crypto: update root certificates to NSS 3.119 (Node.js GitHub Bot) #61419048f7a5c9c] - deps: upgrade npm to 11.8.0 (npm team) #61466fbe4da5725] - (SEMVER-MINOR) deps: add LIEF as a dependency (Joyee Cheung) #611670feab0f083] - (SEMVER-MINOR) deps: add tools and scripts to pull LIEF as a dependency (Joyee Cheung) #611674bb00d7e3c] - deps: update googletest to8508785(Node.js GitHub Bot) #614176a3c614f27] - deps: update sqlite to 3.51.2 (Node.js GitHub Bot) #6133913c0397d6d] - deps: update icu to 78.2 (Node.js GitHub Bot) #60523098ec6f196] - deps: update ada to v3.4.0 (Yagiz Nizipli) #61315320b576125] - deps: update zlib to 1.3.1-e00f703 (Node.js GitHub Bot) #6113598f5e7cf51] - deps: V8: cherry-pick highway@dcc0ca1(Richard Lau) #61008e326df79c9] - deps: V8: backport209d2db(Zhijin Zeng) #61322ccfd9d9b30] - doc: removevprefix for version references (Mike McCready) #61488b6cc5d77a1] - doc: mention constructor comparison in assert.deepStrictEqual (Hamza Kargin) #60253236d7ee635] - doc: add CVE delay mention (Rafael Gonzaga) #614650729fb6ee7] - doc: update previous version links in BUILDING (Mike McCready) #614570fb464252f] - doc: include OpenJSF handle for security stewards (Rafael Gonzaga) #614543331bdca7c] - doc: clarify process.argv[1] behavior for -e/--eval (Jeevankumar S) #6136694b34c38e2] - doc: remove Windows Dev Home instructions from BUILDING (Mike McCready) #61434a17016ee81] - doc: clarify TypedArray properties on Buffer (Roman Reiss) #61355214fac9d7e] - doc: update Python 3.14 manual install instructions (Windows) (Mike McCready) #614286a32a685a6] - doc: note resume build should not be done on node-test-commit (Stewart X Addison) #613732a8e8dfaf3] - doc: refine WebAssembly error documentation (sangwook) #61382f3caf27f8b] - doc: add deprecation history for url.parse (Eng Zer Jun) #613895ab8057856] - doc: add marco and rafael in last sec release (Marco Ippolito) #61383f83cb1e785] - doc: packages: example of private import switch to internal (coderaiser) #613433d23bcd0e2] - doc: add esm and cjs examples to node:v8 (Alfredo González) #613281d159550e0] - doc: added 'secure' event to tls.TLSSocket (ikeyan) #6106690080d2892] - doc: restore @watilde to collaborators (Daijiro Wachi) #61350a87f7a50f8] - doc: run license-builder (github-actions[bot]) #61348adf5c84701] - doc: clean up writing-and-running-benchmarks.md (Hardanish Singh) #613452be98add0c] - doc: document ALPNCallback option for TLSSocket constructor (ikeyan) #613312db4893c8d] - esm: ensure watch mode restarts after syntax errors (Xavier Stouder) #61232828feb2e6b] - events: remove redundant todo (Gürgün Dayıoğlu) #60595e91b296001] - (SEMVER-MINOR) fs: add ignore option to fs.watch (Matteo Collina) #61433606184fae5] - fs: remove duplicate getValidatedPath calls (Mert Can Altin) #61359434fcd7f8f] - fs: fix errorOnExist behavior for directory copy in fs.cp (Nicholas Paun) #60946bacba16f5e] - fs: fix ENOTDIR in globSync when file is treated as dir (sangwook) #612597697ce0310] - fs: remove duplicate fd validation in sync functions (Mert Can Altin) #613618abd54f597] - gyp: aix: change gcc version detection so CXX="ccache g++" works (Stewart X Addison) #6146424033ee7ea] - http: fix rawHeaders exceeding maxHeadersCount limit (Max Harari) #61285cf56327939] - http2: validate initialWindowSize per HTTP/2 spec (Matteo Collina) #61402696935eeeb] - inspector: initial support storage inspection (Ryuhei Shima) #611393d5e718e38] - lib: fix typo inutil.jscomment (Taejin Kim) #61365f55a5fea00] - lib: fix TypeScript support check in jitless mode (sangwook) #61382b3fbc3c375] - meta: do not fast-track npm updates (Antoine du Hamel) #614752423ecdaef] - meta: fix typos in issue template config (Daijiro Wachi) #61399e2df85a33a] - meta: label v8 module PRs (René) #61325bc9e5f7d4d] - node-api: fix node_api_create_object_with_properties name (Vladimir Morozov) #613194f30c21c59] - node-api: use Node-API in comments (Vladimir Morozov) #6132062d71eb28d] - quic: copy options.certs buffer instead of detaching (Chengzhong Wu) #614034bbbe75ba1] - quic: move quic behind compile time flag (Matteo Collina) #61444b351910af1] - (SEMVER-MINOR) sea: add --build-sea to generate SEA directly with Node.js binary (Joyee Cheung) #61167957292e233] - (SEMVER-MINOR) sea: split sea binary manipulation code (Joyee Cheung) #61167f289817ff8] - (SEMVER-MINOR) sqlite: enable defensive mode by default (Bart Louwers) #612666442229880] - sqlite: add some tests (Guilherme Araújo) #61410069f3603e2] - (SEMVER-MINOR) sqlite: add sqlite prepare options args (Guilherme Araújo) #61311df02d00d61] - src: improve StringBytes::Encode perf on UTF8 (Сковорода Никита Андреевич) #61131e35814ba80] - src: add missing override specifier to Clean() (Tobias Nießen) #61429803ff7d3de] - src: cache context lookup in vectored io loops (Mert Can Altin) #6138758abe99cbf] - src: cache missing package.json files in the C++ package config cache (Michael Smith) #604252a542094e4] - src: use starts_with instead of rfind/find (Tobias Nießen) #6142677cacf6d9d] - src: use C++ nullptr in sqlite (Tobias Nießen) #61416344cc629d4] - src: use C++ nullptr in webstorage (Tobias Nießen) #614079f25cad26c] - src: fix pointer alignment (jhofstee) #613365a984b9a09] - src: use node- prefix on thread names (Stewart X Addison) #61307d4cf423a65] - stream: export namespace object from internal end-of-stream module (René) #614557d8232e34c] - test: add some validation for JSON doc output (Antoine du Hamel) #6141375c06bc2a8] - (SEMVER-MINOR) test: migrate to --build-sea in existing SEA tests (Joyee Cheung) #61167cabd58f1cb] - (SEMVER-MINOR) test: use fixture directories for sea tests (Joyee Cheung) #61167bcffca8911] - test: aix: mark test_threadsafe_function/test flaky on AIX (Stewart X Addison) #6145229399501c1] - test: add implicit test for fs dispose handling with using (Ilyas Shabi) #611403bb481571a] - test: reveal wpt evaluation errors in status files (Chengzhong Wu) #61358a132be7f71] - test: check new WebCryptoAPI enum values (Filip Skokan) #6140672f1463735] - test: split test-esm-loader-hooks (Joyee Cheung) #6137439105e4c5f] - test: aix: mark test-emit-on-destroyed as flaky (Stewart X Addison) #613813f17acfb1c] - test: add webidl web-platform tests (Yagiz Nizipli) #6131689983cf747] - test: update url web-platform tests (Yagiz Nizipli) #6131573c0a242d7] - test: forbid use of named imports for fixtures (Antoine du Hamel) #61228a49d54308e] - test: enforce better never-settling-promise detection (Antoine du Hamel) #60976335cb0b5cc] - test: ensure assertions are reached on all tests (Antoine du Hamel) #608455ee02c789a] - test: ensure assertions are reached on more tests (Antoine du Hamel) #60763141fb82ffb] - test: ensure assertions are reached on more tests (Antoine du Hamel) #60760edf90ce457] - test: useRegExp.escapeto improve test reliability (Antoine du Hamel) #60803f5f9b2dcf6] - test: ensure assertions are reached on more tests (Antoine du Hamel) #60728ec1cbbe0b6] - test_runner: fix memory leaks in runner (Abhishek Kv. Savani) #60860399ac68427] - test_runner: fix coverage report when a directory is named file (Heath Dutton🕴️) #611696e1beda333] - test_runner: print info when test restarts (Xavier Stouder) #61160f5803ccb86] - test_runner: fix rerun ambiguous test failures (Moshe Atlow) #61392a5a4c3eb44] - test_runner: nix dead reporter code (Vas Sudanagunta) #59700ff1fcabfc9] - (SEMVER-MINOR) test_runner: support expecting a test-case to fail (Jacob Smith) #60669ade4fc2338] - tools: copyedit Nix files (Antoine du Hamel) #614477c2242beb9] - tools: validate release commit diff as part oflint-release-proposal(Antoine du Hamel) #61440ca4ebed258] - tools: use ad-hoc flag to lint Nix files (Antoine du Hamel) #6140505ce2c87f3] - tools: fix vcbuild lint-js-build (Vladimir Morozov) #6131841adb54a37] - tools: enforce trailing commas intest/es-module(Antoine du Hamel) #60891eebd732a52] - tools: enforce trailing commas intest/sequential(Antoine du Hamel) #608928b73739e03] - typings: add typing for string_decoder (Taejin Kim) #61368e88dd012ad] - v8: changing total_allocated_bytes to avoid ABI changes (Caio Lima) #60800c75ad3d87d] - v8: add GCProfiler support for erm (Ilyas Shabi) #61191611c179663] - zlib: validate write_result array length (Ryuhei Shima) #61342pnpm/pnpm (pnpm)
v10.28.2: pnpm 10.28.2Compare Source
Patch Changes
Security fix: prevent path traversal in
directories.binfield.When pnpm installs a
file:orgit:dependency, it now validates that symlinks point within the package directory. Symlinks to paths outside the package root are skipped to prevent local data from being leaked intonode_modules.This fixes a security issue where a malicious package could create symlinks to sensitive files (e.g.,
/etc/passwd,~/.ssh/id_rsa) and have their contents copied when the package is installed.Note: This only affects
file:andgit:dependencies. Registry packages (npm) have symlinks stripped during publish and are not affected.Fixed optional dependencies to request full metadata from the registry to get the
libcfield, which is required for proper platform compatibility checks #9950.Platinum Sponsors
Gold Sponsors
facebook/react (react)
v19.2.4: 19.2.4 (January 26th, 2026)Compare Source
React Server Components
yarnpkg/berry (yarn)
v4.12.0Compare Source
v4.11.0Compare Source
v4.10.3Compare Source
v4.10.2Compare Source
v4.10.1Compare Source
v4.10.0Compare Source
v4.9.4Compare Source
v4.9.3Compare Source
v4.9.2Compare Source
v4.9.1Compare Source
v4.9.0Compare Source
v4.8.1Compare Source
v4.8.0Compare Source
v4.7.0Compare Source
v4.6.0Compare Source
v4.5.3Compare Source
v4.5.2Compare Source
v4.5.1Compare Source
v4.5.0Compare Source
v4.4.1Compare Source
v4.4.0Compare Source
v4.3.1Compare Source
v4.3.0Compare Source
v4.2.2Compare Source
v4.2.1Compare Source
v4.2.0Compare Source
v4.1.1Compare Source
Configuration
📅 Schedule: Branch creation - At any time (no schedule defined), Automerge - At any time (no schedule defined).
🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.
♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.
👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.
This PR has been generated by Renovate Bot.
chore(deps): update all-minor-updatesto chore(deps): update all-minor-updates - autoclosedPull request closed