chore(deps): update all non-major dependencies - #596
Open
renovate[bot] wants to merge 1 commit into
Open
Conversation
Contributor
Author
|
renovate
Bot
force-pushed
the
renovate/all-minor-patch
branch
2 times, most recently
from
August 4, 2026 04:44
d0108b3 to
7c90160
Compare
renovate
Bot
force-pushed
the
renovate/all-minor-patch
branch
from
August 6, 2026 08:49
7c90160 to
4a28164
Compare
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
This PR contains the following updates:
2.96.0→2.97.0v1.19.1→v1.19.2v0.0.22→v0.0.241.57.0→1.58.03.7.1→3.20.3Warning
Some dependencies could not be looked up. Check the Dependency Dashboard for more information.
Release Notes
cli/cli (gh)
v2.97.0: GitHub CLI 2.97.0Security
Four security vulnerabilities have been identified, and fixed, in this release. Users are advised to update gh to version
v2.97.0as soon as possible.Several commands (including
gh gist view,gh api,gh pr diff,gh release download --output -,gh codespace logs,gh skills preview, andgh agent-task view/create) printed externally controlled content without neutralizing terminal escape sequences, allowing escape sequence injection into a user's terminal.See GHSA-3m3g-3wcr-px46 for more information.
Some request URLs were built without escaping their variable path components, so a value containing URL path metacharacters could alter the request path and cause
ghto address a different resource than intended.See GHSA-4fjg-2h4q-fwg3 for more information.
gh auth status(without--show-token) could print a portion of the authentication token in plaintext for token types whose format contains an underscore after the prefix, such asgithub_pat_*,ghs_*, andghu_*.See GHSA-cg6r-mpgc-h9mm for more information.
gh attestation verifybuilt the certificate matcher from--signer-repoand--signer-workflowwithout escaping regex metacharacters, so a lookalike repository or workflow name could satisfy a matcher intended for a trusted signer and bypass attestation verification.See GHSA-mm27-mwq9-fr5g for more information.
Address project fields and items by name in
gh projectgh project item-editandgh project item-listcan now reference project fields and single-select options by name:What's Changed
✨ Features
gh project item-editby @zwick in #13807gh project item-listby @zwick in #13823gh skillagents by @tommaso-moro in #13987🐛 Fixes
📚 Docs & Chores
OWNER/REPOformat hint to thegh search --repoflag by @BagToad in #13922item-editas the first-class project flow in docs by @Solaris-star in #13927SITE_DEPLOY_PATwith the gh-cli-site-deployer App by @williammartin in #13492pkg/cmd/release/attestation/by @kobihikri in #13886ab275d0to309922bby @dependabot in #13878New Contributors
Full Changelog: cli/cli@v2.96.0...v2.97.0
klauspost/compress (github.com/klauspost/compress)
v1.19.2Compare Source
What's Changed
New Contributors
Full Changelog: klauspost/compress@v1.19.1...v1.19.2
mattn/go-isatty (github.com/mattn/go-isatty)
v0.0.24Compare Source
v0.0.23Compare Source
casey/just (just)
v1.58.0Compare Source
Changed
,-separated values in--justfile-name(#3676 by casey)Added
[timestamp]attribute (#3681 by casey)[timestamp]recipe attribute (#3680 by casey)Misc
no-cdonly affects recipe working directory (#3679 by casey)protocolbuffers/protobuf (protoc)
v3.20.3: Protocol Buffers v3.20.3Java
migrate parsing logic from parse constructor to builder.
constructor" to the Builder class.
messages rather than building up a new immutable object before merging. This
way results in fewer allocations and copy operations.
instances and merging afterwards. This has much better performance.
sub-messages directly from text rather than building a new sub-message and
merging the fully formed message into the existing field.
v3.20.2: Protocol Buffers v3.20.2C++
v3.20.1: Protocol Buffers v3.20.1PHP
Ruby
Other
v3.20.0: Protocol Buffers v3.20.02022-03-25 version 3.20.0 (C++/Java/Python/PHP/Objective-C/C#/Ruby/JavaScript)
Ruby
Ruby GC. In certain tests this leads to much lower memory usage due to more
frequent GC runs (#9586).
without losing precision.
systems.
putting such values in unknown fields.
Java
FieldSet.Builder.mergeFromsubfield. (previously it was replaced.)’
Kotlin
Python
in type annotations.
*[Breaking change] Protobuf python generated codes are simplified. Descriptors and message
classes' definitions are now dynamic created in internal/builder.py.
Insertion Points for messages classes are discarded.
rather than only PyLongObjects.
first.
specified, the function returns a timezone-aware datetime in the given time
zone. If omitted or None, the function returns a timezone-naive UTC datetime
(as previously).
JSON serializations with UTF-8 or other non-ASCII encodings.
multi-dimensional arrays. Numpy arrays should be indexed or flattened explicitly before assignment.
Compiler
guard against stack overflows
more than one invalid character.
Arenas
C++
protobuf_INSTALLto not install files (#7123)shadowed cached_size field
PHP
C#
Objective-C
proto_package_to_prefix_mappings_pathtopackage_to_prefix_mappings_path. (#9552)v3.19.4: Protocol Buffers v3.19.4Python
Ruby
optionalfields in a message is an exact multiple of 32. (#9440).PHP
optionalfields in a message is an exact multiple of 32. (#9440).v3.19.3: Protocol Buffers v3.19.3Python
v3.19.2: Protocol Buffers v3.19.2Java
v3.19.1: Protocol Buffers v3.19.1Bazel
JavaScript
ReferenceError: window is not definedwhen getting the global object (#9156)Ruby
v3.19.0: Protocol Buffers v3.19.0C++
MSVC_RUNTIME_LIBRARYproperty (#8851)Java
//java/com/google/protobuf/util/...with nullness annotationsKotlin
Python
JavaScript
PHP
Ruby
C#
v3.18.1: Protocol Buffers v3.18.1Python
Ruby
v3.18.0: Protocol Buffers v3.18.0C++
record the map items which are different in MessageDifferencer's reporter.
start.
Java
JavaScript
PHP
Ruby
Python
Other
v3.17.3: Protocol Buffers v3.17.3Python
C++
Kotlin
Java
finished parsing.
General
v3.15.8: Protocol Buffers v3.15.8Ruby
v3.15.0: Protocol Buffers v3.15.0Protocol Compiler
the --experimental_allow_proto3_optional flag.
C++
unknown fields
implementation detail users must not rely on. It should not be used in
unit tests.
C++.
output (does not affect comparison logic) and stop printing 'value' in the
path. The modified print functionality is in the
MessageDifferencer::StreamReporter.
crash.
cases out of line.
Python
collection directly instead of using the other methods of the BaseContainer.
JavaScript
getDescriptormethods with*as theirthistype.let/constfor generated messages.PHP
Ruby
upb library. This should lead to much better parsing performance,
particularly for large messages. (#8184).
recursion/run out of memory (#8195)
Java
with a direct ByteBuffer.
validation failure
java_helpers.h.
Java.
C#
v3.14.0: Protocol Buffers v3.14.0Protocol Compiler
generating code.
--deterministic_outputtoprotoc --encode=....C++
any effect.
non-optional fields.
error was encountered.
DebugString.
a single message.
possible. This fixes a lot of warnings when compiling with -Wsign-compare.
libprotocseparately (#7949)Java
0 bytes when not at EOF.
autoboxing.
@java.lang.Deprecatedif the proto enum has optiondeprecated = true;.Python
used outside WKT Value/Struct.
PHP
==operators for Map and Array. (#7900)Configuration
📅 Schedule: (UTC)
* 0-3 * * 1)🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.
♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.
👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.
This PR was generated by Mend Renovate. View the repository job log.