releases

mirror of https://github.com/open-policy-agent/opa.git synced 2026-08-12 19:32:48 -06:00

Author	SHA1	Message	Date
dependabot[bot]	52d1aad7e2	build(deps): bump brace-expansion in /docs (#8969 ) Bumps and [brace-expansion](https://github.com/juliangruber/brace-expansion). These dependencies needed to be updated together. Updates `brace-expansion` from 1.1.13 to 1.1.18 <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/juliangruber/brace-expansion/releases">brace-expansion's releases</a>.</em></p> <blockquote> <h2>v1.1.15</h2> <ul> <li>Backport v5.0.6 change to v1 (<a href="https://redirect.github.com/juliangruber/brace-expansion/issues/111">#111</a>) 0b09384</li> </ul> <hr /> <p><a href="https://github.com/juliangruber/brace-expansion/compare/v1.1.14...v1.1.15">https://github.com/juliangruber/brace-expansion/compare/v1.1.14...v1.1.15</a></p> </blockquote> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/juliangruber/brace-expansion/commit/758fcd6d188a95c2342818519c77b8c06794552b"><code>758fcd6</code></a> 1.1.18</li> <li><a href="https://github.com/juliangruber/brace-expansion/commit/27fbeed22b4fdf2c5f732f66bcf84d43f4a26c6e"><code>27fbeed</code></a> Merge commit from fork</li> <li><a href="https://github.com/juliangruber/brace-expansion/commit/5c57cc2519dfb067e188b7cb0733fffbd02946bf"><code>5c57cc2</code></a> 1.1.17</li> <li><a href="https://github.com/juliangruber/brace-expansion/commit/d757f1dde7808bcbcd7a4628ab913e5185ed3d57"><code>d757f1d</code></a> npm ignore <code>.claude</code></li> <li><a href="https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031"><code>cb4b9e4</code></a> fix: backport GHSA-mh99-v99m-4gvg (<a href="https://redirect.github.com/juliangruber/brace-expansion/issues/129">#129</a>)</li> <li><a href="https://github.com/juliangruber/brace-expansion/commit/447763a91a613cfa67ac73096cbc1de9a2304f97"><code>447763a</code></a> 1.1.16</li> <li><a href="https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95"><code>d74e630</code></a> fix: v1 backport for CVE-2026-13149 (<a href="https://redirect.github.com/juliangruber/brace-expansion/issues/122">#122</a>)</li> <li><a href="https://github.com/juliangruber/brace-expansion/commit/2203f4f4895eba16c4d408b4219ce1b8e5f6ff24"><code>2203f4f</code></a> 1.1.15</li> <li><a href="https://github.com/juliangruber/brace-expansion/commit/0b0938410732370559704230724ca4a44d1b29fd"><code>0b09384</code></a> Backport v5.0.6 change to v1 (<a href="https://redirect.github.com/juliangruber/brace-expansion/issues/111">#111</a>)</li> <li><a href="https://github.com/juliangruber/brace-expansion/commit/10c05fcf3699b1a29ef5e611c011af3d3c97e6e3"><code>10c05fc</code></a> 1.1.14</li> <li>Additional commits viewable in <a href="https://github.com/juliangruber/brace-expansion/compare/v1.1.13...v1.1.18">compare view</a></li> </ul> </details> <br /> Updates `brace-expansion` from 5.0.6 to 5.0.9 <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/juliangruber/brace-expansion/releases">brace-expansion's releases</a>.</em></p> <blockquote> <h2>v1.1.15</h2> <ul> <li>Backport v5.0.6 change to v1 (<a href="https://redirect.github.com/juliangruber/brace-expansion/issues/111">#111</a>) 0b09384</li> </ul> <hr /> <p><a href="https://github.com/juliangruber/brace-expansion/compare/v1.1.14...v1.1.15">https://github.com/juliangruber/brace-expansion/compare/v1.1.14...v1.1.15</a></p> </blockquote> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/juliangruber/brace-expansion/commit/758fcd6d188a95c2342818519c77b8c06794552b"><code>758fcd6</code></a> 1.1.18</li> <li><a href="https://github.com/juliangruber/brace-expansion/commit/27fbeed22b4fdf2c5f732f66bcf84d43f4a26c6e"><code>27fbeed</code></a> Merge commit from fork</li> <li><a href="https://github.com/juliangruber/brace-expansion/commit/5c57cc2519dfb067e188b7cb0733fffbd02946bf"><code>5c57cc2</code></a> 1.1.17</li> <li><a href="https://github.com/juliangruber/brace-expansion/commit/d757f1dde7808bcbcd7a4628ab913e5185ed3d57"><code>d757f1d</code></a> npm ignore <code>.claude</code></li> <li><a href="https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031"><code>cb4b9e4</code></a> fix: backport GHSA-mh99-v99m-4gvg (<a href="https://redirect.github.com/juliangruber/brace-expansion/issues/129">#129</a>)</li> <li><a href="https://github.com/juliangruber/brace-expansion/commit/447763a91a613cfa67ac73096cbc1de9a2304f97"><code>447763a</code></a> 1.1.16</li> <li><a href="https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95"><code>d74e630</code></a> fix: v1 backport for CVE-2026-13149 (<a href="https://redirect.github.com/juliangruber/brace-expansion/issues/122">#122</a>)</li> <li><a href="https://github.com/juliangruber/brace-expansion/commit/2203f4f4895eba16c4d408b4219ce1b8e5f6ff24"><code>2203f4f</code></a> 1.1.15</li> <li><a href="https://github.com/juliangruber/brace-expansion/commit/0b0938410732370559704230724ca4a44d1b29fd"><code>0b09384</code></a> Backport v5.0.6 change to v1 (<a href="https://redirect.github.com/juliangruber/brace-expansion/issues/111">#111</a>)</li> <li><a href="https://github.com/juliangruber/brace-expansion/commit/10c05fcf3699b1a29ef5e611c011af3d3c97e6e3"><code>10c05fc</code></a> 1.1.14</li> <li>Additional commits viewable in <a href="https://github.com/juliangruber/brace-expansion/compare/v1.1.13...v1.1.18">compare view</a></li> </ul> </details> <br /> Updates `brace-expansion` from 5.0.5 to 5.0.9 <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/juliangruber/brace-expansion/releases">brace-expansion's releases</a>.</em></p> <blockquote> <h2>v1.1.15</h2> <ul> <li>Backport v5.0.6 change to v1 (<a href="https://redirect.github.com/juliangruber/brace-expansion/issues/111">#111</a>) 0b09384</li> </ul> <hr /> <p><a href="https://github.com/juliangruber/brace-expansion/compare/v1.1.14...v1.1.15">https://github.com/juliangruber/brace-expansion/compare/v1.1.14...v1.1.15</a></p> </blockquote> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/juliangruber/brace-expansion/commit/758fcd6d188a95c2342818519c77b8c06794552b"><code>758fcd6</code></a> 1.1.18</li> <li><a href="https://github.com/juliangruber/brace-expansion/commit/27fbeed22b4fdf2c5f732f66bcf84d43f4a26c6e"><code>27fbeed</code></a> Merge commit from fork</li> <li><a href="https://github.com/juliangruber/brace-expansion/commit/5c57cc2519dfb067e188b7cb0733fffbd02946bf"><code>5c57cc2</code></a> 1.1.17</li> <li><a href="https://github.com/juliangruber/brace-expansion/commit/d757f1dde7808bcbcd7a4628ab913e5185ed3d57"><code>d757f1d</code></a> npm ignore <code>.claude</code></li> <li><a href="https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031"><code>cb4b9e4</code></a> fix: backport GHSA-mh99-v99m-4gvg (<a href="https://redirect.github.com/juliangruber/brace-expansion/issues/129">#129</a>)</li> <li><a href="https://github.com/juliangruber/brace-expansion/commit/447763a91a613cfa67ac73096cbc1de9a2304f97"><code>447763a</code></a> 1.1.16</li> <li><a href="https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95"><code>d74e630</code></a> fix: v1 backport for CVE-2026-13149 (<a href="https://redirect.github.com/juliangruber/brace-expansion/issues/122">#122</a>)</li> <li><a href="https://github.com/juliangruber/brace-expansion/commit/2203f4f4895eba16c4d408b4219ce1b8e5f6ff24"><code>2203f4f</code></a> 1.1.15</li> <li><a href="https://github.com/juliangruber/brace-expansion/commit/0b0938410732370559704230724ca4a44d1b29fd"><code>0b09384</code></a> Backport v5.0.6 change to v1 (<a href="https://redirect.github.com/juliangruber/brace-expansion/issues/111">#111</a>)</li> <li><a href="https://github.com/juliangruber/brace-expansion/commit/10c05fcf3699b1a29ef5e611c011af3d3c97e6e3"><code>10c05fc</code></a> 1.1.14</li> <li>Additional commits viewable in <a href="https://github.com/juliangruber/brace-expansion/compare/v1.1.13...v1.1.18">compare view</a></li> </ul> </details> <br /> Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself) You can disable automated security fix PRs for this repo from the [Security Alerts page](https://github.com/open-policy-agent/opa/network/alerts). </details> Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>	2026-08-03 15:28:21 -05:00
dependabot[bot]	515aea3fa8	build(deps): bump the dependencies group across 2 directories with 3 updates (#8964 ) Bumps the dependencies group with 2 updates in the / directory: [github.com/dgraph-io/badger/v4](https://github.com/dgraph-io/badger) and [github.com/prometheus/client_golang](https://github.com/prometheus/client_golang). Bumps the dependencies group with 1 update in the /e2e directory: [modernc.org/sqlite](https://gitlab.com/cznic/sqlite). Updates `github.com/dgraph-io/badger/v4` from 4.9.4 to 4.9.5 <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/dgraph-io/badger/releases">github.com/dgraph-io/badger/v4's releases</a>.</em></p> <blockquote> <h2>v4.9.5</h2> <h2>What's Changed</h2> <ul> <li>fix: prevent nil deref when reading in-memory tables by <a href="https://github.com/ErfanMomeniii"><code>@ErfanMomeniii</code></a> in <a href="https://redirect.github.com/dgraph-io/badger/pull/2316">dgraph-io/badger#2316</a></li> <li>ci: test PR's badger code against dgraph instead of main by <a href="https://github.com/shiva-istari"><code>@shiva-istari</code></a> in <a href="https://redirect.github.com/dgraph-io/badger/pull/2320">dgraph-io/badger#2320</a></li> <li>chore(deps): bump go.opentelemetry.io/otel to v1.41.0 (CVE-2026-29181) by <a href="https://github.com/matthewmcneely"><code>@matthewmcneely</code></a> in <a href="https://redirect.github.com/dgraph-io/badger/pull/2323">dgraph-io/badger#2323</a></li> </ul> <h2>New Contributors</h2> <ul> <li><a href="https://github.com/ErfanMomeniii"><code>@ErfanMomeniii</code></a> made their first contribution in <a href="https://redirect.github.com/dgraph-io/badger/pull/2316">dgraph-io/badger#2316</a></li> </ul> <p><strong>Full Changelog</strong>: <a href="https://github.com/dgraph-io/badger/compare/v4.9.4...v4.9.5">https://github.com/dgraph-io/badger/compare/v4.9.4...v4.9.5</a></p> </blockquote> </details> <details> <summary>Changelog</summary> <p><em>Sourced from <a href="https://github.com/dgraph-io/badger/blob/main/CHANGELOG.md">github.com/dgraph-io/badger/v4's changelog</a>.</em></p> <blockquote> <h1>Changelog</h1> <p>All notable changes to this project will be documented in this file.</p> <p>The format is based on <a href="http://keepachangelog.com/en/1.0.0/">Keep a Changelog</a>.</p> </blockquote> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/dgraph-io/badger/commit/21c0bc6f106c985efbb9f3f1320147ae5285b18c"><code>21c0bc6</code></a> fix: prevent nil deref when reading in-memory tables (<a href="https://redirect.github.com/dgraph-io/badger/issues/2316">#2316</a>)</li> <li><a href="https://github.com/dgraph-io/badger/commit/4292e70f9e28b1a9d9203c572d0961052a3606c8"><code>4292e70</code></a> chore(deps): bump go.opentelemetry.io/otel to v1.41.0 (CVE-2026-29181) (<a href="https://redirect.github.com/dgraph-io/badger/issues/2323">#2323</a>)</li> <li><a href="https://github.com/dgraph-io/badger/commit/0a02e668e297167d77a981c7c95c1206483fb0ca"><code>0a02e66</code></a> ci: test PR's badger code against dgraph instead of main (<a href="https://redirect.github.com/dgraph-io/badger/issues/2320">#2320</a>)</li> <li>See full diff in <a href="https://github.com/dgraph-io/badger/compare/v4.9.4...v4.9.5">compare view</a></li> </ul> </details> <br /> Updates `github.com/prometheus/client_golang` from 1.24.0 to 1.24.1 <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/prometheus/client_golang/releases">github.com/prometheus/client_golang's releases</a>.</em></p> <blockquote> <h2>v1.24.1 / 2026-07-23</h2> <p>Small bugfix release for promhttp.</p> <h2>What's Changed</h2> <p>[BUGFIX] promhttp: Fix panic on requests with nil URL. <a href="https://redirect.github.com/prometheus/client_golang/issues/2065">#2065</a></p> <p><strong>Full Changelog</strong>: <a href="https://github.com/prometheus/client_golang/compare/v1.24.0...v1.24.1">https://github.com/prometheus/client_golang/compare/v1.24.0...v1.24.1</a></p> </blockquote> </details> <details> <summary>Changelog</summary> <p><em>Sourced from <a href="https://github.com/prometheus/client_golang/blob/v1.24.1/CHANGELOG.md">github.com/prometheus/client_golang's changelog</a>.</em></p> <blockquote> <h2>1.24.1 / 2026-07-23</h2> <ul> <li>[BUGFIX] promhttp: Fix panic on requests with nil URL. <a href="https://redirect.github.com/prometheus/client_golang/issues/2065">#2065</a></li> </ul> </blockquote> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/prometheus/client_golang/commit/d6087ee482e06716ee21dc03819432d5d40f72db"><code>d6087ee</code></a> release: cut v1.24.1 (<a href="https://redirect.github.com/prometheus/client_golang/issues/2076">#2076</a>)</li> <li>See full diff in <a href="https://github.com/prometheus/client_golang/compare/v1.24.0...v1.24.1">compare view</a></li> </ul> </details> <br /> Updates `modernc.org/sqlite` from 1.54.0 to 1.55.0 <details> <summary>Changelog</summary> <p><em>Sourced from <a href="https://gitlab.com/cznic/sqlite/blob/master/CHANGELOG.md">modernc.org/sqlite's changelog</a>.</em></p> <blockquote> <h1>Changelog</h1> <ul> <li> <p>2026-07-30 v1.56.0:</p> <ul> <li>Add <code>NewConnector</code>, returning a <code>database/sql/driver.Connector</code> for use with <code>sql.OpenDB</code>. It opens the same connections <code>sql.Open("sqlite", dsn)</code> does, from the same registered driver, so every function, collation, connection hook and virtual table module registered through this package applies to them. It exists for callers that need to interpose on the physical connections <code>database/sql</code> opens — tracing, metrics, connection-scoped setup — which <code>sql.Open</code> gives no access to: such a caller can embed the returned <code>Connector</code>, override <code>Connect</code>, and pass its own wrapper to <code>sql.OpenDB</code>. Previously the only way to reach the registered driver was the <code>db, _ := sql.Open("sqlite", ""); drv := db.Driver(); db.Close()</code> idiom, which works only because <code>sql.Open</code> does not connect and this driver does not implement <code>driver.DriverContext</code>; and the only way to get a wrapper into a <code>sql.DB</code> was <code>sql.Register</code>, which is process-global, panics on a name it has already seen, and cannot be undone, so a library had to invent a unique driver name per configuration. <code>sql.OpenDB</code> registers nothing. Constructing a <code>&sqlite.Driver{}</code> is not an alternative — its fields are unexported, so it carries none of the registrations. <code>NewConnector</code> checks the DSN only as far as it can without opening a database — a query string that does not parse, and conflicting <code>vfs</code> parameters; everything else continues to be validated when the connection is opened, so an unknown parameter or an out-of-range value is reported by <code>Connect</code> rather than at construction. Nothing about the existing <code>sql.Open</code> path changes: <code>Driver</code> deliberately still does not implement <code>driver.DriverContext</code>, so <code>sql.Open</code> remains lazy and DSN errors continue to surface where they always have. A runnable sample is in <code>examples/connector</code>. Resolves [GitLab issue <a href="https://gitlab.com/cznic/sqlite/issues/253">#253</a>](<a href="https://gitlab.com/cznic/sqlite/-/issues/253">https://gitlab.com/cznic/sqlite/-/issues/253</a>), thanks Alessandro Segala (<a href="https://github.com/ItalyPaleAle"><code>@ItalyPaleAle</code></a>)!</li> <li>Document that a caller-constructed <code>sqlite.Driver</code> is not the driver this package registers as <code>"sqlite"</code>. Its fields are unexported, so it starts with no functions, collations or connection hooks and the only way to give it any is its own <code>RegisterConnectionHook</code> method; the package-level <code>Register</code> functions always apply to the registered driver. Connections such a <code>Driver</code> opens therefore run without the package-level functions and collations — and because a registered function silently replaces a SQLite built-in of the same name, a <code>Driver</code> you construct can evaluate <code>upper(x)</code>, <code>date(x)</code> and the like differently from one opened through <code>sql.Open</code>. Virtual table modules are the one exception: they are held process-globally and reach every <code>Driver</code>. Constructing one remains supported for the private-hook pattern — a driver registered under a name of its own with <code>sql.Register</code> so its connection hooks apply only to its own connections — and is otherwise best avoided in favour of <code>sql.Open</code> or <code>NewConnector</code>. Documentation only; no behavior changes.</li> </ul> </li> <li> <p>2026-07-20 v1.55.0:</p> <ul> <li>Add <code>github.com/mattn/go-sqlite3</code>-compatible shorthand DSN query parameters to ease migration from that driver: <code>_busy_timeout</code>/<code>_timeout</code>, <code>_foreign_keys</code>/<code>_fk</code>, <code>_journal_mode</code>/<code>_journal</code>, <code>_synchronous</code>/<code>_sync</code>, <code>_auto_vacuum</code>/<code>_vacuum</code>, and <code>_query_only</code>, each setting the correspondingly named PRAGMA. Values are validated against the same set <code>mattn/go-sqlite3</code> accepts (case-insensitive) and an unrecognized value fails the connection with an error, so a typo such as <code>_synchronous=fu1l</code> or <code>_foreign_keys=yes_please</code> is reported rather than silently downgrading durability or dropping foreign-key enforcement. The keys are applied in a fixed order independent of their order in the DSN — <code>_busy_timeout</code> and <code>_auto_vacuum</code> before any <code>_pragma</code> values (<code>auto_vacuum</code> must be set before the database is first written), the rest after, and <code>_query_only</code> last — and where a key and its alias are both supplied the alias wins, matching <code>mattn/go-sqlite3</code>; selection is by presence rather than by value, so supplying the alias empty (<code>_foreign_keys=on&_fk=</code>) suppresses the PRAGMA rather than deferring to the primary key, again matching that driver. Behavior change to note: prior releases ignored these keys entirely, so a DSN carried over from a <code>mattn/go-sqlite3</code> setup changes in two ways. A recognized key that previously did nothing now takes effect — <code>_foreign_keys=on</code> begins enforcing constraints against data that may already violate them, <code>_journal_mode=wal</code> persistently converts the database file, and <code>_query_only=1</code> makes the connection read-only. And a value outside the accepted set now fails the connection with an error where the same DSN previously opened successfully — for example a duration-style <code>_busy_timeout=5s</code> or <code>_timeout=5000ms</code>, neither of which is the integer that key requires. Review such DSNs before upgrading. <code>_pragma</code> is unchanged and no pre-existing parameter changes meaning, though see the following entry for a change in when all of them are validated.</li> <li>See [GitLab merge request <a href="https://gitlab.com/cznic/sqlite/issues/134">#134</a>](<a href="https://gitlab.com/cznic/sqlite/-/merge_requests/134">https://gitlab.com/cznic/sqlite/-/merge_requests/134</a>), thanks Toni Spets (<a href="https://github.com/beeper-hifi"><code>@beeper-hifi</code></a>) and Ian Chechin!</li> <li>Validate every DSN query parameter before applying any of them. Parameters were previously checked as each was reached, so a DSN whose later parameter was rejected had already executed the PRAGMAs ahead of it. Because <code>PRAGMA journal_mode</code> and <code>PRAGMA auto_vacuum</code> are persistent changes to the database file, a DSN such as <code>file:x.db?_journal_mode=wal&_synchronous=bogus</code> failed the connection and yet left <code>x.db</code> converted to WAL. A failed <code>Open</code> now leaves the database as it found it. This covers the pre-existing <code>_txlock</code>, <code>_timezone</code>, <code>_time_format</code>, <code>_time_integer_format</code>, <code>_inttotime</code> and <code>_texttotime</code> parameters as well as the shorthand keys above: all of them were validated only after the <code>_pragma</code> list had already run, so the same DSN shape — a valid <code>_pragma=journal_mode=wal</code> alongside a misspelled <code>_txlock</code> — converted the file before reporting the error. Only the values accepted for each parameter are unchanged; a DSN that opened successfully before still opens, and one that failed still fails with the same error. <code>_pragma</code> remains the sole exception, since its values are executed verbatim and cannot be checked in advance: a malformed <code>_pragma</code> is still rejected by SQLite as it runs, after any earlier <code>_pragma</code> in the list has taken effect.</li> </ul> </li> <li> <p>2026-07-15 v1.54.0:</p> <ul> <li>Upgrade to <a href="https://sqlite.org/releaselog/3_53_3.html">SQLite 3.53.3</a>. This also bumps the pinned <code>modernc.org/libc</code> to v1.74.1; as always, downstream modules must pin the exact same <code>modernc.org/libc</code> version this module's <code>go.mod</code> pins (see [GitLab issue <a href="https://gitlab.com/cznic/sqlite/issues/177">#177</a>](<a href="https://gitlab.com/cznic/sqlite/-/issues/177">https://gitlab.com/cznic/sqlite/-/issues/177</a>)).</li> <li>Under the opt-in <code>_texttotime</code> DSN parameter, best-effort parse date-shaped TEXT values from columns SQLite reports with an empty declared type — aggregates and expressions over a date column (<code>MAX(d)</code>, <code>COALESCE(d, ...)</code>, <code>upper(d)</code>, <code>d \|\| ''</code>), subqueries, and typeless real columns (<code>CREATE TABLE t(x)</code>) — into <code>time.Time</code>, instead of delivering them as a raw string that <code>Scan</code> cannot store into a <code>time.Time</code>. The existing declared <code>DATE</code>/<code>DATETIME</code>/<code>TIME</code>/<code>TIMESTAMP</code> path is unchanged; this only adds the empty-decltype case. The conversion is strictly best-effort: a value that does not parse as a time falls through to the original string, so no <code>Scan</code> that worked before can newly fail. <code>ColumnTypeScanType</code> continues to report <code>string</code> for empty-decltype columns, since the declared type cannot prove the column is temporal. Without <code>_texttotime</code> the behavior is byte-for-byte unchanged. Resolves [GitLab issue <a href="https://gitlab.com/cznic/sqlite/issues/248">#248</a>](<a href="https://gitlab.com/cznic/sqlite/-/issues/248">https://gitlab.com/cznic/sqlite/-/issues/248</a>).</li> <li>See [GitLab merge request <a href="https://gitlab.com/cznic/sqlite/issues/133">#133</a>](<a href="https://gitlab.com/cznic/sqlite/-/merge_requests/133">https://gitlab.com/cznic/sqlite/-/merge_requests/133</a>), thanks Ian Chechin!</li> </ul> </li> <li> <p>2026-06-21 v1.53.0:</p> <ul> <li>Add <strong>experimental</strong> <code>netbsd/amd64</code> support, resolving the long-standing build break in [GitLab issue <a href="https://gitlab.com/cznic/sqlite/issues/246">#246</a>](<a href="https://gitlab.com/cznic/sqlite/-/issues/246">https://gitlab.com/cznic/sqlite/-/issues/246</a>). This target is intentionally <strong>not yet listed among the supported platforms</strong> in the package documentation: the port had been broken for years and is only now revived, and there is as yet no real-world experience running it under production workloads. Green CI is not the same as battle-tested — so while the full test suite (including the <code>pcache</code> and <code>vec</code> packages and the <code>-race</code> concurrency test) passes on NetBSD 10.1 / Go 1.26.3, and the entire upstream toolchain (<code>libc</code>, <code>cc</code>, <code>ccgo</code>, <code>libz</code>, <code>libtcl8.6</code>, <code>libsqlite3</code>, <code>libsqlite_vec</code>) is green on the NetBSD CI builder, the target is offered for evaluation only. If you run NetBSD, please exercise it with your own workloads and report back via <a href="https://gitlab.com/cznic/sqlite/issues/246">#246</a>; the intent is to promote it to a fully supported platform after a period of broader real-world testing (on the order of a month) elapses without surprises.</li> <li>Implementation notes: the previously shipped <code>lib/sqlite_netbsd_amd64.go</code> was a stale old-generator transpile that no longer compiled (the <code>mu.enter</code>/<code>mu.leave</code> break in <a href="https://gitlab.com/cznic/sqlite/issues/246">#246</a>); it is replaced by a fresh new-generator transpile consistent with every other platform, and <code>modernc.org/sqlite/vec</code> (sqlite-vec) is vendored and auto-registers on netbsd. Correct operation requires the matching pinned <code>modernc.org/libc</code>, which carries two NetBSD-specific fixes found during this work: the <code>mmap(2)</code> <code>PAD</code>-argument ABI (without it, concurrent WAL access faults with SIGBUS in the WAL-index shared memory) and a working <code>abort(3)</code> (the prior stub left SQLite's crash-recovery <code>writecrash</code> test unable to terminate by signal). As usual, downstream modules must pin the exact <code>modernc.org/libc</code> version this module's <code>go.mod</code> pins.</li> <li>See [GitLab merge request <a href="https://gitlab.com/cznic/sqlite/issues/82">#82</a>](<a href="https://gitlab.com/cznic/sqlite/-/merge_requests/82">https://gitlab.com/cznic/sqlite/-/merge_requests/82</a>), thanks Leonardo Taccari (<a href="https://github.com/iamleot"><code>@iamleot</code></a>) and Thomas Klausner (@<em>wiz</em>)!</li> <li>Add <strong>experimental</strong> <code>freebsd/386</code> and <code>freebsd/arm</code> support. As with the <code>netbsd/amd64</code> target above, these two 32-bit FreeBSD ports are intentionally <strong>not yet listed among the supported platforms</strong> in the package documentation: <code>freebsd/386</code> previously shipped a stale, effectively untested SQLite 3.41 transpile, and <code>freebsd/arm</code> is entirely new, so neither has real-world production mileage yet. Both are now freshly transpiled at SQLite 3.53.2 consistent with every other platform, build cleanly, and pass the full test suite (core, WAL/concurrency, and the <code>vec</code> package) on the FreeBSD CI builders; they are offered for evaluation only. If you run 32-bit FreeBSD, please exercise these targets with your own workloads and report back — the intent is to promote <code>freebsd/386</code>, <code>freebsd/arm</code>, and <code>netbsd/amd64</code> to fully supported platforms in a future release cycle, once a period of broader real-world testing elapses without surprises.</li> <li>Implementation notes: correct operation on <code>freebsd/arm</code> requires the matching pinned <code>modernc.org/libc</code> (v1.73.4), which fixes the per-arch <code>mmap(2)</code> <code>off_t</code> encoding for 32-bit FreeBSD; without it the WAL shared-memory mapping faults with SIGBUS under concurrent access, the same class of bug found on the netbsd port. As usual, downstream modules must pin the exact <code>modernc.org/libc</code> version this module's <code>go.mod</code> pins.</li> <li>See [GitLab merge request <a href="https://gitlab.com/cznic/sqlite/issues/119">#119</a>](<a href="https://gitlab.com/cznic/sqlite/-/merge_requests/119">https://gitlab.com/cznic/sqlite/-/merge_requests/119</a>), thanks Olivier Cochard-Labbé (<a href="https://github.com/ocochard"><code>@ocochard</code></a>)!</li> <li>Add a Go-facing wrapper for <code>SQLITE_CONFIG_PCACHE2</code>. <code>PageCache</code> is the factory and <code>Cache</code> the per-database instance, both idiomatic Go interfaces; <code>Page</code> exposes the raw <code>Buf</code> and <code>Extra</code> pointers that SQLite reads through the C pcache contract. <code>RegisterPageCache</code> and <code>MustRegisterPageCache</code> install the module process-globally before the first <code>sql.Open</code>; subsequent Open calls are gated through a one-shot <code>Xsqlite3_config(SQLITE_CONFIG_PCACHE2)</code> so a too-late Register returns <code>ErrPageCacheTooLate</code> rather than silently falling through to the built-in pcache1. The binding owns the <code>sqlite3_pcache_page</code> stub and re-consults the implementation on every Fetch, reusing the stub only when the returned <code>Page</code> value is unchanged, which keeps a bounded/evicting purgeable cache safe by construction.</li> <li>See [GitLab merge request <a href="https://gitlab.com/cznic/sqlite/issues/126">#126</a>](<a href="https://gitlab.com/cznic/sqlite/-/merge_requests/126">https://gitlab.com/cznic/sqlite/-/merge_requests/126</a>), thanks Ian Chechin!</li> <li>Add <code>modernc.org/sqlite/pcache</code>, the reference page-cache implementation that accompanies the <a href="https://gitlab.com/cznic/sqlite/issues/126">#126</a> <code>SQLITE_CONFIG_PCACHE2</code> wrapper. <code>pcache.New</code> returns a <code>Pool</code> satisfying the <code>PageCache</code> interface; register it once with <code>sqlite.MustRegisterPageCache(pcache.New())</code> and every connection opened afterwards draws its pages from it. Each <code>Pool.Create</code> mints a fresh per-database <code>Cache</code>: a bounded, LRU-evicting page store that honours the <code>PRAGMA cache_size</code> soft cap and releases the least-recently-unpinned page when it must make room. Page memory — the <code>Buf</code> and <code>Extra</code> buffers SQLite reads through — is allocated with <code>libc.Xmalloc</code>/<code>libc.Xcalloc</code> and therefore lives off the Go heap, which keeps SQLite's interior pointer arithmetic on the page extras from tripping the race detector's checkptr enforcement. <code>Pool.Stats</code> reports aggregate lifetime counters (hits, misses, allocs, evictions, rekeys, truncates, caches) across every cache a Pool has created, so hit/miss/eviction behaviour is observable without instrumenting individual caches. Cross-connection page sharing is out of scope for now; each <code>Create</code> returns an independent per-database cache.</li> <li>Validated end-to-end against the <a href="https://gitlab.com/cznic/sqlite/issues/126">#126</a> stress workload (<code>cache_size=16</code>, 4000 BLOB rows with DELETE and <code>incremental_vacuum</code>, <code>integrity_check</code> clean under <code>-race</code>) and benchmarked for the memory-utilization goal tracked in [GitLab issue <a href="https://gitlab.com/cznic/sqlite/issues/204">#204</a>](<a href="https://gitlab.com/cznic/sqlite/-/issues/204">https://gitlab.com/cznic/sqlite/-/issues/204</a>).</li> <li>See [GitLab merge request <a href="https://gitlab.com/cznic/sqlite/issues/127">#127</a>](<a href="https://gitlab.com/cznic/sqlite/-/merge_requests/127">https://gitlab.com/cznic/sqlite/-/merge_requests/127</a>), thanks Ian Chechin!</li> <li>Tighten the <code>modernc.org/sqlite/pcache</code> reference implementation per cznic's !127 review follow-ups. Adds <code>Stats.EasyRefusals</code>, a per-Pool counter for the cases where <code>FetchCreateEasy</code> returns nil at cap; SQLite reacts to a refusal by spilling dirty pages and retrying with <code>FetchCreateForce</code>, so the new field is a direct proxy for the I/O pressure the strict Easy contract imposes vs pcache1's recycle-without-spill behavior. <code>BenchmarkPoolEvictionChurn</code> was reworked to drive a rotating-residue DELETE (<code>k % 3 = i % 3</code>) and re-insert a matching batch each cycle so the spill pressure recurs and <code>easy-refusals/op</code> scales with <code>b.N</code> instead of capping at the seed's one-time first-cycle cost; both existing benchmarks now report <code>easy-refusals/op</code> alongside the page-allocs/evictions metrics. <code>Stats.Evictions</code> documentation was tightened to match the actual behavior (counts LRU eviction, <code>Unpin(discard=true)</code>, <code>Shrink</code> releases, and <code>Unpin(discard=false)</code> trimming back to target after a <code>FetchCreateForce</code> overcommit; bulk frees from <code>Truncate</code>, <code>Rekey</code> collisions, and <code>Destroy</code> are not counted). The <code>TestPoolRoundTripIntegrity</code> comment claiming the workload exercises <code>xRekey</code> ~15 times has been corrected; the SQL surface does not reliably emit xRekey here, and that codepath is covered by the unit tests instead.</li> <li>See [GitLab merge request <a href="https://gitlab.com/cznic/sqlite/issues/130">#130</a>](<a href="https://gitlab.com/cznic/sqlite/-/merge_requests/130">https://gitlab.com/cznic/sqlite/-/merge_requests/130</a>), thanks Ian Chechin!</li> <li>Make <code>modernc.org/sqlite/pcache</code> <code>-race</code>-clean under SQLite's <code>cache=shared</code> mode. The pool already runs correctly under shared-cache because every callback into a given <code>Cache</code> is serialised internally by SQLite's <code>sqlite3BtreeEnter</code> on the <code>BtShared</code> mutex; verified empirically with a lock-free in-flight probe (max-in-flight = 1 on the canonical two-connection workload, 4 on a positive control with goroutines hitting the cache directly). However the Go race detector does not recognise SQLite's libc mutex as a happens-before edge and reports false-positive races on <code>Fetch</code> vs <code>Unpin</code> reads/writes of the per-cache state, which surfaces as <code>DATA RACE</code> failures for any user who registers the pool and runs their suite under <code>-race</code>. A <code>sync.Mutex</code> on the <code>cache</code> type is now taken on every public method (<code>SetSize</code>, <code>PageCount</code>, <code>Fetch</code>, <code>Unpin</code>, <code>Rekey</code>, <code>Truncate</code>, <code>Destroy</code>, <code>Shrink</code>), always. On the common non-shared-cache path the lock is uncontended (one atomic CAS per Lock/Unlock pair, negligible next to the SQLite work it bookends); on the shared-cache path it just rubber-stamps the order SQLite's <code>BtShared</code> mutex already established. A new <code>e2e_test.go</code> <code>TestSharedCacheTwoConns_Integrity</code> drives two <code>sql.Conn</code> against the same <code>cache=shared</code> URI with concurrent writers and asserts <code>PRAGMA integrity_check = ok</code> under <code>-race</code>; passes cleanly with the lock, would surface the false-positive without it. Design notes live in <code>pcache/sharing.go</code>.</li> <li>See [GitLab merge request <a href="https://gitlab.com/cznic/sqlite/issues/131">#131</a>](<a href="https://gitlab.com/cznic/sqlite/-/merge_requests/131">https://gitlab.com/cznic/sqlite/-/merge_requests/131</a>), thanks Ian Chechin!</li> <li>Add a Go wrapper for <code>sqlite3_db_status</code>, the per-connection runtime counters (cache hit/miss/write/spill rates, schema and prepared-statement memory, lookaside usage, deferred foreign keys). <code>DBStatus</code> is an interface implemented by the driver connection and reached through the <code>database/sql</code> escape hatch <code>(sql.Conn).Raw()</code>, mirroring the existing <code>FileControl</code> surface; <code>DBStatusOp</code> is a distinct typed enum of the <code>SQLITE_DBSTATUS_</code> verbs so a counter from a different op family will not compile in its place. <code>Status(op, reset)</code> returns the <code>(current, high)</code> pair and optionally resets the counter. This also lets <code>modernc.org/sqlite/pcache</code> measure real I/O instead of the <code>EasyRefusals</code> proxy: the new <code>BenchmarkPoolSpillIO</code> reads the pager-level <code>SQLITE_DBSTATUS_CACHE_SPILL</code>/<code>_CACHE_WRITE</code> counters, which the pager maintains identically for pcache1 and the pool, making the pcache1-vs-pool comparison cznic raised on the !127 review a genuine apples-to-apples measurement. On the rotating-residue eviction-churn workload at <code>cache_size=16</code> the pool spills ~3.5x more than pcache1 (cache-spill/op 31.96 vs 8.96) for ~3% more page writes (cache-write/op 450 vs 436) at identical hit/miss, quantifying the I/O cost of the strict Easy contract that <code>EasyRefusals</code> only proxied.</li> <li>See [GitLab merge request <a href="https://gitlab.com/cznic/sqlite/issues/132">#132</a>](<a href="https://gitlab.com/cznic/sqlite/-/merge_requests/132">https://gitlab.com/cznic/sqlite/-/merge_requests/132</a>), thanks Ian Chechin!</li> <li>Add an opt-in <code>_dqs</code> DSN query parameter that disables SQLite's double-quoted string literal compatibility quirk on a per-connection basis. When <code>_dqs=0</code> (or any <code>strconv.ParseBool</code> false value) is supplied, the driver calls <code>sqlite3_db_config</code> with <code>SQLITE_DBCONFIG_DQS_DDL</code> and <code>SQLITE_DBCONFIG_DQS_DML</code> set to off before any statement is prepared, so a double-quoted identifier that fails to resolve raises a parse error instead of silently falling back to a string literal. Absence of the parameter, or <code>_dqs=1</code>, leaves SQLite's default behavior unchanged; existing DSNs continue to work byte-for-byte. Resolves [GitLab issue <a href="https://gitlab.com/cznic/sqlite/issues/61">#61</a>](<a href="https://gitlab.com/cznic/sqlite/-/issues/61">https://gitlab.com/cznic/sqlite/-/issues/61</a>).</li> <li>See [GitLab merge request <a href="https://gitlab.com/cznic/sqlite/issues/128">#128</a>](<a href="https://gitlab.com/cznic/sqlite/-/merge_requests/128">https://gitlab.com/cznic/sqlite/-/merge_requests/128</a>), thanks Ian Chechin!</li> <li>Add an opt-in <code>_error_rc</code> DSN query parameter for clearer error reporting on open-time failures. When <code>_error_rc=1</code> (or any <code>strconv.ParseBool</code> true value) is supplied, error strings synthesised from a <code>(rc, db)</code> pair only append <code>sqlite3_errmsg(db)</code> when <code>sqlite3_extended_errcode(db)</code> is consistent with the operation rc (full match first, primary code <code>&0xff</code> as fallback). On mismatch the canonical <code>sqlite3_errstr(rc)</code> is used alone, so an open-time <code>SQLITE_CANTOPEN</code> no longer carries the temporary handle's stale "out of memory" errmsg. Absence of the parameter, or <code>_error_rc=0</code>, preserves the legacy "errstr: errmsg" form byte-for-byte; existing callers that parse error strings are unaffected. The driver's <code>Error.Code()</code> returns the same SQLite result code in both modes. Parsed before <code>sqlite3_open_v2</code> so open-time errors are covered. Resolves [GitLab issue <a href="https://gitlab.com/cznic/sqlite/issues/230">#230</a>](<a href="https://gitlab.com/cznic/sqlite/-/issues/230">https://gitlab.com/cznic/sqlite/-/issues/230</a>).</li> <li>See [GitLab merge request <a href="https://gitlab.com/cznic/sqlite/issues/129">#129</a>](<a href="https://gitlab.com/cznic/sqlite/-/merge_requests/129">https://gitlab.com/cznic/sqlite/-/merge_requests/129</a>), thanks Ian Chechin!</li> </ul> </li> <li> <p>2026-06-06 v1.52.0:</p> <ul> <li>Upgrade to <a href="https://sqlite.org/releaselog/3_53_2.html">SQLite 3.53.2</a>.</li> <li>Add <code>Backup.Remaining</code> and <code>Backup.PageCount</code>, thin wrappers around the existing <code>sqlite3_backup_remaining</code> and <code>sqlite3_backup_pagecount</code> C symbols. Together they expose the per-<code>Step</code> progress counters that the underlying backup object already maintains, enabling progress reporting during online backups without dropping to <code>modernc.org/sqlite/lib</code> directly.</li> <li>See [GitLab merge request <a href="https://gitlab.com/cznic/sqlite/issues/122">#122</a>](<a href="https://gitlab.com/cznic/sqlite/-/merge_requests/122">https://gitlab.com/cznic/sqlite/-/merge_requests/122</a>), thanks Ian Chechin!</li> <li>Drop the redundant second copy in <code>(conn).columnText</code>, the path that backs every <code>Rows.Scan</code> into a Go <code>string</code> for a TEXT column. The value's bytes are still copied once out of SQLite-owned memory into a fresh Go buffer; that buffer is then reinterpreted as the result string with <code>unsafe.String</code> rather than copied a second time by the implicit <code>string([]byte)</code> conversion. This removes one allocation per TEXT value per row and roughly halves the bytes allocated on that path; on the new <code>BenchmarkColumnTextScan</code> cases it is ~13–20% faster for payloads of 256 B and larger, with no measurable change for very short strings. Purely internal: no API or behavioral change, and the returned string never aliases SQLite's buffer.</li> <li>See [GitLab merge request <a href="https://gitlab.com/cznic/sqlite/issues/123">#123</a>](<a href="https://gitlab.com/cznic/sqlite/-/merge_requests/123">https://gitlab.com/cznic/sqlite/-/merge_requests/123</a>), thanks Ian Chechin!</li> <li>Cache each result column's declared type once per result set in <code>newRows</code> instead of recomputing it on every row. The TEXT branch of <code>Rows.Next</code> calls <code>ColumnTypeDatabaseTypeName</code> for every TEXT column on every row (independent of any DSN flag), which previously did a <code>libc.GoString</code> + <code>strings.ToUpper</code> each time; that lookup is now a single index into a cached, pre-uppercased <code>[]string</code>, and <code>ColumnTypeScanType</code> reads the same cache and drops its per-call <code>strings.ToLower</code>. The declared type is fixed for the lifetime of a prepared statement, so the C round-trip is paid once per column rather than once per column per row, removing exactly 1 alloc + 8 B per TEXT column per row from the <code>Next</code> hot path. The new <code>BenchmarkTextToTimeScan</code> cases show ~7% faster on a 1000-row DATETIME SELECT under <code>_texttotime=1</code>. Purely internal: <code>ColumnTypeDatabaseTypeName</code> and <code>ColumnTypeScanType</code> return identical values, no API or behavioral change.</li> <li>See [GitLab merge request <a href="https://gitlab.com/cznic/sqlite/issues/124">#124</a>](<a href="https://gitlab.com/cznic/sqlite/-/merge_requests/124">https://gitlab.com/cznic/sqlite/-/merge_requests/124</a>), thanks Ian Chechin!</li> <li>Cache, per result column, the <code>parseTimeFormats</code> index that first parsed a TEXT-stored DATE/DATETIME/TIMESTAMP value, and try that format first on later rows instead of re-walking the list from the top. <code>(conn).parseTime</code> previously ran <code>time.Parse</code> down the format list on every such row; for the canonical SQLite TEXT datetime format every row paid two failed <code>time.Parse</code> attempts — each allocating a <code>*time.ParseError</code> — before the match. On a 1000-row DATETIME TEXT SELECT this cuts ~50% of allocs/op and ~57% of B/op and is ~37% faster. The fall-through chain is preserved exactly: the seven formats are mutually exclusive, so the cached hint can never select a different match than the in-order scan, and the parsed <code>driver.Value</code> is identical to before. Purely internal: no API or behavioral change.</li> <li>See [GitLab merge request <a href="https://gitlab.com/cznic/sqlite/issues/125">#125</a>](<a href="https://gitlab.com/cznic/sqlite/-/merge_requests/125">https://gitlab.com/cznic/sqlite/-/merge_requests/125</a>), thanks Ian Chechin!</li> </ul> </li> </ul> <!-- raw HTML omitted --> </blockquote> <p>... (truncated)</p> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://gitlab.com/cznic/sqlite/commit/cfb97341944de3bfa93dd4d7ef30bc921e924229"><code>cfb9734</code></a> CHANGELOG.md: document the DSN validation-order change</li> <li><a href="https://gitlab.com/cznic/sqlite/commit/0895392f927b5ebbd778751764ca25a73757f6ed"><code>0895392</code></a> sqlite: validate all DSN parameters before applying any of them</li> <li><a href="https://gitlab.com/cznic/sqlite/commit/63a57e475f6f0674c9cbc28b96a3c56d9342419c"><code>63a57e4</code></a> sqlite: select DSN shorthand aliases by presence, matching mattn (!134 follow...</li> <li><a href="https://gitlab.com/cznic/sqlite/commit/d7210fc87cbdbd007f12564c221d9941cbe7e5be"><code>d7210fc</code></a> CHANGELOG.md: correct the !134 DSN shorthand-key entry</li> <li><a href="https://gitlab.com/cznic/sqlite/commit/b31f52124d296ead27daee9e457912139865073e"><code>b31f521</code></a> Merge branch 'dsn-compat-keys' into 'master'</li> <li><a href="https://gitlab.com/cznic/sqlite/commit/266b979e9d3b91e618c81d2462a367b06461fa55"><code>266b979</code></a> sqlite: validate mattn-compat DSN keys and fix auto_vacuum apply order</li> <li><a href="https://gitlab.com/cznic/sqlite/commit/97841221df58eb884ebe4784897345007c001e86"><code>9784122</code></a> sqlite: document mattn-compat DSN pragma keys and test them together</li> <li><a href="https://gitlab.com/cznic/sqlite/commit/5831f4bee87e259531f9cb941bb5a6cc550fd7da"><code>5831f4b</code></a> Support more underscore keys in DSN</li> <li>See full diff in <a href="https://gitlab.com/cznic/sqlite/compare/v1.54.0...v1.55.0">compare view</a></li> </ul> </details> <br /> Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore <dependency name> major version` will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself) - `@dependabot ignore <dependency name> minor version` will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself) - `@dependabot ignore <dependency name>` will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself) - `@dependabot unignore <dependency name>` will remove all of the ignore conditions of the specified dependency - `@dependabot unignore <dependency name> <ignore condition>` will remove the ignore condition of the specified dependency and ignore conditions </details> Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>	2026-08-03 09:53:34 -05:00
dependabot[bot]	dd3c665b62	build(deps): bump the e2e-prisma group in /e2e/api/compile/prisma with 2 updates (#8965 ) Bumps the e2e-prisma group in /e2e/api/compile/prisma with 2 updates: [@prisma/adapter-pg](https://github.com/prisma/prisma/tree/HEAD/packages/adapter-pg) and [@prisma/client](https://github.com/prisma/prisma/tree/HEAD/packages/client). Updates `@prisma/adapter-pg` from 7.8.0 to 7.9.0 <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/prisma/prisma/releases">@prisma/adapter-pg's releases</a>.</em></p> <blockquote> <h2>7.9.0</h2> <p>Today, we are excited to share the <code>7.9.0</code> stable release 🎉</p> <p><strong>🌟 Star this repo for notifications about new releases, bug fixes & features — or <a href="https://pris.ly/x">follow us on X</a>!</strong></p> <h1>Highlights</h1> <h2>ORM</h2> <h3>Tab completions for the Prisma CLI</h3> <p>Typing out CLI commands from memory is now optional. Prisma ships <strong>shell tab completions</strong> for <code>bash</code>, <code>zsh</code>, <code>fish</code>, and PowerShell, covering commands, subcommands, options, flags, and even option values.</p> <p><strong>Setting it up.</strong> Most projects run Prisma through a package manager, so completions are enabled through <code>@bomb.sh/tab</code>'s package-manager integration — install it once, then source the completion for your package manager and shell:</p> <pre lang="bash"><code># 1. Install @bomb.sh/tab globally npm install -g @bomb.sh/tab <h1>2. Wire up your package manager + shell (pnpm shown; swap in npm / yarn / bun):</h1> <p>echo 'source <(tab pnpm zsh)' >> ~/.zshrc # zsh<br /> echo 'source <(tab pnpm bash)' >> ~/.bashrc # bash<br /> tab pnpm fish > ~/.config/fish/completions/pnpm.fish # fish<br /> tab pnpm powershell > ~/.tab-pnpm.ps1 # PowerShell (then dot-source it from $PROFILE)<br /> </code></pre></p> <p><code>@bomb.sh/tab</code> delegates to any locally-installed CLI that ships completions, so <code>pnpm prisma <TAB></code>, <code>pnpm exec prisma <TAB></code>, <code>yarn prisma <TAB></code>, and <code>bun x prisma <TAB></code> all complete Prisma's commands, options, and values — no per-project setup. (<code>npx</code> and <code>bunx</code> don't support completion themselves; use <code>npm exec</code> and <code>bun x</code>.)</p> <p>If instead you have Prisma installed globally on your <code>PATH</code>, source its own completion directly: <code>source <(prisma complete zsh)</code> (or the <code>bash</code> / <code>fish</code> / <code>powershell</code> variant).</p> <p>This is built on <a href="https://github.com/bombshell-dev/tab/"><code>@bomb.sh/tab</code></a>, the same completion library that powers other CLIs in the ecosystem — including Cloudflare, Nuxt, and Vitest — so the package-manager completions you enable for Prisma work for those tools too. A wonderful community contribution from <a href="https://github.com/AmirSa12"><code>@AmirSa12</code></a> (<a href="https://redirect.github.com/prisma/prisma/pull/28351">#28351</a>) — thank you!</p> <p><a href="https://github.com/user-attachments/assets/1f916a60-ee4d-40be-bb7d-74035d48ca83">https://github.com/user-attachments/assets/1f916a60-ee4d-40be-bb7d-74035d48ca83</a></p> <h3>Prisma ORM, ready for AI agents</h3> <p>Coding agents are now a first-class audience for Prisma, and 7.9.0 brings the first wave of work to make Prisma projects safe and productive for them to work in.</p> <p><strong>Agent skills installed with <code>prisma init</code></strong> (<a href="https://redirect.github.com/prisma/prisma/pull/29689">#29689</a>)</p> <p><code>prisma init</code> now installs the <a href="https://github.com/prisma/skills">prisma/skills</a> catalog into freshly scaffolded projects. Agents such as Claude Code, Cursor, Codex, and Windsurf start out with current, version-relevant Prisma knowledge instead of relying on whatever happened to be in their training data. The install is best-effort and never blocks scaffolding; opt out at any time with <code>--no-skills</code>.</p> <pre lang="terminal"><code>npx prisma@latest init </code></pre> <p><img src="https://github.com/user-attachments/assets/8244a6dc-cdad-4028-a652-bb5ac6e4b271" alt="prisma init scaffolds a project and installs the Prisma agent skills catalog" /></p> <p><strong>A safer default around destructive commands</strong> (<a href="https://redirect.github.com/prisma/prisma/pull/29684">#29684</a>, <a href="https://redirect.github.com/prisma/prisma/pull/29691">#29691</a>, <a href="https://redirect.github.com/prisma/prisma/pull/29713">#29713</a>)</p> <!-- raw HTML omitted --> </blockquote> <p>... (truncated)</p> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/prisma/prisma/commit/35003fd86c574741cb5d93a57b773ee33015a79c"><code>35003fd</code></a> chore(adapter-pg): remove duplicate values parameter (<a href="https://github.com/prisma/prisma/tree/HEAD/packages/adapter-pg/issues/29650">#29650</a>)</li> <li><a href="https://github.com/prisma/prisma/commit/d6d9fc9ed341946d45c7d0aba35081a7bd741aa1"><code>d6d9fc9</code></a> chore: remove parameterization from sqlcommenter-query-insights (<a href="https://github.com/prisma/prisma/tree/HEAD/packages/adapter-pg/issues/29518">#29518</a>)</li> <li>See full diff in <a href="https://github.com/prisma/prisma/commits/7.9.0/packages/adapter-pg">compare view</a></li> </ul> </details> <br /> Updates `@prisma/client` from 7.8.0 to 7.9.0 <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/prisma/prisma/releases">@prisma/client's releases</a>.</em></p> <blockquote> <h2>7.9.0</h2> <p>Today, we are excited to share the <code>7.9.0</code> stable release 🎉</p> <p><strong>🌟 Star this repo for notifications about new releases, bug fixes & features — or <a href="https://pris.ly/x">follow us on X</a>!</strong></p> <h1>Highlights</h1> <h2>ORM</h2> <h3>Tab completions for the Prisma CLI</h3> <p>Typing out CLI commands from memory is now optional. Prisma ships <strong>shell tab completions</strong> for <code>bash</code>, <code>zsh</code>, <code>fish</code>, and PowerShell, covering commands, subcommands, options, flags, and even option values.</p> <p><strong>Setting it up.</strong> Most projects run Prisma through a package manager, so completions are enabled through <code>@bomb.sh/tab</code>'s package-manager integration — install it once, then source the completion for your package manager and shell:</p> <pre lang="bash"><code># 1. Install @bomb.sh/tab globally npm install -g @bomb.sh/tab <h1>2. Wire up your package manager + shell (pnpm shown; swap in npm / yarn / bun):</h1> <p>echo 'source <(tab pnpm zsh)' >> ~/.zshrc # zsh<br /> echo 'source <(tab pnpm bash)' >> ~/.bashrc # bash<br /> tab pnpm fish > ~/.config/fish/completions/pnpm.fish # fish<br /> tab pnpm powershell > ~/.tab-pnpm.ps1 # PowerShell (then dot-source it from $PROFILE)<br /> </code></pre></p> <p><code>@bomb.sh/tab</code> delegates to any locally-installed CLI that ships completions, so <code>pnpm prisma <TAB></code>, <code>pnpm exec prisma <TAB></code>, <code>yarn prisma <TAB></code>, and <code>bun x prisma <TAB></code> all complete Prisma's commands, options, and values — no per-project setup. (<code>npx</code> and <code>bunx</code> don't support completion themselves; use <code>npm exec</code> and <code>bun x</code>.)</p> <p>If instead you have Prisma installed globally on your <code>PATH</code>, source its own completion directly: <code>source <(prisma complete zsh)</code> (or the <code>bash</code> / <code>fish</code> / <code>powershell</code> variant).</p> <p>This is built on <a href="https://github.com/bombshell-dev/tab/"><code>@bomb.sh/tab</code></a>, the same completion library that powers other CLIs in the ecosystem — including Cloudflare, Nuxt, and Vitest — so the package-manager completions you enable for Prisma work for those tools too. A wonderful community contribution from <a href="https://github.com/AmirSa12"><code>@AmirSa12</code></a> (<a href="https://redirect.github.com/prisma/prisma/pull/28351">#28351</a>) — thank you!</p> <p><a href="https://github.com/user-attachments/assets/1f916a60-ee4d-40be-bb7d-74035d48ca83">https://github.com/user-attachments/assets/1f916a60-ee4d-40be-bb7d-74035d48ca83</a></p> <h3>Prisma ORM, ready for AI agents</h3> <p>Coding agents are now a first-class audience for Prisma, and 7.9.0 brings the first wave of work to make Prisma projects safe and productive for them to work in.</p> <p><strong>Agent skills installed with <code>prisma init</code></strong> (<a href="https://redirect.github.com/prisma/prisma/pull/29689">#29689</a>)</p> <p><code>prisma init</code> now installs the <a href="https://github.com/prisma/skills">prisma/skills</a> catalog into freshly scaffolded projects. Agents such as Claude Code, Cursor, Codex, and Windsurf start out with current, version-relevant Prisma knowledge instead of relying on whatever happened to be in their training data. The install is best-effort and never blocks scaffolding; opt out at any time with <code>--no-skills</code>.</p> <pre lang="terminal"><code>npx prisma@latest init </code></pre> <p><img src="https://github.com/user-attachments/assets/8244a6dc-cdad-4028-a652-bb5ac6e4b271" alt="prisma init scaffolds a project and installs the Prisma agent skills catalog" /></p> <p><strong>A safer default around destructive commands</strong> (<a href="https://redirect.github.com/prisma/prisma/pull/29684">#29684</a>, <a href="https://redirect.github.com/prisma/prisma/pull/29691">#29691</a>, <a href="https://redirect.github.com/prisma/prisma/pull/29713">#29713</a>)</p> <!-- raw HTML omitted --> </blockquote> <p>... (truncated)</p> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/prisma/prisma/commit/b82985029d44349849dfbb4990bb19278178ee61"><code>b829850</code></a> ci: upgrade pnpm to 11 to restore pnpm audit (<a href="https://github.com/prisma/prisma/tree/HEAD/packages/client/issues/29725">#29725</a>)</li> <li><a href="https://github.com/prisma/prisma/commit/280fd56f28c53f42fb2dfbc190c3d35d046e19fa"><code>280fd56</code></a> fix(client): mask each quoted string in maskQuery independently (<a href="https://github.com/prisma/prisma/tree/HEAD/packages/client/issues/29723">#29723</a>)</li> <li><a href="https://github.com/prisma/prisma/commit/4da377494cc27bc0784d3629df21e94989abd153"><code>4da3774</code></a> fix(client): reject invalid raw dates (<a href="https://github.com/prisma/prisma/tree/HEAD/packages/client/issues/29697">#29697</a>)</li> <li><a href="https://github.com/prisma/prisma/commit/a7cec97b204e734cf30049ee7a39c9b61da085de"><code>a7cec97</code></a> chore(deps): update engines to 7.9.0-1.e922089b7d7502aff4249d5da3420f6fa55fc6...</li> <li><a href="https://github.com/prisma/prisma/commit/58f8439d020d70bf7cc9a77cca62dfc95d9ddc0f"><code>58f8439</code></a> fix(client): pin pg-protocol in prisma-client-imports-postgres e2e test (<a href="https://github.com/prisma/prisma/tree/HEAD/packages/client/issues/29687">#29687</a>)</li> <li><a href="https://github.com/prisma/prisma/commit/918cf5d72c1ba85ed0bb85c50c34d483b02a19e1"><code>918cf5d</code></a> fix(client): improve adapter-related Prisma 7 error messages (<a href="https://github.com/prisma/prisma/tree/HEAD/packages/client/issues/29624">#29624</a>)</li> <li><a href="https://github.com/prisma/prisma/commit/93da6ea2dcd65b8b4b9d58daf2e2821f1a4e9320"><code>93da6ea</code></a> ci(e2e): shard client e2e suite across 3 jobs to fix chronic timeouts (<a href="https://github.com/prisma/prisma/tree/HEAD/packages/client/issues/29619">#29619</a>)</li> <li><a href="https://github.com/prisma/prisma/commit/3937779e617c743966ebb50901d013167dd9171e"><code>3937779</code></a> fix: remove duplicate 'the the' in test comments (<a href="https://github.com/prisma/prisma/tree/HEAD/packages/client/issues/29610">#29610</a>)</li> <li><a href="https://github.com/prisma/prisma/commit/fda8fbce23b3af6b1651bd539da09e62c863ed6e"><code>fda8fbc</code></a> chore(deps): bump <code>@prisma/dev</code> to 0.24.9 (resolves hono GHSA-92pp-h63x-v22m) (...</li> <li><a href="https://github.com/prisma/prisma/commit/0036baf8c9bb0b53e18c04fb27de4acf0535a306"><code>0036baf</code></a> fix(client-engine-runtime): surface unmapped driver errors as user-facing P20...</li> <li>See full diff in <a href="https://github.com/prisma/prisma/commits/7.9.0/packages/client">compare view</a></li> </ul> </details> <br /> Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore <dependency name> major version` will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself) - `@dependabot ignore <dependency name> minor version` will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself) - `@dependabot ignore <dependency name>` will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself) - `@dependabot unignore <dependency name>` will remove all of the ignore conditions of the specified dependency - `@dependabot unignore <dependency name> <ignore condition>` will remove the ignore condition of the specified dependency and ignore conditions </details> Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>	2026-08-03 09:53:20 -05:00
dependabot[bot]	823b39aa10	build(deps): bump the website group in /docs with 9 updates (#8966 ) Bumps the website group in /docs with 9 updates: \| Package \| From \| To \| \| --- \| --- \| --- \| \| [@docusaurus/core](https://github.com/facebook/docusaurus/tree/HEAD/packages/docusaurus) \| `3.10.1` \| `3.10.2` \| \| [@docusaurus/plugin-content-docs](https://github.com/facebook/docusaurus/tree/HEAD/packages/docusaurus-plugin-content-docs) \| `3.10.1` \| `3.10.2` \| \| [@docusaurus/plugin-google-gtag](https://github.com/facebook/docusaurus/tree/HEAD/packages/docusaurus-plugin-google-gtag) \| `3.10.1` \| `3.10.2` \| \| [@docusaurus/preset-classic](https://github.com/facebook/docusaurus/tree/HEAD/packages/docusaurus-preset-classic) \| `3.10.1` \| `3.10.2` \| \| [@docusaurus/theme-mermaid](https://github.com/facebook/docusaurus/tree/HEAD/packages/docusaurus-theme-mermaid) \| `3.10.1` \| `3.10.2` \| \| [@floating-ui/react](https://github.com/floating-ui/floating-ui/tree/HEAD/packages/react) \| `0.27.19` \| `0.27.20` \| \| [eslint](https://github.com/eslint/eslint) \| `10.5.0` \| `10.8.0` \| \| [recharts](https://github.com/recharts/recharts) \| `3.9.0` \| `3.10.0` \| \| [baseline-browser-mapping](https://github.com/web-platform-dx/baseline-browser-mapping) \| `2.10.38` \| `2.11.9` \| Updates `@docusaurus/core` from 3.10.1 to 3.10.2 <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/facebook/docusaurus/releases">@docusaurus/core's releases</a>.</em></p> <blockquote> <h2>3.10.2 (2026-07-10)</h2> <p>Backport and cherry-pick commits from main for v3.10.2 patch release:</p> <ul> <li>[fix(bundler): do not import <code>@swc/html</code>, fix StackBlitz playground <a href="https://github.com/facebook/docusaurus/tree/HEAD/packages/docusaurus/issues/12055">#12055</a>](<a href="https://redirect.github.com/facebook/docusaurus/pull/12055">facebook/docusaurus#12055</a>)</li> <li>[fix(core): use locale url in site config <a href="https://github.com/facebook/docusaurus/tree/HEAD/packages/docusaurus/issues/12054">#12054</a>](<a href="https://redirect.github.com/facebook/docusaurus/pull/12054">facebook/docusaurus#12054</a>)</li> <li>[fix(theme-classic): remove redundant sidebar label titles <a href="https://github.com/facebook/docusaurus/tree/HEAD/packages/docusaurus/issues/11966">#11966</a>](<a href="https://redirect.github.com/facebook/docusaurus/pull/11966">facebook/docusaurus#11966</a>)</li> <li>[fix(mdx-loader): avoid transforming dotted directory links into asset… <a href="https://github.com/facebook/docusaurus/tree/HEAD/packages/docusaurus/issues/11944">#11944</a>](<a href="https://redirect.github.com/facebook/docusaurus/pull/11944">facebook/docusaurus#11944</a>)</li> <li>[fix(dev-server): for HTTPS, support non-RSA TLS certs <a href="https://github.com/facebook/docusaurus/tree/HEAD/packages/docusaurus/issues/12065">#12065</a>](<a href="https://redirect.github.com/facebook/docusaurus/pull/12065">facebook/docusaurus#12065</a>)</li> <li>[fix(utils): fix <code>extractLeadingEmoji()</code> edge cases <a href="https://github.com/facebook/docusaurus/tree/HEAD/packages/docusaurus/issues/12100">#12100</a>](<a href="https://redirect.github.com/facebook/docusaurus/pull/12100">facebook/docusaurus#12100</a>)</li> <li>[fix(gtag.js, faster): Fix StackBlitz, vendor <code>@types/gtag.js</code>, upgrade <code>@swc/html</code> <a href="https://github.com/facebook/docusaurus/tree/HEAD/packages/docusaurus/issues/12080">#12080</a>](<a href="https://redirect.github.com/facebook/docusaurus/pull/12080">facebook/docusaurus#12080</a>)</li> <li>[fix(create-docusaurus): init template README should use npm commands by default <a href="https://github.com/facebook/docusaurus/tree/HEAD/packages/docusaurus/issues/12138">#12138</a>](<a href="https://redirect.github.com/facebook/docusaurus/pull/12138">facebook/docusaurus#12138</a>)</li> <li>[fix(cli): <code>docusaurus serve</code> should pass <code>--host</code> to <code>server.listen()</code> <a href="https://github.com/facebook/docusaurus/tree/HEAD/packages/docusaurus/issues/12127">#12127</a>](<a href="https://redirect.github.com/facebook/docusaurus/pull/12127">facebook/docusaurus#12127</a>)</li> <li>[fix(core): bump detect-port to v2.1, fix pnpm <code>trustPolicy</code> downgrade issue <a href="https://github.com/facebook/docusaurus/tree/HEAD/packages/docusaurus/issues/12012">#12012</a>](<a href="https://redirect.github.com/facebook/docusaurus/pull/12012">facebook/docusaurus#12012</a>)</li> <li>[fix(i18n): complete Spanish translations for theme-common and theme-l… <a href="https://github.com/facebook/docusaurus/tree/HEAD/packages/docusaurus/issues/12180">#12180</a>](<a href="https://redirect.github.com/facebook/docusaurus/pull/12180">facebook/docusaurus#12180</a>)</li> <li>[chore(deps): migrate to <code>@11ty/gray-matter</code> <a href="https://github.com/facebook/docusaurus/tree/HEAD/packages/docusaurus/issues/12181">#12181</a>](<a href="https://redirect.github.com/facebook/docusaurus/pull/12181">facebook/docusaurus#12181</a>)</li> <li>[fix(core): fix BaseUrlIssueBanner little security issue <a href="https://github.com/facebook/docusaurus/tree/HEAD/packages/docusaurus/issues/12260">#12260</a>](<a href="https://redirect.github.com/facebook/docusaurus/pull/12260">facebook/docusaurus#12260</a>)</li> <li>[fix(core): accept boolean attributes in headTags config validation <a href="https://github.com/facebook/docusaurus/tree/HEAD/packages/docusaurus/issues/12238">#12238</a>](<a href="https://redirect.github.com/facebook/docusaurus/pull/12238">facebook/docusaurus#12238</a>)</li> <li>[fix(sitemap): don't drop lastmod for an epoch (0) timestamp <a href="https://github.com/facebook/docusaurus/tree/HEAD/packages/docusaurus/issues/12212">#12212</a>](<a href="https://redirect.github.com/facebook/docusaurus/pull/12212">facebook/docusaurus#12212</a>)</li> <li>[fix(utils): preserve author names containing commas in git log parsing <a href="https://github.com/facebook/docusaurus/tree/HEAD/packages/docusaurus/issues/12069">#12069</a>](<a href="https://redirect.github.com/facebook/docusaurus/pull/12069">facebook/docusaurus#12069</a>)</li> </ul> </blockquote> </details> <details> <summary>Changelog</summary> <p><em>Sourced from <a href="https://github.com/facebook/docusaurus/blob/main/CHANGELOG.md">@docusaurus/core's changelog</a>.</em></p> <blockquote> <h2>3.10.2 (2026-07-10)</h2> <p>Backport and cherry-pick commits from main for v3.10.2 patch release:</p> <ul> <li>[fix(bundler): do not import <code>@swc/html</code>, fix StackBlitz playground <a href="https://github.com/facebook/docusaurus/tree/HEAD/packages/docusaurus/issues/12055">#12055</a>](<a href="https://redirect.github.com/facebook/docusaurus/pull/12055">facebook/docusaurus#12055</a>)</li> <li>[fix(core): use locale url in site config <a href="https://github.com/facebook/docusaurus/tree/HEAD/packages/docusaurus/issues/12054">#12054</a>](<a href="https://redirect.github.com/facebook/docusaurus/pull/12054">facebook/docusaurus#12054</a>)</li> <li>[fix(theme-classic): remove redundant sidebar label titles <a href="https://github.com/facebook/docusaurus/tree/HEAD/packages/docusaurus/issues/11966">#11966</a>](<a href="https://redirect.github.com/facebook/docusaurus/pull/11966">facebook/docusaurus#11966</a>)</li> <li>[fix(mdx-loader): avoid transforming dotted directory links into asset… <a href="https://github.com/facebook/docusaurus/tree/HEAD/packages/docusaurus/issues/11944">#11944</a>](<a href="https://redirect.github.com/facebook/docusaurus/pull/11944">facebook/docusaurus#11944</a>)</li> <li>[fix(dev-server): for HTTPS, support non-RSA TLS certs <a href="https://github.com/facebook/docusaurus/tree/HEAD/packages/docusaurus/issues/12065">#12065</a>](<a href="https://redirect.github.com/facebook/docusaurus/pull/12065">facebook/docusaurus#12065</a>)</li> <li>[fix(utils): fix <code>extractLeadingEmoji()</code> edge cases <a href="https://github.com/facebook/docusaurus/tree/HEAD/packages/docusaurus/issues/12100">#12100</a>](<a href="https://redirect.github.com/facebook/docusaurus/pull/12100">facebook/docusaurus#12100</a>)</li> <li>[fix(gtag.js, faster): Fix StackBlitz, vendor <code>@types/gtag.js</code>, upgrade <code>@swc/html</code> <a href="https://github.com/facebook/docusaurus/tree/HEAD/packages/docusaurus/issues/12080">#12080</a>](<a href="https://redirect.github.com/facebook/docusaurus/pull/12080">facebook/docusaurus#12080</a>)</li> <li>[fix(create-docusaurus): init template README should use npm commands by default <a href="https://github.com/facebook/docusaurus/tree/HEAD/packages/docusaurus/issues/12138">#12138</a>](<a href="https://redirect.github.com/facebook/docusaurus/pull/12138">facebook/docusaurus#12138</a>)</li> <li>[fix(cli): <code>docusaurus serve</code> should pass <code>--host</code> to <code>server.listen()</code> <a href="https://github.com/facebook/docusaurus/tree/HEAD/packages/docusaurus/issues/12127">#12127</a>](<a href="https://redirect.github.com/facebook/docusaurus/pull/12127">facebook/docusaurus#12127</a>)</li> <li>[fix(core): bump detect-port to v2.1, fix pnpm <code>trustPolicy</code> downgrade issue <a href="https://github.com/facebook/docusaurus/tree/HEAD/packages/docusaurus/issues/12012">#12012</a>](<a href="https://redirect.github.com/facebook/docusaurus/pull/12012">facebook/docusaurus#12012</a>)</li> <li>[fix(i18n): complete Spanish translations for theme-common and theme-l… <a href="https://github.com/facebook/docusaurus/tree/HEAD/packages/docusaurus/issues/12180">#12180</a>](<a href="https://redirect.github.com/facebook/docusaurus/pull/12180">facebook/docusaurus#12180</a>)</li> <li>[chore(deps): migrate to <code>@11ty/gray-matter</code> <a href="https://github.com/facebook/docusaurus/tree/HEAD/packages/docusaurus/issues/12181">#12181</a>](<a href="https://redirect.github.com/facebook/docusaurus/pull/12181">facebook/docusaurus#12181</a>)</li> <li>[fix(core): fix BaseUrlIssueBanner little security issue <a href="https://github.com/facebook/docusaurus/tree/HEAD/packages/docusaurus/issues/12260">#12260</a>](<a href="https://redirect.github.com/facebook/docusaurus/pull/12260">facebook/docusaurus#12260</a>)</li> <li>[fix(core): accept boolean attributes in headTags config validation <a href="https://github.com/facebook/docusaurus/tree/HEAD/packages/docusaurus/issues/12238">#12238</a>](<a href="https://redirect.github.com/facebook/docusaurus/pull/12238">facebook/docusaurus#12238</a>)</li> <li>[fix(sitemap): don't drop lastmod for an epoch (0) timestamp <a href="https://github.com/facebook/docusaurus/tree/HEAD/packages/docusaurus/issues/12212">#12212</a>](<a href="https://redirect.github.com/facebook/docusaurus/pull/12212">facebook/docusaurus#12212</a>)</li> <li>[fix(utils): preserve author names containing commas in git log parsing <a href="https://github.com/facebook/docusaurus/tree/HEAD/packages/docusaurus/issues/12069">#12069</a>](<a href="https://redirect.github.com/facebook/docusaurus/pull/12069">facebook/docusaurus#12069</a>)</li> </ul> </blockquote> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/facebook/docusaurus/commit/f37f9035584917a97a260b91fc2842cba4f8b94f"><code>f37f903</code></a> v3.10.2</li> <li><a href="https://github.com/facebook/docusaurus/commit/2f5389d1fa4c1801d7bfe6ec13e9317cec449935"><code>2f5389d</code></a> chore: cherry-pick commits for v3.10.2 patch release (<a href="https://github.com/facebook/docusaurus/tree/HEAD/packages/docusaurus/issues/12265">#12265</a>)</li> <li>See full diff in <a href="https://github.com/facebook/docusaurus/commits/v3.10.2/packages/docusaurus">compare view</a></li> </ul> </details> <br /> Updates `@docusaurus/plugin-content-docs` from 3.10.1 to 3.10.2 <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/facebook/docusaurus/releases">@docusaurus/plugin-content-docs's releases</a>.</em></p> <blockquote> <h2>3.10.2 (2026-07-10)</h2> <p>Backport and cherry-pick commits from main for v3.10.2 patch release:</p> <ul> <li>[fix(bundler): do not import <code>@swc/html</code>, fix StackBlitz playground <a href="https://github.com/facebook/docusaurus/tree/HEAD/packages/docusaurus-plugin-content-docs/issues/12055">#12055</a>](<a href="https://redirect.github.com/facebook/docusaurus/pull/12055">facebook/docusaurus#12055</a>)</li> <li>[fix(core): use locale url in site config <a href="https://github.com/facebook/docusaurus/tree/HEAD/packages/docusaurus-plugin-content-docs/issues/12054">#12054</a>](<a href="https://redirect.github.com/facebook/docusaurus/pull/12054">facebook/docusaurus#12054</a>)</li> <li>[fix(theme-classic): remove redundant sidebar label titles <a href="https://github.com/facebook/docusaurus/tree/HEAD/packages/docusaurus-plugin-content-docs/issues/11966">#11966</a>](<a href="https://redirect.github.com/facebook/docusaurus/pull/11966">facebook/docusaurus#11966</a>)</li> <li>[fix(mdx-loader): avoid transforming dotted directory links into asset… <a href="https://github.com/facebook/docusaurus/tree/HEAD/packages/docusaurus-plugin-content-docs/issues/11944">#11944</a>](<a href="https://redirect.github.com/facebook/docusaurus/pull/11944">facebook/docusaurus#11944</a>)</li> <li>[fix(dev-server): for HTTPS, support non-RSA TLS certs <a href="https://github.com/facebook/docusaurus/tree/HEAD/packages/docusaurus-plugin-content-docs/issues/12065">#12065</a>](<a href="https://redirect.github.com/facebook/docusaurus/pull/12065">facebook/docusaurus#12065</a>)</li> <li>[fix(utils): fix <code>extractLeadingEmoji()</code> edge cases <a href="https://github.com/facebook/docusaurus/tree/HEAD/packages/docusaurus-plugin-content-docs/issues/12100">#12100</a>](<a href="https://redirect.github.com/facebook/docusaurus/pull/12100">facebook/docusaurus#12100</a>)</li> <li>[fix(gtag.js, faster): Fix StackBlitz, vendor <code>@types/gtag.js</code>, upgrade <code>@swc/html</code> <a href="https://github.com/facebook/docusaurus/tree/HEAD/packages/docusaurus-plugin-content-docs/issues/12080">#12080</a>](<a href="https://redirect.github.com/facebook/docusaurus/pull/12080">facebook/docusaurus#12080</a>)</li> <li>[fix(create-docusaurus): init template README should use npm commands by default <a href="https://github.com/facebook/docusaurus/tree/HEAD/packages/docusaurus-plugin-content-docs/issues/12138">#12138</a>](<a href="https://redirect.github.com/facebook/docusaurus/pull/12138">facebook/docusaurus#12138</a>)</li> <li>[fix(cli): <code>docusaurus serve</code> should pass <code>--host</code> to <code>server.listen()</code> <a href="https://github.com/facebook/docusaurus/tree/HEAD/packages/docusaurus-plugin-content-docs/issues/12127">#12127</a>](<a href="https://redirect.github.com/facebook/docusaurus/pull/12127">facebook/docusaurus#12127</a>)</li> <li>[fix(core): bump detect-port to v2.1, fix pnpm <code>trustPolicy</code> downgrade issue <a href="https://github.com/facebook/docusaurus/tree/HEAD/packages/docusaurus-plugin-content-docs/issues/12012">#12012</a>](<a href="https://redirect.github.com/facebook/docusaurus/pull/12012">facebook/docusaurus#12012</a>)</li> <li>[fix(i18n): complete Spanish translations for theme-common and theme-l… <a href="https://github.com/facebook/docusaurus/tree/HEAD/packages/docusaurus-plugin-content-docs/issues/12180">#12180</a>](<a href="https://redirect.github.com/facebook/docusaurus/pull/12180">facebook/docusaurus#12180</a>)</li> <li>[chore(deps): migrate to <code>@11ty/gray-matter</code> <a href="https://github.com/facebook/docusaurus/tree/HEAD/packages/docusaurus-plugin-content-docs/issues/12181">#12181</a>](<a href="https://redirect.github.com/facebook/docusaurus/pull/12181">facebook/docusaurus#12181</a>)</li> <li>[fix(core): fix BaseUrlIssueBanner little security issue <a href="https://github.com/facebook/docusaurus/tree/HEAD/packages/docusaurus-plugin-content-docs/issues/12260">#12260</a>](<a href="https://redirect.github.com/facebook/docusaurus/pull/12260">facebook/docusaurus#12260</a>)</li> <li>[fix(core): accept boolean attributes in headTags config validation <a href="https://github.com/facebook/docusaurus/tree/HEAD/packages/docusaurus-plugin-content-docs/issues/12238">#12238</a>](<a href="https://redirect.github.com/facebook/docusaurus/pull/12238">facebook/docusaurus#12238</a>)</li> <li>[fix(sitemap): don't drop lastmod for an epoch (0) timestamp <a href="https://github.com/facebook/docusaurus/tree/HEAD/packages/docusaurus-plugin-content-docs/issues/12212">#12212</a>](<a href="https://redirect.github.com/facebook/docusaurus/pull/12212">facebook/docusaurus#12212</a>)</li> <li>[fix(utils): preserve author names containing commas in git log parsing <a href="https://github.com/facebook/docusaurus/tree/HEAD/packages/docusaurus-plugin-content-docs/issues/12069">#12069</a>](<a href="https://redirect.github.com/facebook/docusaurus/pull/12069">facebook/docusaurus#12069</a>)</li> </ul> </blockquote> </details> <details> <summary>Changelog</summary> <p><em>Sourced from <a href="https://github.com/facebook/docusaurus/blob/main/CHANGELOG.md">@docusaurus/plugin-content-docs's changelog</a>.</em></p> <blockquote> <h2>3.10.2 (2026-07-10)</h2> <p>Backport and cherry-pick commits from main for v3.10.2 patch release:</p> <ul> <li>[fix(bundler): do not import <code>@swc/html</code>, fix StackBlitz playground <a href="https://github.com/facebook/docusaurus/tree/HEAD/packages/docusaurus-plugin-content-docs/issues/12055">#12055</a>](<a href="https://redirect.github.com/facebook/docusaurus/pull/12055">facebook/docusaurus#12055</a>)</li> <li>[fix(core): use locale url in site config <a href="https://github.com/facebook/docusaurus/tree/HEAD/packages/docusaurus-plugin-content-docs/issues/12054">#12054</a>](<a href="https://redirect.github.com/facebook/docusaurus/pull/12054">facebook/docusaurus#12054</a>)</li> <li>[fix(theme-classic): remove redundant sidebar label titles <a href="https://github.com/facebook/docusaurus/tree/HEAD/packages/docusaurus-plugin-content-docs/issues/11966">#11966</a>](<a href="https://redirect.github.com/facebook/docusaurus/pull/11966">facebook/docusaurus#11966</a>)</li> <li>[fix(mdx-loader): avoid transforming dotted directory links into asset… <a href="https://github.com/facebook/docusaurus/tree/HEAD/packages/docusaurus-plugin-content-docs/issues/11944">#11944</a>](<a href="https://redirect.github.com/facebook/docusaurus/pull/11944">facebook/docusaurus#11944</a>)</li> <li>[fix(dev-server): for HTTPS, support non-RSA TLS certs <a href="https://github.com/facebook/docusaurus/tree/HEAD/packages/docusaurus-plugin-content-docs/issues/12065">#12065</a>](<a href="https://redirect.github.com/facebook/docusaurus/pull/12065">facebook/docusaurus#12065</a>)</li> <li>[fix(utils): fix <code>extractLeadingEmoji()</code> edge cases <a href="https://github.com/facebook/docusaurus/tree/HEAD/packages/docusaurus-plugin-content-docs/issues/12100">#12100</a>](<a href="https://redirect.github.com/facebook/docusaurus/pull/12100">facebook/docusaurus#12100</a>)</li> <li>[fix(gtag.js, faster): Fix StackBlitz, vendor <code>@types/gtag.js</code>, upgrade <code>@swc/html</code> <a href="https://github.com/facebook/docusaurus/tree/HEAD/packages/docusaurus-plugin-content-docs/issues/12080">#12080</a>](<a href="https://redirect.github.com/facebook/docusaurus/pull/12080">facebook/docusaurus#12080</a>)</li> <li>[fix(create-docusaurus): init template README should use npm commands by default <a href="https://github.com/facebook/docusaurus/tree/HEAD/packages/docusaurus-plugin-content-docs/issues/12138">#12138</a>](<a href="https://redirect.github.com/facebook/docusaurus/pull/12138">facebook/docusaurus#12138</a>)</li> <li>[fix(cli): <code>docusaurus serve</code> should pass <code>--host</code> to <code>server.listen()</code> <a href="https://github.com/facebook/docusaurus/tree/HEAD/packages/docusaurus-plugin-content-docs/issues/12127">#12127</a>](<a href="https://redirect.github.com/facebook/docusaurus/pull/12127">facebook/docusaurus#12127</a>)</li> <li>[fix(core): bump detect-port to v2.1, fix pnpm <code>trustPolicy</code> downgrade issue <a href="https://github.com/facebook/docusaurus/tree/HEAD/packages/docusaurus-plugin-content-docs/issues/12012">#12012</a>](<a href="https://redirect.github.com/facebook/docusaurus/pull/12012">facebook/docusaurus#12012</a>)</li> <li>[fix(i18n): complete Spanish translations for theme-common and theme-l… <a href="https://github.com/facebook/docusaurus/tree/HEAD/packages/docusaurus-plugin-content-docs/issues/12180">#12180</a>](<a href="https://redirect.github.com/facebook/docusaurus/pull/12180">facebook/docusaurus#12180</a>)</li> <li>[chore(deps): migrate to <code>@11ty/gray-matter</code> <a href="https://github.com/facebook/docusaurus/tree/HEAD/packages/docusaurus-plugin-content-docs/issues/12181">#12181</a>](<a href="https://redirect.github.com/facebook/docusaurus/pull/12181">facebook/docusaurus#12181</a>)</li> <li>[fix(core): fix BaseUrlIssueBanner little security issue <a href="https://github.com/facebook/docusaurus/tree/HEAD/packages/docusaurus-plugin-content-docs/issues/12260">#12260</a>](<a href="https://redirect.github.com/facebook/docusaurus/pull/12260">facebook/docusaurus#12260</a>)</li> <li>[fix(core): accept boolean attributes in headTags config validation <a href="https://github.com/facebook/docusaurus/tree/HEAD/packages/docusaurus-plugin-content-docs/issues/12238">#12238</a>](<a href="https://redirect.github.com/facebook/docusaurus/pull/12238">facebook/docusaurus#12238</a>)</li> <li>[fix(sitemap): don't drop lastmod for an epoch (0) timestamp <a href="https://github.com/facebook/docusaurus/tree/HEAD/packages/docusaurus-plugin-content-docs/issues/12212">#12212</a>](<a href="https://redirect.github.com/facebook/docusaurus/pull/12212">facebook/docusaurus#12212</a>)</li> <li>[fix(utils): preserve author names containing commas in git log parsing <a href="https://github.com/facebook/docusaurus/tree/HEAD/packages/docusaurus-plugin-content-docs/issues/12069">#12069</a>](<a href="https://redirect.github.com/facebook/docusaurus/pull/12069">facebook/docusaurus#12069</a>)</li> </ul> </blockquote> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/facebook/docusaurus/commit/f37f9035584917a97a260b91fc2842cba4f8b94f"><code>f37f903</code></a> v3.10.2</li> <li>See full diff in <a href="https://github.com/facebook/docusaurus/commits/v3.10.2/packages/docusaurus-plugin-content-docs">compare view</a></li> </ul> </details> <br /> Updates `@docusaurus/plugin-google-gtag` from 3.10.1 to 3.10.2 <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/facebook/docusaurus/releases">@docusaurus/plugin-google-gtag's releases</a>.</em></p> <blockquote> <h2>3.10.2 (2026-07-10)</h2> <p>Backport and cherry-pick commits from main for v3.10.2 patch release:</p> <ul> <li>[fix(bundler): do not import <code>@swc/html</code>, fix StackBlitz playground <a href="https://github.com/facebook/docusaurus/tree/HEAD/packages/docusaurus-plugin-google-gtag/issues/12055">#12055</a>](<a href="https://redirect.github.com/facebook/docusaurus/pull/12055">facebook/docusaurus#12055</a>)</li> <li>[fix(core): use locale url in site config <a href="https://github.com/facebook/docusaurus/tree/HEAD/packages/docusaurus-plugin-google-gtag/issues/12054">#12054</a>](<a href="https://redirect.github.com/facebook/docusaurus/pull/12054">facebook/docusaurus#12054</a>)</li> <li>[fix(theme-classic): remove redundant sidebar label titles <a href="https://github.com/facebook/docusaurus/tree/HEAD/packages/docusaurus-plugin-google-gtag/issues/11966">#11966</a>](<a href="https://redirect.github.com/facebook/docusaurus/pull/11966">facebook/docusaurus#11966</a>)</li> <li>[fix(mdx-loader): avoid transforming dotted directory links into asset… <a href="https://github.com/facebook/docusaurus/tree/HEAD/packages/docusaurus-plugin-google-gtag/issues/11944">#11944</a>](<a href="https://redirect.github.com/facebook/docusaurus/pull/11944">facebook/docusaurus#11944</a>)</li> <li>[fix(dev-server): for HTTPS, support non-RSA TLS certs <a href="https://github.com/facebook/docusaurus/tree/HEAD/packages/docusaurus-plugin-google-gtag/issues/12065">#12065</a>](<a href="https://redirect.github.com/facebook/docusaurus/pull/12065">facebook/docusaurus#12065</a>)</li> <li>[fix(utils): fix <code>extractLeadingEmoji()</code> edge cases <a href="https://github.com/facebook/docusaurus/tree/HEAD/packages/docusaurus-plugin-google-gtag/issues/12100">#12100</a>](<a href="https://redirect.github.com/facebook/docusaurus/pull/12100">facebook/docusaurus#12100</a>)</li> <li>[fix(gtag.js, faster): Fix StackBlitz, vendor <code>@types/gtag.js</code>, upgrade <code>@swc/html</code> <a href="https://github.com/facebook/docusaurus/tree/HEAD/packages/docusaurus-plugin-google-gtag/issues/12080">#12080</a>](<a href="https://redirect.github.com/facebook/docusaurus/pull/12080">facebook/docusaurus#12080</a>)</li> <li>[fix(create-docusaurus): init template README should use npm commands by default <a href="https://github.com/facebook/docusaurus/tree/HEAD/packages/docusaurus-plugin-google-gtag/issues/12138">#12138</a>](<a href="https://redirect.github.com/facebook/docusaurus/pull/12138">facebook/docusaurus#12138</a>)</li> <li>[fix(cli): <code>docusaurus serve</code> should pass <code>--host</code> to <code>server.listen()</code> <a href="https://github.com/facebook/docusaurus/tree/HEAD/packages/docusaurus-plugin-google-gtag/issues/12127">#12127</a>](<a href="https://redirect.github.com/facebook/docusaurus/pull/12127">facebook/docusaurus#12127</a>)</li> <li>[fix(core): bump detect-port to v2.1, fix pnpm <code>trustPolicy</code> downgrade issue <a href="https://github.com/facebook/docusaurus/tree/HEAD/packages/docusaurus-plugin-google-gtag/issues/12012">#12012</a>](<a href="https://redirect.github.com/facebook/docusaurus/pull/12012">facebook/docusaurus#12012</a>)</li> <li>[fix(i18n): complete Spanish translations for theme-common and theme-l… <a href="https://github.com/facebook/docusaurus/tree/HEAD/packages/docusaurus-plugin-google-gtag/issues/12180">#12180</a>](<a href="https://redirect.github.com/facebook/docusaurus/pull/12180">facebook/docusaurus#12180</a>)</li> <li>[chore(deps): migrate to <code>@11ty/gray-matter</code> <a href="https://github.com/facebook/docusaurus/tree/HEAD/packages/docusaurus-plugin-google-gtag/issues/12181">#12181</a>](<a href="https://redirect.github.com/facebook/docusaurus/pull/12181">facebook/docusaurus#12181</a>)</li> <li>[fix(core): fix BaseUrlIssueBanner little security issue <a href="https://github.com/facebook/docusaurus/tree/HEAD/packages/docusaurus-plugin-google-gtag/issues/12260">#12260</a>](<a href="https://redirect.github.com/facebook/docusaurus/pull/12260">facebook/docusaurus#12260</a>)</li> <li>[fix(core): accept boolean attributes in headTags config validation <a href="https://github.com/facebook/docusaurus/tree/HEAD/packages/docusaurus-plugin-google-gtag/issues/12238">#12238</a>](<a href="https://redirect.github.com/facebook/docusaurus/pull/12238">facebook/docusaurus#12238</a>)</li> <li>[fix(sitemap): don't drop lastmod for an epoch (0) timestamp <a href="https://github.com/facebook/docusaurus/tree/HEAD/packages/docusaurus-plugin-google-gtag/issues/12212">#12212</a>](<a href="https://redirect.github.com/facebook/docusaurus/pull/12212">facebook/docusaurus#12212</a>)</li> <li>[fix(utils): preserve author names containing commas in git log parsing <a href="https://github.com/facebook/docusaurus/tree/HEAD/packages/docusaurus-plugin-google-gtag/issues/12069">#12069</a>](<a href="https://redirect.github.com/facebook/docusaurus/pull/12069">facebook/docusaurus#12069</a>)</li> </ul> </blockquote> </details> <details> <summary>Changelog</summary> <p><em>Sourced from <a href="https://github.com/facebook/docusaurus/blob/main/CHANGELOG.md">@docusaurus/plugin-google-gtag's changelog</a>.</em></p> <blockquote> <h2>3.10.2 (2026-07-10)</h2> <p>Backport and cherry-pick commits from main for v3.10.2 patch release:</p> <ul> <li>[fix(bundler): do not import <code>@swc/html</code>, fix StackBlitz playground <a href="https://github.com/facebook/docusaurus/tree/HEAD/packages/docusaurus-plugin-google-gtag/issues/12055">#12055</a>](<a href="https://redirect.github.com/facebook/docusaurus/pull/12055">facebook/docusaurus#12055</a>)</li> <li>[fix(core): use locale url in site config <a href="https://github.com/facebook/docusaurus/tree/HEAD/packages/docusaurus-plugin-google-gtag/issues/12054">#12054</a>](<a href="https://redirect.github.com/facebook/docusaurus/pull/12054">facebook/docusaurus#12054</a>)</li> <li>[fix(theme-classic): remove redundant sidebar label titles <a href="https://github.com/facebook/docusaurus/tree/HEAD/packages/docusaurus-plugin-google-gtag/issues/11966">#11966</a>](<a href="https://redirect.github.com/facebook/docusaurus/pull/11966">facebook/docusaurus#11966</a>)</li> <li>[fix(mdx-loader): avoid transforming dotted directory links into asset… <a href="https://github.com/facebook/docusaurus/tree/HEAD/packages/docusaurus-plugin-google-gtag/issues/11944">#11944</a>](<a href="https://redirect.github.com/facebook/docusaurus/pull/11944">facebook/docusaurus#11944</a>)</li> <li>[fix(dev-server): for HTTPS, support non-RSA TLS certs <a href="https://github.com/facebook/docusaurus/tree/HEAD/packages/docusaurus-plugin-google-gtag/issues/12065">#12065</a>](<a href="https://redirect.github.com/facebook/docusaurus/pull/12065">facebook/docusaurus#12065</a>)</li> <li>[fix(utils): fix <code>extractLeadingEmoji()</code> edge cases <a href="https://github.com/facebook/docusaurus/tree/HEAD/packages/docusaurus-plugin-google-gtag/issues/12100">#12100</a>](<a href="https://redirect.github.com/facebook/docusaurus/pull/12100">facebook/docusaurus#12100</a>)</li> <li>[fix(gtag.js, faster): Fix StackBlitz, vendor <code>@types/gtag.js</code>, upgrade <code>@swc/html</code> <a href="https://github.com/facebook/docusaurus/tree/HEAD/packages/docusaurus-plugin-google-gtag/issues/12080">#12080</a>](<a href="https://redirect.github.com/facebook/docusaurus/pull/12080">facebook/docusaurus#12080</a>)</li> <li>[fix(create-docusaurus): init template README should use npm commands by default <a href="https://github.com/facebook/docusaurus/tree/HEAD/packages/docusaurus-plugin-google-gtag/issues/12138">#12138</a>](<a href="https://redirect.github.com/facebook/docusaurus/pull/12138">facebook/docusaurus#12138</a>)</li> <li>[fix(cli): <code>docusaurus serve</code> should pass <code>--host</code> to <code>server.listen()</code> <a href="https://github.com/facebook/docusaurus/tree/HEAD/packages/docusaurus-plugin-google-gtag/issues/12127">#12127</a>](<a href="https://redirect.github.com/facebook/docusaurus/pull/12127">facebook/docusaurus#12127</a>)</li> <li>[fix(core): bump detect-port to v2.1, fix pnpm <code>trustPolicy</code> downgrade issue <a href="https://github.com/facebook/docusaurus/tree/HEAD/packages/docusaurus-plugin-google-gtag/issues/12012">#12012</a>](<a href="https://redirect.github.com/facebook/docusaurus/pull/12012">facebook/docusaurus#12012</a>)</li> <li>[fix(i18n): complete Spanish translations for theme-common and theme-l… <a href="https://github.com/facebook/docusaurus/tree/HEAD/packages/docusaurus-plugin-google-gtag/issues/12180">#12180</a>](<a href="https://redirect.github.com/facebook/docusaurus/pull/12180">facebook/docusaurus#12180</a>)</li> <li>[chore(deps): migrate to <code>@11ty/gray-matter</code> <a href="https://github.com/facebook/docusaurus/tree/HEAD/packages/docusaurus-plugin-google-gtag/issues/12181">#12181</a>](<a href="https://redirect.github.com/facebook/docusaurus/pull/12181">facebook/docusaurus#12181</a>)</li> <li>[fix(core): fix BaseUrlIssueBanner little security issue <a href="https://github.com/facebook/docusaurus/tree/HEAD/packages/docusaurus-plugin-google-gtag/issues/12260">#12260</a>](<a href="https://redirect.github.com/facebook/docusaurus/pull/12260">facebook/docusaurus#12260</a>)</li> <li>[fix(core): accept boolean attributes in headTags config validation <a href="https://github.com/facebook/docusaurus/tree/HEAD/packages/docusaurus-plugin-google-gtag/issues/12238">#12238</a>](<a href="https://redirect.github.com/facebook/docusaurus/pull/12238">facebook/docusaurus#12238</a>)</li> <li>[fix(sitemap): don't drop lastmod for an epoch (0) timestamp <a href="https://github.com/facebook/docusaurus/tree/HEAD/packages/docusaurus-plugin-google-gtag/issues/12212">#12212</a>](<a href="https://redirect.github.com/facebook/docusaurus/pull/12212">facebook/docusaurus#12212</a>)</li> <li>[fix(utils): preserve author names containing commas in git log parsing <a href="https://github.com/facebook/docusaurus/tree/HEAD/packages/docusaurus-plugin-google-gtag/issues/12069">#12069</a>](<a href="https://redirect.github.com/facebook/docusaurus/pull/12069">facebook/docusaurus#12069</a>)</li> </ul> </blockquote> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/facebook/docusaurus/commit/f37f9035584917a97a260b91fc2842cba4f8b94f"><code>f37f903</code></a> v3.10.2</li> <li><a href="https://github.com/facebook/docusaurus/commit/2f5389d1fa4c1801d7bfe6ec13e9317cec449935"><code>2f5389d</code></a> chore: cherry-pick commits for v3.10.2 patch release (<a href="https://github.com/facebook/docusaurus/tree/HEAD/packages/docusaurus-plugin-google-gtag/issues/12265">#12265</a>)</li> <li>See full diff in <a href="https://github.com/facebook/docusaurus/commits/v3.10.2/packages/docusaurus-plugin-google-gtag">compare view</a></li> </ul> </details> <br /> Updates `@docusaurus/preset-classic` from 3.10.1 to 3.10.2 <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/facebook/docusaurus/releases">@docusaurus/preset-classic's releases</a>.</em></p> <blockquote> <h2>3.10.2 (2026-07-10)</h2> <p>Backport and cherry-pick commits from main for v3.10.2 patch release:</p> <ul> <li>[fix(bundler): do not import <code>@swc/html</code>, fix StackBlitz playground <a href="https://github.com/facebook/docusaurus/tree/HEAD/packages/docusaurus-preset-classic/issues/12055">#12055</a>](<a href="https://redirect.github.com/facebook/docusaurus/pull/12055">facebook/docusaurus#12055</a>)</li> <li>[fix(core): use locale url in site config <a href="https://github.com/facebook/docusaurus/tree/HEAD/packages/docusaurus-preset-classic/issues/12054">#12054</a>](<a href="https://redirect.github.com/facebook/docusaurus/pull/12054">facebook/docusaurus#12054</a>)</li> <li>[fix(theme-classic): remove redundant sidebar label titles <a href="https://github.com/facebook/docusaurus/tree/HEAD/packages/docusaurus-preset-classic/issues/11966">#11966</a>](<a href="https://redirect.github.com/facebook/docusaurus/pull/11966">facebook/docusaurus#11966</a>)</li> <li>[fix(mdx-loader): avoid transforming dotted directory links into asset… <a href="https://github.com/facebook/docusaurus/tree/HEAD/packages/docusaurus-preset-classic/issues/11944">#11944</a>](<a href="https://redirect.github.com/facebook/docusaurus/pull/11944">facebook/docusaurus#11944</a>)</li> <li>[fix(dev-server): for HTTPS, support non-RSA TLS certs <a href="https://github.com/facebook/docusaurus/tree/HEAD/packages/docusaurus-preset-classic/issues/12065">#12065</a>](<a href="https://redirect.github.com/facebook/docusaurus/pull/12065">facebook/docusaurus#12065</a>)</li> <li>[fix(utils): fix <code>extractLeadingEmoji()</code> edge cases <a href="https://github.com/facebook/docusaurus/tree/HEAD/packages/docusaurus-preset-classic/issues/12100">#12100</a>](<a href="https://redirect.github.com/facebook/docusaurus/pull/12100">facebook/docusaurus#12100</a>)</li> <li>[fix(gtag.js, faster): Fix StackBlitz, vendor <code>@types/gtag.js</code>, upgrade <code>@swc/html</code> <a href="https://github.com/facebook/docusaurus/tree/HEAD/packages/docusaurus-preset-classic/issues/12080">#12080</a>](<a href="https://redirect.github.com/facebook/docusaurus/pull/12080">facebook/docusaurus#12080</a>)</li> <li>[fix(create-docusaurus): init template README should use npm commands by default <a href="https://github.com/facebook/docusaurus/tree/HEAD/packages/docusaurus-preset-classic/issues/12138">#12138</a>](<a href="https://redirect.github.com/facebook/docusaurus/pull/12138">facebook/docusaurus#12138</a>)</li> <li>[fix(cli): <code>docusaurus serve</code> should pass <code>--host</code> to <code>server.listen()</code> <a href="https://github.com/facebook/docusaurus/tree/HEAD/packages/docusaurus-preset-classic/issues/12127">#12127</a>](<a href="https://redirect.github.com/facebook/docusaurus/pull/12127">facebook/docusaurus#12127</a>)</li> <li>[fix(core): bump detect-port to v2.1, fix pnpm <code>trustPolicy</code> downgrade issue <a href="https://github.com/facebook/docusaurus/tree/HEAD/packages/docusaurus-preset-classic/issues/12012">#12012</a>](<a href="https://redirect.github.com/facebook/docusaurus/pull/12012">facebook/docusaurus#12012</a>)</li> <li>[fix(i18n): complete Spanish translations for theme-common and theme-l… <a href="https://github.com/facebook/docusaurus/tree/HEAD/packages/docusaurus-preset-classic/issues/12180">#12180</a>](<a href="https://redirect.github.com/facebook/docusaurus/pull/12180">facebook/docusaurus#12180</a>)</li> <li>[chore(deps): migrate to <code>@11ty/gray-matter</code> <a href="https://github.com/facebook/docusaurus/tree/HEAD/packages/docusaurus-preset-classic/issues/12181">#12181</a>](<a href="https://redirect.github.com/facebook/docusaurus/pull/12181">facebook/docusaurus#12181</a>)</li> <li>[fix(core): fix BaseUrlIssueBanner little security issue <a href="https://github.com/facebook/docusaurus/tree/HEAD/packages/docusaurus-preset-classic/issues/12260">#12260</a>](<a href="https://redirect.github.com/facebook/docusaurus/pull/12260">facebook/docusaurus#12260</a>)</li> <li>[fix(core): accept boolean attributes in headTags config validation <a href="https://github.com/facebook/docusaurus/tree/HEAD/packages/docusaurus-preset-classic/issues/12238">#12238</a>](<a href="https://redirect.github.com/facebook/docusaurus/pull/12238">facebook/docusaurus#12238</a>)</li> <li>[fix(sitemap): don't drop lastmod for an epoch (0) timestamp <a href="https://github.com/facebook/docusaurus/tree/HEAD/packages/docusaurus-preset-classic/issues/12212">#12212</a>](<a href="https://redirect.github.com/facebook/docusaurus/pull/12212">facebook/docusaurus#12212</a>)</li> <li>[fix(utils): preserve author names containing commas in git log parsing <a href="https://github.com/facebook/docusaurus/tree/HEAD/packages/docusaurus-preset-classic/issues/12069">#12069</a>](<a href="https://redirect.github.com/facebook/docusaurus/pull/12069">facebook/docusaurus#12069</a>)</li> </ul> </blockquote> </details> <details> <summary>Changelog</summary> <p><em>Sourced from <a href="https://github.com/facebook/docusaurus/blob/main/CHANGELOG.md">@docusaurus/preset-classic's changelog</a>.</em></p> <blockquote> <h2>3.10.2 (2026-07-10)</h2> <p>Backport and cherry-pick commits from main for v3.10.2 patch release:</p> <ul> <li>[fix(bundler): do not import <code>@swc/html</code>, fix StackBlitz playground <a href="https://github.com/facebook/docusaurus/tree/HEAD/packages/docusaurus-preset-classic/issues/12055">#12055</a>](<a href="https://redirect.github.com/facebook/docusaurus/pull/12055">facebook/docusaurus#12055</a>)</li> <li>[fix(core): use locale url in site config <a href="https://github.com/facebook/docusaurus/tree/HEAD/packages/docusaurus-preset-classic/issues/12054">#12054</a>](<a href="https://redirect.github.com/facebook/docusaurus/pull/12054">facebook/docusaurus#12054</a>)</li> <li>[fix(theme-classic): remove redundant sidebar label titles <a href="https://github.com/facebook/docusaurus/tree/HEAD/packages/docusaurus-preset-classic/issues/11966">#11966</a>](<a href="https://redirect.github.com/facebook/docusaurus/pull/11966">facebook/docusaurus#11966</a>)</li> <li>[fix(mdx-loader): avoid transforming dotted directory links into asset… <a href="https://github.com/facebook/docusaurus/tree/HEAD/packages/docusaurus-preset-classic/issues/11944">#11944</a>](<a href="https://redirect.github.com/facebook/docusaurus/pull/11944">facebook/docusaurus#11944</a>)</li> <li>[fix(dev-server): for HTTPS, support non-RSA TLS certs <a href="https://github.com/facebook/docusaurus/tree/HEAD/packages/docusaurus-preset-classic/issues/12065">#12065</a>](<a href="https://redirect.github.com/facebook/docusaurus/pull/12065">facebook/docusaurus#12065</a>)</li> <li>[fix(utils): fix <code>extractLeadingEmoji()</code> edge cases <a href="https://github.com/facebook/docusaurus/tree/HEAD/packages/docusaurus-preset-classic/issues/12100">#12100</a>](<a href="https://redirect.github.com/facebook/docusaurus/pull/12100">facebook/docusaurus#12100</a>)</li> <li>[fix(gtag.js, faster): Fix StackBlitz, vendor <code>@types/gtag.js</code>, upgrade <code>@swc/html</code> <a href="https://github.com/facebook/docusaurus/tree/HEAD/packages/docusaurus-preset-classic/issues/12080">#12080</a>](<a href="https://redirect.github.com/facebook/docusaurus/pull/12080">facebook/docusaurus#12080</a>)</li> <li>[fix(create-docusaurus): init template README should use npm commands by default <a href="https://github.com/facebook/docusaurus/tree/HEAD/packages/docusaurus-preset-classic/issues/12138">#12138</a>](<a href="https://redirect.github.com/facebook/docusaurus/pull/12138">facebook/docusaurus#12138</a>)</li> <li>[fix(cli): <code>docusaurus serve</code> should pass <code>--host</code> to <code>server.listen()</code> <a href="https://github.com/facebook/docusaurus/tree/HEAD/packages/docusaurus-preset-classic/issues/12127">#12127</a>](<a href="https://redirect.github.com/facebook/docusaurus/pull/12127">facebook/docusaurus#12127</a>)</li> <li>[fix(core): bump detect-port to v2.1, fix pnpm <code>trustPolicy</code> downgrade issue <a href="https://github.com/facebook/docusaurus/tree/HEAD/packages/docusaurus-preset-classic/issues/12012">#12012</a>](<a href="https://redirect.github.com/facebook/docusaurus/pull/12012">facebook/docusaurus#12012</a>)</li> <li>[fix(i18n): complete Spanish translations for theme-common and theme-l… <a href="https://github.com/facebook/docusaurus/tree/HEAD/packages/docusaurus-preset-classic/issues/12180">#12180</a>](<a href="https://redirect.github.com/facebook/docusaurus/pull/12180">facebook/docusaurus#12180</a>)</li> <li>[chore(deps): migrate to <code>@11ty/gray-matter</code> <a href="https://github.com/facebook/docusaurus/tree/HEAD/packages/docusaurus-preset-classic/issues/12181">#12181</a>](<a href="https://redirect.github.com/facebook/docusaurus/pull/12181">facebook/docusaurus#12181</a>)</li> <li>[fix(core): fix BaseUrlIssueBanner little security issue <a href="https://github.com/facebook/docusaurus/tree/HEAD/packages/docusaurus-preset-classic/issues/12260">#12260</a>](<a href="https://redirect.github.com/facebook/docusaurus/pull/12260">facebook/docusaurus#12260</a>)</li> <li>[fix(core): accept boolean attributes in headTags config validation <a href="https://github.com/facebook/docusaurus/tree/HEAD/packages/docusaurus-preset-classic/issues/12238">#12238</a>](<a href="https://redirect.github.com/facebook/docusaurus/pull/12238">facebook/docusaurus#12238</a>)</li> <li>[fix(sitemap): don't drop lastmod for an epoch (0) timestamp <a href="https://github.com/facebook/docusaurus/tree/HEAD/packages/docusaurus-preset-classic/issues/12212">#12212</a>](<a href="https://redirect.github.com/facebook/docusaurus/pull/12212">facebook/docusaurus#12212</a>)</li> <li>[fix(utils): preserve author names containing commas in git log parsing <a href="https://github.com/facebook/docusaurus/tree/HEAD/packages/docusaurus-preset-classic/issues/12069">#12069</a>](<a href="https://redirect.github.com/facebook/docusaurus/pull/12069">facebook/docusaurus#12069</a>)</li> </ul> </blockquote> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/facebook/docusaurus/commit/f37f9035584917a97a260b91fc2842cba4f8b94f"><code>f37f903</code></a> v3.10.2</li> <li>See full diff in <a href="https://github.com/facebook/docusaurus/commits/v3.10.2/packages/docusaurus-preset-classic">compare view</a></li> </ul> </details> <br /> Updates `@docusaurus/theme-mermaid` from 3.10.1 to 3.10.2 <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/facebook/docusaurus/releases">@docusaurus/theme-mermaid's releases</a>.</em></p> <blockquote> <h2>3.10.2 (2026-07-10)</h2> <p>Backport and cherry-pick commits from main for v3.10.2 patch release:</p> <ul> <li>[fix(bundler): do not import <code>@swc/html</code>, fix StackBlitz playground <a href="https://github.com/facebook/docusaurus/tree/HEAD/packages/docusaurus-theme-mermaid/issues/12055">#12055</a>](<a href="https://redirect.github.com/facebook/docusaurus/pull/12055">facebook/docusaurus#12055</a>)</li> <li>[fix(core): use locale url in site config <a href="https://github.com/facebook/docusaurus/tree/HEAD/packages/docusaurus-theme-mermaid/issues/12054">#12054</a>](<a href="https://redirect.github.com/facebook/docusaurus/pull/12054">facebook/docusaurus#12054</a>)</li> <li>[fix(theme-classic): remove redundant sidebar label titles <a href="https://github.com/facebook/docusaurus/tree/HEAD/packages/docusaurus-theme-mermaid/issues/11966">#11966</a>](<a href="https://redirect.github.com/facebook/docusaurus/pull/11966">facebook/docusaurus#11966</a>)</li> <li>[fix(mdx-loader): avoid transforming dotted directory links into asset… <a href="https://github.com/facebook/docusaurus/tree/HEAD/packages/docusaurus-theme-mermaid/issues/11944">#11944</a>](<a href="https://redirect.github.com/facebook/docusaurus/pull/11944">facebook/docusaurus#11944</a>)</li> <li>[fix(dev-server): for HTTPS, support non-RSA TLS certs <a href="https://github.com/facebook/docusaurus/tree/HEAD/packages/docusaurus-theme-mermaid/issues/12065">#12065</a>](<a href="https://redirect.github.com/facebook/docusaurus/pull/12065">facebook/docusaurus#12065</a>)</li> <li>[fix(utils): fix <code>extractLeadingEmoji()</code> edge cases <a href="https://github.com/facebook/docusaurus/tree/HEAD/packages/docusaurus-theme-mermaid/issues/12100">#12100</a>](<a href="https://redirect.github.com/facebook/docusaurus/pull/12100">facebook/docusaurus#12100</a>)</li> <li>[fix(gtag.js, faster): Fix StackBlitz, vendor <code>@types/gtag.js</code>, upgrade <code>@swc/html</code> <a href="https://github.com/facebook/docusaurus/tree/HEAD/packages/docusaurus-theme-mermaid/issues/12080">#12080</a>](<a href="https://redirect.github.com/facebook/docusaurus/pull/12080">facebook/docusaurus#12080</a>)</li> <li>[fix(create-docusaurus): init template README should use npm commands by default <a href="https://github.com/facebook/docusaurus/tree/HEAD/packages/docusaurus-theme-mermaid/issues/12138">#12138</a>](<a href="https://redirect.github.com/facebook/docusaurus/pull/12138">facebook/docusaurus#12138</a>)</li> <li>[fix(cli): <code>docusaurus serve</code> should pass <code>--host</code> to <code>server.listen()</code> <a href="https://github.com/facebook/docusaurus/tree/HEAD/packages/docusaurus-theme-mermaid/issues/12127">#12127</a>](<a href="https://redirect.github.com/facebook/docusaurus/pull/12127">facebook/docusaurus#12127</a>)</li> <li>[fix(core): bump detect-port to v2.1, fix pnpm <code>trustPolicy</code> downgrade issue <a href="https://github.com/facebook/docusaurus/tree/HEAD/packages/docusaurus-theme-mermaid/issues/12012">#12012</a>](<a href="https://redirect.github.com/facebook/docusaurus/pull/12012">facebook/docusaurus#12012</a>)</li> <li>[fix(i18n): complete Spanish translations for theme-common and theme-l… <a href="https://github.com/facebook/docusaurus/tree/HEAD/packages/docusaurus-theme-mermaid/issues/12180">#12180</a>](<a href="https://redirect.github.com/facebook/docusaurus/pull/12180">facebook/docusaurus#12180</a>)</li> <li>[chore(deps): migrate to <code>@11ty/gray-matter</code> <a href="https://github.com/facebook/docusaurus/tree/HEAD/packages/docusaurus-theme-mermaid/issues/12181">#12181</a>](<a href="https://redirect.github.com/facebook/docusaurus/pull/12181">facebook/docusaurus#12181</a>)</li> <li>[fix(core): fix BaseUrlIssueBanner little security issue <a href="https://github.com/facebook/docusaurus/tree/HEAD/packages/docusaurus-theme-mermaid/issues/12260">#12260</a>](<a href="https://redirect.github.com/facebook/docusaurus/pull/12260">facebook/docusaurus#12260</a>)</li> <li>[fix(core): accept boolean attributes in headTags config validation <a href="https://github.com/facebook/docusaurus/tree/HEAD/packages/docusaurus-theme-mermaid/issues/12238">#12238</a>](<a href="https://redirect.github.com/facebook/docusaurus/pull/12238">facebook/docusaurus#12238</a>)</li> <li>[fix(sitemap): don't drop lastmod for an epoch (0) timestamp <a href="https://github.com/facebook/docusaurus/tree/HEAD/packages/docusaurus-theme-mermaid/issues/12212">#12212</a>](<a href="https://redirect.github.com/facebook/docusaurus/pull/12212">facebook/docusaurus#12212</a>)</li> <li>[fix(utils): preserve author names containing commas in git log parsing <a href="https://github.com/facebook/docusaurus/tree/HEAD/packages/docusaurus-theme-mermaid/issues/12069">#12069</a>](<a href="https://redirect.github.com/facebook/docusaurus/pull/12069">facebook/docusaurus#12069</a>)</li> </ul> </blockquote> </details> <details> <summary>Changelog</summary> <p><em>Sourced from <a href="https://github.com/facebook/docusaurus/blob/main/CHANGELOG.md">@docusaurus/theme-mermaid's changelog</a>.</em></p> <blockquote> <h2>3.10.2 (2026-07-10)</h2> <p>Backport and cherry-pick commits from main for v3.10.2 patch release:</p> <ul> <li>[fix(bundler): do not import <code>@swc/html</code>, fix StackBlitz playground <a href="https://github.com/facebook/docusaurus/tree/HEAD/packages/docusaurus-theme-mermaid/issues/12055">#12055</a>](<a href="https://redirect.github.com/facebook/docusaurus/pull/12055">facebook/docusaurus#12055</a>)</li> <li>[fix(core): use locale url in site config <a href="https://github.com/facebook/docusaurus/tree/HEAD/packages/docusaurus-theme-mermaid/issues/12054">#12054</a>](<a href="https://redirect.github.com/facebook/docusaurus/pull/12054">facebook/docusaurus#12054</a>)</li> <li>[fix(theme-classic): remove redundant sidebar label titles <a href="https://github.com/facebook/docusaurus/tree/HEAD/packages/docusaurus-theme-mermaid/issues/11966">#11966</a>](<a href="https://redirect.github.com/facebook/docusaurus/pull/11966">facebook/docusaurus#11966</a>)</li> <li>[fix(mdx-loader): avoid transforming dotted directory links into asset… <a href="https://github.com/facebook/docusaurus/tree/HEAD/packages/docusaurus-theme-mermaid/issues/11944">#11944</a>](<a href="https://redirect.github.com/facebook/docusaurus/pull/11944">facebook/docusaurus#11944</a>)</li> <li>[fix(dev-server): for HTTPS, support non-RSA TLS certs <a href="https://github.com/facebook/docusaurus/tree/HEAD/packages/docusaurus-theme-mermaid/issues/12065">#12065</a>](<a href="https://redirect.github.com/facebook/docusaurus/pull/12065">facebook/docusaurus#12065</a>)</li> <li>[fix(utils): fix <code>extractLeadingEmoji()</code> edge cases <a href="https://github.com/facebook/docusaurus/tree/HEAD/packages/docusaurus-theme-mermaid/issues/12100">#12100</a>](<a href="https://redirect.github.com/facebook/docusaurus/pull/12100">facebook/docusaurus#12100</a>)</li> <li>[fix(gtag.js, faster): Fix StackBlitz, vendor <code>@types/gtag.js</code>, upgrade <code>@swc/html</code> <a href="https://github.com/facebook/docusaurus/tree/HEAD/packages/docusaurus-theme-mermaid/issues/12080">#12080</a>](<a href="https://redirect.github.com/facebook/docusaurus/pull/12080">facebook/docusaurus#12080</a>)</li> <li>[fix(create-docusaurus): init template README should use npm commands by default <a href="https://github.com/facebook/docusaurus/tree/HEAD/packages/docusaurus-theme-mermaid/issues/12138">#12138</a>](<a href="https://redirect.github.com/facebook/docusaurus/pull/12138">facebook/docusaurus#12138</a>)</li> <li>[fix(cli): <code>docusaurus serve</code> should pass <code>--host</code> to <code>server.listen()</code> <a href="https://github.com/facebook/docusaurus/tree/HEAD/packages/docusaurus-theme-mermaid/issues/12127">#12127</a>](<a href="https://redirect.github.com/facebook/docusaurus/pull/12127">facebook/docusaurus#12127</a>)</li> <li>[fix(core): bump detect-port to v2.1, fix pnpm <code>trustPolicy</code> downgrade issue <a href="https://github.com/facebook/docusaurus/tree/HEAD/packages/docusaurus-theme-mermaid/issues/12012">#12012</a>](<a href="https://redirect.github.com/facebook/docusaurus/pull/12012">facebook/docusaurus#12012</a>)</li> <li>[fix(i18n): complete Spanish translations for theme-common and theme-l… <a href="https://github.com/facebook/docusaurus/tree/HEAD/packages/docusaurus-theme-mermaid/issues/12180">#12180</a>](<a href="https://redirect.github.com/facebook/docusaurus/pull/12180">facebook/docusaurus#12180</a>)</li> <li>[chore(deps): migrate to <code>@11ty/gray-matter</code> <a href="https://github.com/facebook/docusaurus/tree/HEAD/packages/docusaurus-theme-mermaid/issues/12181">#12181</a>](<a href="https://redirect.github.com/facebook/docusaurus/pull/12181">facebook/docusaurus#12181</a>)</li> <li>[fix(core): fix BaseUrlIssueBanner little security issue <a href="https://github.com/facebook/docusaurus/tree/HEAD/packages/docusaurus-theme-mermaid/issues/12260">#12260</a>](<a href="https://redirect.github.com/facebook/docusaurus/pull/12260">facebook/docusaurus#12260</a>)</li> <li>[fix(core): accept boolean attributes in headTags config validation <a href="https://github.com/facebook/docusaurus/tree/HEAD/packages/docusaurus-theme-mermaid/issues/12238">#12238</a>](<a href="https://redirect.github.com/facebook/docusaurus/pull/12238">facebook/docusaurus#12238</a>)</li> <li>[fix(sitemap): don't drop lastmod for an epoch (0) timestamp <a href="https://github.com/facebook/docusaurus/tree/HEAD/packages/docusaurus-theme-mermaid/issues/12212">#12212</a>](<a href="https://redirect.github.com/facebook/docusaurus/pull/12212">facebook/docusaurus#12212</a>)</li> <li>[fix(utils): preserve author names containing commas in git log parsing <a href="https://github.com/facebook/docusaurus/tree/HEAD/packages/docusaurus-theme-mermaid/issues/12069">#12069</a>](<a href="https://redirect.github.com/facebook/docusaurus/pull/12069">facebook/docusaurus#12069</a>)</li> </ul> </blockquote> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/facebook/docusaurus/commit/f37f9035584917a97a260b91fc2842cba4f8b94f"><code>f37f903</code></a> v3.10.2</li> <li>See full diff in <a href="https://github.com/facebook/docusaurus/commits/v3.10.2/packages/docusaurus-theme-mermaid">compare view</a></li> </ul> </details> <br /> Updates `@floating-ui/react` from 0.27.19 to 0.27.20 <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/floating-ui/floating-ui/releases">@floating-ui/react's releases</a>.</em></p> <blockquote> <h2><code>@floating-ui/react</code><a href="https://github.com/0"><code>@0</code></a>.27.20</h2> <h3>Patch Changes</h3> <ul> <li>fix: remove redundant passive options from scroll listeners</li> <li>fix: support explicit <code>undefined</code> for optional properties with <code>exactOptionalPropertyTypes</code></li> <li>Update dependencies: <code>@floating-ui/react-dom@2.1.9</code>, <code>@floating-ui/utils@0.2.12</code></li> </ul> </blockquote> </details> <details> <summary>Changelog</summary> <p><em>Sourced from <a href="https://github.com/floating-ui/floating-ui/blob/master/packages/react/CHANGELOG.md">@floating-ui/react's changelog</a>.</em></p> <blockquote> <h2>0.27.20</h2> <h3>Patch Changes</h3> <ul> <li>fix: remove redundant passive options from scroll listeners</li> <li>fix: support explicit <code>undefined</code> for optional properties with <code>exactOptionalPropertyTypes</code></li> <li>Update dependencies: <code>@floating-ui/react-dom@2.1.9</code>, <code>@floating-ui/utils@0.2.12</code></li> </ul> </blockquote> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/floating-ui/floating-ui/commit/12d94738472e922e1b3fa31b02b2b61b9ed77e6a"><code>12d9473</code></a> chore: version packages (<a href="https://github.com/floating-ui/floating-ui/tree/HEAD/packages/react/issues/3480">#3480</a>)</li> <li><a href="https://github.com/floating-ui/floating-ui/commit/9887c9679906900ffac4ee632deaa8bc959f71d2"><code>9887c96</code></a> fix(types): restore bivariant parameters for optional callbacks</li> <li><a href="https://github.com/floating-ui/floating-ui/commit/73c1f762a2670a3eb1e99935df59c81ef241b90a"><code>73c1f76</code></a> fix(types): support <code>exactOptionalPropertyTypes</code> (<a href="https://github.com/floating-ui/floating-ui/tree/HEAD/packages/react/issues/3456">#3456</a>)</li> <li><a href="https://github.com/floating-ui/floating-ui/commit/8999976822c9193eab5eb625ae16cc4381e9e7b0"><code>8999976</code></a> chore: upgrade vulnerable direct dependencies (<a href="https://github.com/floating-ui/floating-ui/tree/HEAD/packages/react/issues/3484">#3484</a>)</li> <li><a href="https://github.com/floating-ui/floating-ui/commit/fa63ca665910d90d664da6c7e3f6d8e0061925e9"><code>fa63ca6</code></a> chore: remove unnecessary passive flag from scroll events (<a href="https://github.com/floating-ui/floating-ui/tree/HEAD/packages/react/issues/3470">#3470</a>)</li> <li><a href="https://github.com/floating-ui/floating-ui/commit/fabb80ba5e5cd76bcde288fd725ac2e1942ba613"><code>fabb80b</code></a> breaking(vue): drop <code>vue-demi</code> and require Vue >=3.3.0 (<a href="https://github.com/floating-ui/floating-ui/tree/HEAD/packages/react/issues/3452">#3452</a>)</li> <li>See full diff in <a href="https://github.com/floating-ui/floating-ui/commits/@floating-ui/react@0.27.20/packages/react">compare view</a></li> </ul> </details> <br /> Updates `eslint` from 10.5.0 to 10.8.0 <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/eslint/eslint/releases">eslint's releases</a>.</em></p> <blockquote> <h2>v10.8.0</h2> <h2>Features</h2> <ul> <li><a href="https://github.com/eslint/eslint/commit/2fee9bb7416116cbed4d8c8100b1ae713b6356a1"><code>2fee9bb</code></a> feat: export <code>ConfigObject</code> from <code>eslint/config</code> (<a href="https://redirect.github.com/eslint/eslint/issues/21082">#21082</a>) (sethamus)</li> </ul> <h2>Bug Fixes</h2> <ul> <li><a href="https://github.com/eslint/eslint/commit/6b8d2f7589b8a7c8b91b8ca2a2ef6d46178760d8"><code>6b8d2f7</code></a> fix: escape reserved characters in rule id in <code>html</code> formatter (<a href="https://redirect.github.com/eslint/eslint/issues/21129">#21129</a>) (Francesco Trotta)</li> <li><a href="https://github.com/eslint/eslint/commit/90910715011211a20d011d807d398a7005127f35"><code>9091071</code></a> fix: prevent <code>no-unreachable-loop</code> crash when all loop types are ignored (<a href="https://redirect.github.com/eslint/eslint/issues/21116">#21116</a>) (Pixel)</li> <li><a href="https://github.com/eslint/eslint/commit/e23fafe8d4b15355adef6cdebef414c3a2019454"><code>e23fafe</code></a> fix: prefer-object-spread add semicolon when adding parenthesis (<a href="https://redirect.github.com/eslint/eslint/issues/21081">#21081</a>) (synthex-byte)</li> <li><a href="https://github.com/eslint/eslint/commit/20b5ad052360a443786a202e94624a3f81846511"><code>20b5ad0</code></a> fix: quadratic-time regex in <code>prefer-template</code> (<a href="https://redirect.github.com/eslint/eslint/issues/21096">#21096</a>) (Milos Djermanovic)</li> <li><a href="https://github.com/eslint/eslint/commit/8b6f6c0b33411f34485512456d94f221daf7321f"><code>8b6f6c0</code></a> fix: apply ignore configs to computed methods in class-methods-use-this (<a href="https://redirect.github.com/eslint/eslint/issues/21094">#21094</a>) (Pixel)</li> <li><a href="https://github.com/eslint/eslint/commit/b2c608c014a396800a24a89343265d0616bee2d8"><code>b2c608c</code></a> fix: NewExpression with parenthesized callee in <code>preserve-caught-error</code> (<a href="https://redirect.github.com/eslint/eslint/issues/21083">#21083</a>) (Francesco Trotta)</li> </ul> <h2>Documentation</h2> <ul> <li><a href="https://github.com/eslint/eslint/commit/6ddf8587e5cfeeb7328332601bb76d98b8a198ea"><code>6ddf858</code></a> docs: fix broken Specify Parser Options anchor link (<a href="https://redirect.github.com/eslint/eslint/issues/21106">#21106</a>) (Minsu)</li> <li><a href="https://github.com/eslint/eslint/commit/784dfbe98f0222426fd200153a5ce2e5624151f0"><code>784dfbe</code></a> docs: Clarify <code>no-eq-null</code> description (<a href="https://redirect.github.com/eslint/eslint/issues/21120">#21120</a>) (Park Harin)</li> <li><a href="https://github.com/eslint/eslint/commit/7ec733a3ba5acb053a73ac656030a3879aa48fda"><code>7ec733a</code></a> docs: Fix typos and grammar in glossary (<a href="https://redirect.github.com/eslint/eslint/issues/21095">#21095</a>) (Marry (Subin Yang))</li> <li><a href="https://github.com/eslint/eslint/commit/92bb13f13065db72d62454b9830d3ae52db15c76"><code>92bb13f</code></a> docs: replace quake link (<a href="https://redirect.github.com/eslint/eslint/issues/21108">#21108</a>) (Jung Hyeon Jun)</li> <li><a href="https://github.com/eslint/eslint/commit/68eb4a57572409dbdcfeb3bc5c92ddbba46bc770"><code>68eb4a5</code></a> docs: fix broken Specify Globals anchor links in rule pages (<a href="https://redirect.github.com/eslint/eslint/issues/21103">#21103</a>) (Minsu)</li> <li><a href="https://github.com/eslint/eslint/commit/d28f697e0d32d7446c825fd89c362db028450134"><code>d28f697</code></a> docs: replace Code Climate CLI links with Qlty CLI links (<a href="https://redirect.github.com/eslint/eslint/issues/21099">#21099</a>) (Jung Hyeon Jun)</li> <li><a href="https://github.com/eslint/eslint/commit/eccc68d42564e46bc9020d19ec52d2988f3b7bfa"><code>eccc68d</code></a> docs: correct --suppressions-location option description (<a href="https://redirect.github.com/eslint/eslint/issues/21093">#21093</a>) (Ga eun Lee)</li> <li><a href="https://github.com/eslint/eslint/commit/c5963f74bfa82a5b7ccc0607dcdcc695b8c97a31"><code>c5963f7</code></a> docs: Update README (GitHub Actions Bot)</li> </ul> <h2>Chores</h2> <ul> <li><a href="https://github.com/eslint/eslint/commit/4fbf46d140120ae838db08cbe49544c985956490"><code>4fbf46d</code></a> test: pin <code>webpack</code> version to 5.108.4 (<a href="https://redirect.github.com/eslint/eslint/issues/21137">#21137</a>) (Francesco Trotta)</li> <li><a href="https://github.com/eslint/eslint/commit/2d063e224e9bb0ccb0a28c120f7e380a8d62f320"><code>2d063e2</code></a> chore: update HTTP URLs to HTTPS in JSDoc and comments (<a href="https://redirect.github.com/eslint/eslint/issues/21101">#21101</a>) (Bo Hyun Kim)</li> <li><a href="https://github.com/eslint/eslint/commit/eccbe7bc9257a6c99880468e452c8dfafbf47f74"><code>eccbe7b</code></a> test: add error locations to <code>no-class-assign</code> (<a href="https://redirect.github.com/eslint/eslint/issues/21123">#21123</a>) (devoil)</li> <li><a href="https://github.com/eslint/eslint/commit/e7d1e4373bf626f8da76d62ce024c28928bc99bc"><code>e7d1e43</code></a> ci: bump actions/setup-go from 6 to 7 (<a href="https://redirect.github.com/eslint/eslint/issues/21118">#21118</a>) (dependabot[bot])</li> <li><a href="https://github.com/eslint/eslint/commit/e9d66d0cde1a7752c29dee53ab7b62632835a87a"><code>e9d66d0</code></a> ci: bump actions/setup-node from 6 to 7 (<a href="https://redirect.github.com/eslint/eslint/issues/21119">#21119</a>) (dependabot[bot])</li> <li><a href="https://github.com/eslint/eslint/commit/ee225b60c26f0cc5f4d71641888a5bd2ec5626d6"><code>ee225b6</code></a> test: Add error location details to <code>no-eq-null</code> rule (<a href="https://redirect.github.com/eslint/eslint/issues/21117">#21117</a>) (Park Harin)</li> <li><a href="https://github.com/eslint/eslint/commit/044a627fa3e28ee1410d515acc5378eb4b49f8ba"><code>044a627</code></a> chore: update minimatch to ^10.2.5 (<a href="https://redirect.github.com/eslint/eslint/issues/21107">#21107</a>) (김채영)</li> <li><a href="https://github.com/eslint/eslint/commit/fb09aa8ff09730d3ccf68859e065f99666b52466"><code>fb09aa8</code></a> chore: update ecosystem plugins (<a href="https://redirect.github.com/eslint/eslint/issues/21115">#21115</a>) (ESLint Bot)</li> <li><a href="https://github.com/eslint/eslint/commit/5abd878740fe417fd8a910cac3741f2a0317b365"><code>5abd878</code></a> test: add error locations to <code>no-proto</code> (<a href="https://redirect.github.com/eslint/eslint/issues/21114">#21114</a>) (Gihyeon Jeong / 정기현)</li> <li><a href="https://github.com/eslint/eslint/commit/9715887ec94a5ff936447d7b680d039fbe2f0541"><code>9715887</code></a> test: Add error location details to <code>no-div-regex</code> (<a href="https://redirect.github.com/eslint/eslint/issues/21110">#21110</a>) (Park Harin)</li> <li><a href="https://github.com/eslint/eslint/commit/a746ec6ea4a2249b1eb3f512264da5f4d5f7c886"><code>a746ec6</code></a> test: add error locations to <code>no-new-wrappers</code> (<a href="https://redirect.github.com/eslint/eslint/issues/21109">#21109</a>) (Gihyeon Jeong / 정기현)</li> <li><a href="https://github.com/eslint/eslint/commit/8dde64570e240f3ef8af873d59a752db6d8519aa"><code>8dde645</code></a> test: add error locations to <code>no-ex-assign</code> (<a href="https://redirect.github.com/eslint/eslint/issues/21102">#21102</a>) (devoil)</li> <li><a href="ht... _Description has been truncated_ Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>	2026-08-03 09:53:00 -05:00
dependabot[bot]	699b878e7e	build(deps): bump the gha-dependencies group with 14 updates (#8967 ) Bumps the gha-dependencies group with 14 updates: \| Package \| From \| To \| \| --- \| --- \| --- \| \| [actions/checkout](https://github.com/actions/checkout) \| `7.0.0` \| `7.0.1` \| \| [actions/setup-go](https://github.com/actions/setup-go) \| `6.5.0` \| `7.0.0` \| \| [actions/setup-java](https://github.com/actions/setup-java) \| `5.4.0` \| `5.6.0` \| \| [jdx/mise-action](https://github.com/jdx/mise-action) \| `4.2.0` \| `4.2.3` \| \| [github/codeql-action/init](https://github.com/github/codeql-action) \| `4.36.2` \| `4.37.3` \| \| [github/codeql-action/analyze](https://github.com/github/codeql-action) \| `4.36.2` \| `4.37.3` \| \| [lycheeverse/lychee-action](https://github.com/lycheeverse/lychee-action) \| `2.8.0` \| `2.9.0` \| \| [slackapi/slack-github-action](https://github.com/slackapi/slack-github-action) \| `3.0.3` \| `4.0.0` \| \| [docker/setup-buildx-action](https://github.com/docker/setup-buildx-action) \| `4.1.0` \| `4.2.0` \| \| [actions/setup-node](https://github.com/actions/setup-node) \| `6.4.0` \| `7.0.0` \| \| [zizmorcore/zizmor-action](https://github.com/zizmorcore/zizmor-action) \| `0.5.7` \| `0.6.1` \| \| [docker/setup-qemu-action](https://github.com/docker/setup-qemu-action) \| `4.1.0` \| `4.2.0` \| \| [ossf/scorecard-action](https://github.com/ossf/scorecard-action) \| `2.4.3` \| `2.4.4` \| \| [github/codeql-action/upload-sarif](https://github.com/github/codeql-action) \| `4.36.2` \| `4.37.3` \| Updates `actions/checkout` from 7.0.0 to 7.0.1 <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/actions/checkout/releases">actions/checkout's releases</a>.</em></p> <blockquote> <h2>v7.0.1</h2> <h2>What's Changed</h2> <ul> <li>skip running unsafe pr check if input is default by <a href="https://github.com/aiqiaoy"><code>@aiqiaoy</code></a> in <a href="https://redirect.github.com/actions/checkout/pull/2518">actions/checkout#2518</a></li> <li>trim only ascii whitespace for branch by <a href="https://github.com/aiqiaoy"><code>@aiqiaoy</code></a> in <a href="https://redirect.github.com/actions/checkout/pull/2521">actions/checkout#2521</a></li> <li>escape values passed to --unset by <a href="https://github.com/aiqiaoy"><code>@aiqiaoy</code></a> in <a href="https://redirect.github.com/actions/checkout/pull/2530">actions/checkout#2530</a></li> <li>Various dependency updates</li> </ul> <p><strong>Full Changelog</strong>: <a href="https://github.com/actions/checkout/compare/v7...v7.0.1">https://github.com/actions/checkout/compare/v7...v7.0.1</a></p> </blockquote> </details> <details> <summary>Changelog</summary> <p><em>Sourced from <a href="https://github.com/actions/checkout/blob/main/CHANGELOG.md">actions/checkout's changelog</a>.</em></p> <blockquote> <h1>Changelog</h1> <h2>v7.0.1</h2> <ul> <li>Skip running unsafe pr check if input is default by <a href="https://github.com/aiqiaoy"><code>@aiqiaoy</code></a> in <a href="https://redirect.github.com/actions/checkout/pull/2518">actions/checkout#2518</a></li> <li>Trim only ascii whitespace for branch by <a href="https://github.com/aiqiaoy"><code>@aiqiaoy</code></a> in <a href="https://redirect.github.com/actions/checkout/pull/2521">actions/checkout#2521</a></li> <li>Escape values passed to --unset by <a href="https://github.com/aiqiaoy"><code>@aiqiaoy</code></a> in <a href="https://redirect.github.com/actions/checkout/pull/2530">actions/checkout#2530</a></li> <li>Various dependency updates</li> </ul> <h2>v7.0.0</h2> <ul> <li>Block checking out fork PR for pull_request_target and workflow_run by <a href="https://github.com/aiqiaoy"><code>@aiqiaoy</code></a> in <a href="https://redirect.github.com/actions/checkout/pull/2454">actions/checkout#2454</a></li> <li>Various dependency updates</li> </ul> <h2>v6.0.3</h2> <ul> <li>Fix checkout init for SHA-256 repositories by <a href="https://github.com/yaananth"><code>@yaananth</code></a> in <a href="https://redirect.github.com/actions/checkout/pull/2439">actions/checkout#2439</a></li> <li>fix: expand merge commit SHA regex and add SHA-256 test cases by <a href="https://github.com/yaananth"><code>@yaananth</code></a> in <a href="https://redirect.github.com/actions/checkout/pull/2414">actions/checkout#2414</a></li> </ul> <h2>v6.0.2</h2> <ul> <li>Fix tag handling: preserve annotations and explicit fetch-tags by <a href="https://github.com/ericsciple"><code>@ericsciple</code></a> in <a href="https://redirect.github.com/actions/checkout/pull/2356">actions/checkout#2356</a></li> </ul> <h2>v6.0.1</h2> <ul> <li>Add worktree support for persist-credentials includeIf by <a href="https://github.com/ericsciple"><code>@ericsciple</code></a> in <a href="https://redirect.github.com/actions/checkout/pull/2327">actions/checkout#2327</a></li> </ul> <h2>v6.0.0</h2> <ul> <li>Persist creds to a separate file by <a href="https://github.com/ericsciple"><code>@ericsciple</code></a> in <a href="https://redirect.github.com/actions/checkout/pull/2286">actions/checkout#2286</a></li> <li>Update README to include Node.js 24 support details and requirements by <a href="https://github.com/salmanmkc"><code>@salmanmkc</code></a> in <a href="https://redirect.github.com/actions/checkout/pull/2248">actions/checkout#2248</a></li> </ul> <h2>v5.0.1</h2> <ul> <li>Port v6 cleanup to v5 by <a href="https://github.com/ericsciple"><code>@ericsciple</code></a> in <a href="https://redirect.github.com/actions/checkout/pull/2301">actions/checkout#2301</a></li> </ul> <h2>v5.0.0</h2> <ul> <li>Update actions checkout to use node 24 by <a href="https://github.com/salmanmkc"><code>@salmanmkc</code></a> in <a href="https://redirect.github.com/actions/checkout/pull/2226">actions/checkout#2226</a></li> </ul> <h2>v4.3.1</h2> <ul> <li>Port v6 cleanup to v4 by <a href="https://github.com/ericsciple"><code>@ericsciple</code></a> in <a href="https://redirect.github.com/actions/checkout/pull/2305">actions/checkout#2305</a></li> </ul> <h2>v4.3.0</h2> <ul> <li>docs: update README.md by <a href="https://github.com/motss"><code>@motss</code></a> in <a href="https://redirect.github.com/actions/checkout/pull/1971">actions/checkout#1971</a></li> <li>Add internal repos for checking out multiple repositories by <a href="https://github.com/mouismail"><code>@mouismail</code></a> in <a href="https://redirect.github.com/actions/checkout/pull/1977">actions/checkout#1977</a></li> <li>Documentation update - add recommended permissions to Readme by <a href="https://github.com/benwells"><code>@benwells</code></a> in <a href="https://redirect.github.com/actions/checkout/pull/2043">actions/checkout#2043</a></li> <li>Adjust positioning of user email note and permissions heading by <a href="https://github.com/joshmgross"><code>@joshmgross</code></a> in <a href="https://redirect.github.com/actions/checkout/pull/2044">actions/checkout#2044</a></li> <li>Update README.md by <a href="https://github.com/nebuk89"><code>@nebuk89</code></a> in <a href="https://redirect.github.com/actions/checkout/pull/2194">actions/checkout#2194</a></li> <li>Update CODEOWNERS for actions by <a href="https://github.com/TingluoHuang"><code>@TingluoHuang</code></a> in <a href="https://redirect.github.com/actions/checkout/pull/2224">actions/checkout#2224</a></li> <li>Update package dependencies by <a href="https://github.com/salmanmkc"><code>@salmanmkc</code></a> in <a href="https://redirect.github.com/actions/checkout/pull/2236">actions/checkout#2236</a></li> </ul> <h2>v4.2.2</h2> <ul> <li><code>url-helper.ts</code> now leverages well-known environment variables by <a href="https://github.com/jww3"><code>@jww3</code></a> in <a href="https://redirect.github.com/actions/checkout/pull/1941">actions/checkout#1941</a></li> <li>Expand unit test coverage for <code>isGhes</code> by <a href="https://github.com/jww3"><code>@jww3</code></a> in <a href="https://redirect.github.com/actions/checkout/pull/1946">actions/checkout#1946</a></li> </ul> <h2>v4.2.1</h2> <ul> <li>Check out other refs/* by commit if provided, fall back to ref by <a href="https://github.com/orhantoy"><code>@orhantoy</code></a> in <a href="https://redirect.github.com/actions/checkout/pull/1924">actions/checkout#1924</a></li> </ul> <!-- raw HTML omitted --> </blockquote> <p>... (truncated)</p> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/actions/checkout/commit/3d3c42e5aac5ba805825da76410c181273ba90b1"><code>3d3c42e</code></a> prep v7.0.1 release (<a href="https://redirect.github.com/actions/checkout/issues/2531">#2531</a>)</li> <li><a href="https://github.com/actions/checkout/commit/28802689a136bfcdb721715abd713740beecbe07"><code>2880268</code></a> escape values passed to --unset (<a href="https://redirect.github.com/actions/checkout/issues/2530">#2530</a>)</li> <li><a href="https://github.com/actions/checkout/commit/12cd2235efa0937479335606d7c3ac9f6c0973b1"><code>12cd223</code></a> trim only ascii whitespace for branch (<a href="https://redirect.github.com/actions/checkout/issues/2521">#2521</a>)</li> <li><a href="https://github.com/actions/checkout/commit/62661c4e71a304b2823ed026347b8d34c3eac541"><code>62661c4</code></a> skip running unsafe pr check if input is default (<a href="https://redirect.github.com/actions/checkout/issues/2518">#2518</a>)</li> <li><a href="https://github.com/actions/checkout/commit/e8d4307400f9427dba7cb98e488d6ab85f1cec5f"><code>e8d4307</code></a> Bump the minor-actions-dependencies group with 2 updates (<a href="https://redirect.github.com/actions/checkout/issues/2499">#2499</a>)</li> <li><a href="https://github.com/actions/checkout/commit/631c942040754b6e095e929c1677c07e10ed4f87"><code>631c942</code></a> eslint 9 (<a href="https://redirect.github.com/actions/checkout/issues/2474">#2474</a>)</li> <li><a href="https://github.com/actions/checkout/commit/4f1f4aec02e41874fa0262ea8ff5172d7978ad1e"><code>4f1f4ae</code></a> Bump actions/upload-artifact from 4 to 7 (<a href="https://redirect.github.com/actions/checkout/issues/2476">#2476</a>)</li> <li><a href="https://github.com/actions/checkout/commit/ba097532fb203f7e88c9c3c0b899b49469908a92"><code>ba09753</code></a> Bump actions/checkout from 6 to 7 (<a href="https://redirect.github.com/actions/checkout/issues/2488">#2488</a>)</li> <li><a href="https://github.com/actions/checkout/commit/b9e0990d219a03df7633c93f6f005a8fecbcab22"><code>b9e0990</code></a> Bump docker/login-action from 3.3.0 to 4.2.0 (<a href="https://redirect.github.com/actions/checkout/issues/2479">#2479</a>)</li> <li><a href="https://github.com/actions/checkout/commit/e8cb398be4a550817e382abf69e4c12c76fce1f2"><code>e8cb398</code></a> Bump docker/build-push-action from 6.5.0 to 7.2.0 (<a href="https://redirect.github.com/actions/checkout/issues/2478">#2478</a>)</li> <li>Additional commits viewable in <a href="https://github.com/actions/checkout/compare/9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0...3d3c42e5aac5ba805825da76410c181273ba90b1">compare view</a></li> </ul> </details> <br /> Updates `actions/setup-go` from 6.5.0 to 7.0.0 <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/actions/setup-go/releases">actions/setup-go's releases</a>.</em></p> <blockquote> <h2>v7.0.0</h2> <h2>What's Changed</h2> <ul> <li>Migrate to ESM and upgrade dependencies by <a href="https://github.com/priyagupta108"><code>@priyagupta108</code></a> in <a href="https://redirect.github.com/actions/setup-go/pull/763">actions/setup-go#763</a></li> <li>chore(deps): bump <code>@actions/cache</code> to 6.2.0 by <a href="https://github.com/philip-gai"><code>@philip-gai</code></a> in <a href="https://redirect.github.com/actions/setup-go/pull/771">actions/setup-go#771</a></li> </ul> <h2>New Contributors</h2> <ul> <li><a href="https://github.com/philip-gai"><code>@philip-gai</code></a> made their first contribution in <a href="https://redirect.github.com/actions/setup-go/pull/771">actions/setup-go#771</a></li> </ul> <p><strong>Full Changelog</strong>: <a href="https://github.com/actions/setup-go/compare/v6...v7.0.0">https://github.com/actions/setup-go/compare/v6...v7.0.0</a></p> </blockquote> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/actions/setup-go/commit/b7ad1dad31e06c5925ef5d2fc7ad053ef454303e"><code>b7ad1da</code></a> chore(deps): bump <code>@actions/cache</code> to 6.2.0 (<a href="https://redirect.github.com/actions/setup-go/issues/771">#771</a>)</li> <li><a href="https://github.com/actions/setup-go/commit/0778a10ce47b5d450cf60fb94fafad4330008a35"><code>0778a10</code></a> Migrate to ESM and upgrade dependencies (<a href="https://redirect.github.com/actions/setup-go/issues/763">#763</a>)</li> <li>See full diff in <a href="https://github.com/actions/setup-go/compare/924ae3a1cded613372ab5595356fb5720e22ba16...b7ad1dad31e06c5925ef5d2fc7ad053ef454303e">compare view</a></li> </ul> </details> <br /> Updates `actions/setup-java` from 5.4.0 to 5.6.0 <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/actions/setup-java/releases">actions/setup-java's releases</a>.</em></p> <blockquote> <h2>v5.6.0</h2> <h2>What's Changed</h2> <ul> <li>Backport to v5: Add Maven compiler problem matcher for javac diagnostics by <a href="https://github.com/brunoborges"><code>@brunoborges</code></a> in <a href="https://redirect.github.com/actions/setup-java/pull/1087">actions/setup-java#1087</a></li> <li>feat: expose cache-primary-key output (<a href="https://redirect.github.com/actions/setup-java/issues/597">#597</a>) [v5 backport] by <a href="https://github.com/brunoborges"><code>@brunoborges</code></a> in <a href="https://redirect.github.com/actions/setup-java/pull/1089">actions/setup-java#1089</a></li> <li>dist: Cover Tencent Kona JDK 25 (<a href="https://redirect.github.com/actions/setup-java/issues/1108">#1108</a>) [v5 backport] by <a href="https://github.com/brunoborges"><code>@brunoborges</code></a> in <a href="https://redirect.github.com/actions/setup-java/pull/1110">actions/setup-java#1110</a></li> <li>Backport <a href="https://redirect.github.com/actions/setup-java/issues/1111">#1111</a>: Preserve Maven toolchains across repeated setup-java runs (<a href="https://redirect.github.com/actions/setup-java/issues/1099">#1099</a>) by <a href="https://github.com/brunoborges"><code>@brunoborges</code></a> in <a href="https://redirect.github.com/actions/setup-java/pull/1113">actions/setup-java#1113</a></li> <li>Backport <a href="https://redirect.github.com/actions/setup-java/issues/1097">#1097</a>/<a href="https://redirect.github.com/actions/setup-java/issues/1098">#1098</a> to v5: cache Maven and Gradle wrapper distributions separately by <a href="https://github.com/brunoborges"><code>@brunoborges</code></a> in <a href="https://redirect.github.com/actions/setup-java/pull/1122">actions/setup-java#1122</a></li> </ul> <p><strong>Full Changelog</strong>: <a href="https://github.com/actions/setup-java/compare/v5...v5.6.0">https://github.com/actions/setup-java/compare/v5...v5.6.0</a></p> <h2>v5.5.0</h2> <h2>What's Changed</h2> <ul> <li>chore: enforce pre-PR validation (aggregate scripts, git hooks, PR checklist) by <a href="https://github.com/brunoborges"><code>@brunoborges</code></a> in <a href="https://redirect.github.com/actions/setup-java/pull/1061">actions/setup-java#1061</a></li> <li>Bump github/codeql-action from 3 to 4 by <a href="https://github.com/dependabot"><code>@dependabot</code></a>[bot] in <a href="https://redirect.github.com/actions/setup-java/pull/1069">actions/setup-java#1069</a></li> <li>Bump actions/checkout from 6 to 7 by <a href="https://github.com/dependabot"><code>@dependabot</code></a>[bot] in <a href="https://redirect.github.com/actions/setup-java/pull/1068">actions/setup-java#1068</a></li> <li>Bump actions/setup-python from 5 to 6 by <a href="https://github.com/dependabot"><code>@dependabot</code></a>[bot] in <a href="https://redirect.github.com/actions/setup-java/pull/1067">actions/setup-java#1067</a></li> <li>Bump <code>@typescript-eslint/parser</code> from 8.61.1 to 8.62.0 by <a href="https://github.com/dependabot"><code>@dependabot</code></a>[bot] in <a href="https://redirect.github.com/actions/setup-java/pull/1062">actions/setup-java#1062</a></li> <li>feat: Add verify-signature plumbing and Temurin+Microsoft verification support by <a href="https://github.com/johnoliver"><code>@johnoliver</code></a> in <a href="https://redirect.github.com/actions/setup-java/pull/1060">actions/setup-java#1060</a></li> <li>Updated jetbrains test: https.request() now catches errors. This fixes leaking tests as well by <a href="https://github.com/jmjaffe37"><code>@jmjaffe37</code></a> in <a href="https://redirect.github.com/actions/setup-java/pull/1070">actions/setup-java#1070</a></li> <li>Fix arm64 e2e workflow tests mislabeled as x64 by <a href="https://github.com/brunoborges"><code>@brunoborges</code></a> with <a href="https://github.com/Copilot"><code>@Copilot</code></a> in <a href="https://redirect.github.com/actions/setup-java/pull/1073">actions/setup-java#1073</a></li> <li>feat: suppress Maven transfer progress via MAVEN_ARGS by default (add show-download-progress input) by <a href="https://github.com/brunoborges"><code>@brunoborges</code></a> in <a href="https://redirect.github.com/actions/setup-java/pull/1053">actions/setup-java#1053</a></li> <li>feat: Disable interactiveMode in generated Maven settings.xml by <a href="https://github.com/brunoborges"><code>@brunoborges</code></a> with <a href="https://github.com/Copilot"><code>@Copilot</code></a> in <a href="https://redirect.github.com/actions/setup-java/pull/1052">actions/setup-java#1052</a></li> <li>Bump prettier from 3.6.2 to 3.9.1 by <a href="https://github.com/dependabot"><code>@dependabot</code></a>[bot] in <a href="https://redirect.github.com/actions/setup-java/pull/1066">actions/setup-java#1066</a></li> <li>chore(deps-dev): bump eslint-plugin-jest from 29.0.1 to 29.15.4 by <a href="https://github.com/dependabot"><code>@dependabot</code></a>[bot] in <a href="https://redirect.github.com/actions/setup-java/pull/1074">actions/setup-java#1074</a></li> <li>fix: Maven Toolchains grows unexpectedly by <a href="https://github.com/Okeanos"><code>@Okeanos</code></a> in <a href="https://redirect.github.com/actions/setup-java/pull/534">actions/setup-java#534</a></li> <li>dist: Support Tencent Kona JDK by <a href="https://github.com/johnshajiang"><code>@johnshajiang</code></a> in <a href="https://redirect.github.com/actions/setup-java/pull/672">actions/setup-java#672</a></li> <li>feat: Add set-default option by <a href="https://github.com/gsmet"><code>@gsmet</code></a> in <a href="https://redirect.github.com/actions/setup-java/pull/1017">actions/setup-java#1017</a></li> <li>docs: document problem matcher (and how to disable it), Maven Wrapper caching, and generated interactiveMode by <a href="https://github.com/brunoborges"><code>@brunoborges</code></a> in <a href="https://redirect.github.com/actions/setup-java/pull/1075">actions/setup-java#1075</a></li> <li>feat: Add distribution detection support to .sdkmanrc file by <a href="https://github.com/lukaszgyg"><code>@lukaszgyg</code></a> in <a href="https://redirect.github.com/actions/setup-java/pull/975">actions/setup-java#975</a></li> </ul> <h2>New Contributors</h2> <ul> <li><a href="https://github.com/jmjaffe37"><code>@jmjaffe37</code></a> made their first contribution in <a href="https://redirect.github.com/actions/setup-java/pull/1070">actions/setup-java#1070</a></li> <li><a href="https://github.com/gsmet"><code>@gsmet</code></a> made their first contribution in <a href="https://redirect.github.com/actions/setup-java/pull/1017">actions/setup-java#1017</a></li> <li><a href="https://github.com/lukaszgyg"><code>@lukaszgyg</code></a> made their first contribution in <a href="https://redirect.github.com/actions/setup-java/pull/975">actions/setup-java#975</a></li> </ul> <p><strong>Full Changelog</strong>: <a href="https://github.com/actions/setup-java/compare/v5...v5.5.0">https://github.com/actions/setup-java/compare/v5...v5.5.0</a></p> </blockquote> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/actions/setup-java/commit/03ad4de0992f5dab5e18fcb136590ce7c4a0ac95"><code>03ad4de</code></a> Backport <a href="https://redirect.github.com/actions/setup-java/issues/1097">#1097</a>/<a href="https://redirect.github.com/actions/setup-java/issues/1098">#1098</a>: cache Maven and Gradle wrapper distributions separately...</li> <li><a href="https://github.com/actions/setup-java/commit/d229d2e858d9137cc0b3f118fa5184b9f0a44ac4"><code>d229d2e</code></a> Backport <a href="https://redirect.github.com/actions/setup-java/issues/1111">#1111</a>: Preserve Maven toolchains across repeated setup-java runs (<a href="https://redirect.github.com/actions/setup-java/issues/1">#1</a>...</li> <li><a href="https://github.com/actions/setup-java/commit/bbf0f6967066506f72571a96d5d6c67ca42ab460"><code>bbf0f69</code></a> dist: Cover Tencent Kona JDK 25 (<a href="https://redirect.github.com/actions/setup-java/issues/1110">#1110</a>)</li> <li><a href="https://github.com/actions/setup-java/commit/513edc4f8710565e4ad696f3b7d8e3bda584a46c"><code>513edc4</code></a> feat: expose cache-primary-key output (<a href="https://redirect.github.com/actions/setup-java/issues/597">#597</a>) [v5 backport] (<a href="https://redirect.github.com/actions/setup-java/issues/1089">#1089</a>)</li> <li><a href="https://github.com/actions/setup-java/commit/62df799a9c6e3022bb466697c66c36e9a2dbf347"><code>62df799</code></a> Add Maven compiler problem matcher for javac diagnostics (<a href="https://redirect.github.com/actions/setup-java/issues/1087">#1087</a>)</li> <li><a href="https://github.com/actions/setup-java/commit/176156a187714aaf460b0a3c8f21e8b4f784b978"><code>176156a</code></a> chore: bump version to 5.6.0 for v5 release line</li> <li><a href="https://github.com/actions/setup-java/commit/bf7b8deac240b9cee05eb15ccdb1d2f424a54b9f"><code>bf7b8de</code></a> build: rebuild dist for backported changes (<a href="https://redirect.github.com/actions/setup-java/issues/1079">#1079</a>, <a href="https://redirect.github.com/actions/setup-java/issues/1083">#1083</a>, <a href="https://redirect.github.com/actions/setup-java/issues/1084">#1084</a>)</li> <li><a href="https://github.com/actions/setup-java/commit/0173e6dd1b6e53ac3f6d68d220fa24cce79ae77c"><code>0173e6d</code></a> Infer distribution from asdf .tool-versions vendor prefix (<a href="https://redirect.github.com/actions/setup-java/issues/1084">#1084</a>)</li> <li><a href="https://github.com/actions/setup-java/commit/f45cd82b67042e9e5c24cef950ea0c61736241c6"><code>f45cd82</code></a> Rename jdkFile input to jdk-file with deprecated alias (<a href="https://redirect.github.com/actions/setup-java/issues/1083">#1083</a>)</li> <li><a href="https://github.com/actions/setup-java/commit/e2863ad49937c063e5a23922d1971a105f4f0140"><code>e2863ad</code></a> Map Zulu x86 architecture to i686 for Azul Metadata API (<a href="https://redirect.github.com/actions/setup-java/issues/1079">#1079</a>)</li> <li>Additional commits viewable in <a href="https://github.com/actions/setup-java/compare/1bcf9fb12cf4aa7d266a90ae39939e61372fe520...03ad4de0992f5dab5e18fcb136590ce7c4a0ac95">compare view</a></li> </ul> </details> <br /> Updates `jdx/mise-action` from 4.2.0 to 4.2.3 <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/jdx/mise-action/releases">jdx/mise-action's releases</a>.</em></p> <blockquote> <h2>v4.2.3: Restore mise PATH propagation</h2> <p>A patch release that restores mise's PATH propagation to subsequent workflow steps — without reintroducing the full-PATH snapshot behavior that v4.2.1 fixed.</p> <h2>Fixed</h2> <h3>Export mise PATH entries to subsequent steps (<a href="https://redirect.github.com/jdx/mise-action/pull/575">#575</a>) by <a href="https://github.com/jdx"><code>@jdx</code></a></h3> <p>v4.2.1 stopped exporting the complete <code>PATH</code> returned by <code>mise env --json</code> into <code>GITHUB_ENV</code>, which correctly prevented snapshotting the runner's environment into subsequent steps. However, that also dropped mise-produced PATH entries — tool shims, <code>[env] _.path</code> directories, and similar — that workflows relied on after the setup step. See <a href="https://redirect.github.com/jdx/mise-action/issues/565">#565</a>.</p> <p>The action now computes only the <strong>prefix</strong> that mise prepended to the existing <code>PATH</code> and forwards those directories individually through <code>GITHUB_PATH</code>. This preserves mise's configured ordering, composes cleanly with PATH changes from other actions, and never persists the runner's full <code>PATH</code> through <code>GITHUB_ENV</code>. The dotenv fallback path (used with older mise versions) also strips <code>PATH=</code> lines and re-derives additions from <code>mise env --json</code>.</p> <p>A new <code>export_path</code> input (default <code>true</code>) lets workflows keep regular <code>env</code> exports while opting out of PATH changes:</p> <pre lang="yaml"><code>- uses: jdx/mise-action@v4 with: export_path: false # keep env vars, skip mise PATH additions </code></pre> <p><strong>Full Changelog</strong>: <a href="https://github.com/jdx/mise-action/compare/v4.2.2...v4.2.3">https://github.com/jdx/mise-action/compare/v4.2.2...v4.2.3</a></p> <h2>v4.2.2: Zstd tar fallback for older runners</h2> <p>A small patch release that fixes archive selection on runners with an older <code>tar</code> and corrects a stale default in the README.</p> <h2>Fixed</h2> <h3>Verify <code>tar</code> supports Zstd before picking <code>.tar.zst</code> (<a href="https://redirect.github.com/jdx/mise-action/pull/569">#569</a> by <a href="https://github.com/JackMyers001"><code>@JackMyers001</code></a></h3> <p>The action previously chose the <code>.tar.zst</code> mise archive whenever <code>zstd --version</code> succeeded, then extracted it with <code>tar --zstd</code>. On RHEL 8-compatible runners that ship <code>zstd</code> 1.4.4 alongside GNU <code>tar</code> 1.30, the <code>--zstd</code> option isn't recognized and installation failed.</p> <p>Detection now runs both checks:</p> <pre><code>zstd --version tar --zstd --version </code></pre> <p>If either fails, the action falls back to the <code>.tar.gz</code> archive. No configuration change is required — existing workflows on affected runners just start working again. Fixes <a href="https://redirect.github.com/jdx/mise-action/issues/568">#568</a>.</p> <h2>Documentation</h2> <ul> <li>Update the <code>cache_key_prefix</code> example in the README to reflect the current default of <code>mise-v1</code> (previously documented as <code>mise-v0</code>) (<a href="https://redirect.github.com/jdx/mise-action/pull/570">#570</a> by <a href="https://github.com/muzimuzhi"><code>@muzimuzhi</code></a>).</li> </ul> <h2>New Contributors</h2> <ul> <li><a href="https://github.com/JackMyers001"><code>@JackMyers001</code></a> made their first contribution in <a href="https://redirect.github.com/jdx/mise-action/pull/569">#569</a></li> <li><a href="https://github.com/muzimuzhi"><code>@muzimuzhi</code></a> made their first contribution in <a href="https://redirect.github.com/jdx/mise-action/pull/570">#570</a></li> </ul> <p><strong>Full Changelog</strong>: <a href="https://github.com/jdx/mise-action/compare/v4.2.1...v4.2.2">https://github.com/jdx/mise-action/compare/v4.2.1...v4.2.2</a></p> <!-- raw HTML omitted --> </blockquote> <p>... (truncated)</p> </details> <details> <summary>Changelog</summary> <p><em>Sourced from <a href="https://github.com/jdx/mise-action/blob/main/CHANGELOG.md">jdx/mise-action's changelog</a>.</em></p> <blockquote> <h1>Changelog</h1> <hr /> <h2><a href="https://github.com/jdx/mise-action/compare/v4.2.3..v4.2.4">4.2.4</a> - 2026-07-28</h2> <h3>🐛 Bug Fixes</h3> <ul> <li>locking support detection with force-colored output (<a href="https://redirect.github.com/jdx/mise-action/issues/580">#580</a>) by <a href="https://github.com/scop"><code>@scop</code></a> in <a href="https://redirect.github.com/jdx/mise-action/pull/580">#580</a></li> </ul> <hr /> <h2><a href="https://github.com/jdx/mise-action/compare/v4.2.2..v4.2.3">4.2.3</a> - 2026-07-24</h2> <h3>🐛 Bug Fixes</h3> <ul> <li>export mise path entries to subsequent steps (<a href="https://redirect.github.com/jdx/mise-action/issues/575">#575</a>) by <a href="https://github.com/jdx"><code>@jdx</code></a> in <a href="https://redirect.github.com/jdx/mise-action/pull/575">#575</a></li> </ul> <hr /> <h2><a href="https://github.com/jdx/mise-action/compare/v4.2.1..v4.2.2">4.2.2</a> - 2026-07-24</h2> <h3>🐛 Bug Fixes</h3> <ul> <li><strong>(release-plz)</strong> exit when git-cliff produces no version bump (<a href="https://redirect.github.com/jdx/mise-action/issues/566">#566</a>) by <a href="https://github.com/jdx"><code>@jdx</code></a> in <a href="https://redirect.github.com/jdx/mise-action/pull/566">#566</a></li> <li>ensure <code>tar</code> supports Zstd (<a href="https://redirect.github.com/jdx/mise-action/issues/569">#569</a>) by <a href="https://github.com/JackMyers001"><code>@JackMyers001</code></a> in <a href="https://redirect.github.com/jdx/mise-action/pull/569">#569</a></li> </ul> <h3>📚 Documentation</h3> <ul> <li>update default value of <code>cache_key_prefix</code> (<a href="https://redirect.github.com/jdx/mise-action/issues/570">#570</a>) by <a href="https://github.com/muzimuzhi"><code>@muzimuzhi</code></a> in <a href="https://redirect.github.com/jdx/mise-action/pull/570">#570</a></li> </ul> <h3>New Contributors</h3> <ul> <li><a href="https://github.com/muzimuzhi"><code>@muzimuzhi</code></a> made their first contribution in <a href="https://redirect.github.com/jdx/mise-action/pull/570">#570</a></li> <li><a href="https://github.com/JackMyers001"><code>@JackMyers001</code></a> made their first contribution in <a href="https://redirect.github.com/jdx/mise-action/pull/569">#569</a></li> </ul> <hr /> <h2><a href="https://github.com/jdx/mise-action/compare/v4.2.0..v4.2.1">4.2.1</a> - 2026-07-16</h2> <h3>🐛 Bug Fixes</h3> <ul> <li>verify mise downloads with signed checksums (<a href="https://redirect.github.com/jdx/mise-action/issues/548">#548</a>) by <a href="https://github.com/jdx"><code>@jdx</code></a> in <a href="https://redirect.github.com/jdx/mise-action/pull/548">#548</a></li> <li>exclude PATH from environment export (<a href="https://redirect.github.com/jdx/mise-action/issues/556">#556</a>) by <a href="https://github.com/jdx"><code>@jdx</code></a> in <a href="https://redirect.github.com/jdx/mise-action/pull/556">#556</a></li> </ul> <h3>🔍 Other Changes</h3> <ul> <li>Enable Entire for Codex (<a href="https://redirect.github.com/jdx/mise-action/issues/529">#529</a>) by <a href="https://github.com/jdx"><code>@jdx</code></a> in <a href="https://redirect.github.com/jdx/mise-action/pull/529">#529</a></li> </ul> <h3>⚙️ Miscellaneous Tasks</h3> <ul> <li><strong>(ci)</strong> automate weekly releases (<a href="https://redirect.github.com/jdx/mise-action/issues/557">#557</a>) by <a href="https://github.com/jdx"><code>@jdx</code></a> in <a href="https://redirect.github.com/jdx/mise-action/pull/557">#557</a></li> <li><strong>(release)</strong> skip ai reviews for release prs (<a href="https://redirect.github.com/jdx/mise-action/issues/549">#549</a>) by <a href="https://github.com/jdx"><code>@jdx</code></a> in <a href="https://redirect.github.com/jdx/mise-action/pull/549">#549</a></li> </ul> <!-- raw HTML omitted --> </blockquote> <p>... (truncated)</p> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/jdx/mise-action/commit/9e7f7633ff6f6d6048a9418a68d48f288f50eb14"><code>9e7f763</code></a> chore: release v4.2.3 (<a href="https://redirect.github.com/jdx/mise-action/issues/578">#578</a>)</li> <li><a href="https://github.com/jdx/mise-action/commit/0f8563785e70e54dca8048fea170aa8724b5470c"><code>0f85637</code></a> fix: export mise path entries to subsequent steps (<a href="https://redirect.github.com/jdx/mise-action/issues/575">#575</a>)</li> <li><a href="https://github.com/jdx/mise-action/commit/a24c37558aed0ce7f5bbd98aa69c714201402256"><code>a24c375</code></a> chore(deps): migrate to aube lockfile (<a href="https://redirect.github.com/jdx/mise-action/issues/576">#576</a>)</li> <li><a href="https://github.com/jdx/mise-action/commit/f10502fc09dadecfefb962fff68ce77213930204"><code>f10502f</code></a> chore: release v4.2.2 (<a href="https://redirect.github.com/jdx/mise-action/issues/567">#567</a>)</li> <li><a href="https://github.com/jdx/mise-action/commit/5df6b79829f8220a0c9d91f2943a030155adb035"><code>5df6b79</code></a> chore(deps): update zizmorcore/zizmor-action action to v0.6.0 (<a href="https://redirect.github.com/jdx/mise-action/issues/574">#574</a>)</li> <li><a href="https://github.com/jdx/mise-action/commit/be707ecdeaf88b565eacb466b4a76bf378c94dd8"><code>be707ec</code></a> chore(deps): update jdx/mise-action action to v4.2.1 (<a href="https://redirect.github.com/jdx/mise-action/issues/572">#572</a>)</li> <li><a href="https://github.com/jdx/mise-action/commit/d0f7879e382fb84c4eabb58874329c8d4b4654a9"><code>d0f7879</code></a> chore(deps): update github/codeql-action action to v4.37.1 (<a href="https://redirect.github.com/jdx/mise-action/issues/571">#571</a>)</li> <li><a href="https://github.com/jdx/mise-action/commit/fc371b785e25187fe8939adbfca8b55874df247a"><code>fc371b7</code></a> docs: update default value of <code>cache_key_prefix</code> (<a href="https://redirect.github.com/jdx/mise-action/issues/570">#570</a>)</li> <li><a href="https://github.com/jdx/mise-action/commit/5c77551fad58f7b38c7cd1fabec52ef652968bed"><code>5c77551</code></a> fix: ensure <code>tar</code> supports Zstd (<a href="https://redirect.github.com/jdx/mise-action/issues/569">#569</a>)</li> <li><a href="https://github.com/jdx/mise-action/commit/a63ca4f21410f6d76a7bba6b6787d34cf15541f2"><code>a63ca4f</code></a> fix(release-plz): exit when git-cliff produces no version bump (<a href="https://redirect.github.com/jdx/mise-action/issues/566">#566</a>)</li> <li>Additional commits viewable in <a href="https://github.com/jdx/mise-action/compare/e6a8b3978addb5a52f2b4cd9d91eafa7f0ab959d...9e7f7633ff6f6d6048a9418a68d48f288f50eb14">compare view</a></li> </ul> </details> <br /> Updates `github/codeql-action/init` from 4.36.2 to 4.37.3 <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/github/codeql-action/releases">github/codeql-action/init's releases</a>.</em></p> <blockquote> <h2>v4.37.3</h2> <p>No user facing changes.</p> <h2>v4.37.2</h2> <ul> <li>The new address format for the <code>config-file</code> input that was introduced in CodeQL Action 4.37.0 is now enabled by default. In addition to the format described there, the <code>remote=</code> prefix can now be used to explicitly indicate that the input refers to a remote file. All previous input formats continue to be accepted as well. <a href="https://redirect.github.com/github/codeql-action/pull/4023">#4023</a></li> <li>The CodeQL Action can now make use of <a href="https://docs.github.com/en/code-security/how-tos/secure-at-scale/configure-organization-security/manage-usage-and-access/giving-org-access-private-registries">configured private registries</a> in Default Setup to retrieve CodeQL configuration files from remote repositories that require authentication. This will allow customers to store their CodeQL configuration in a single repository that can then be referenced by Default Setup workflows in other repositories. We expect to roll this and other, related changes out to everyone in July. <a href="https://redirect.github.com/github/codeql-action/pull/4007">#4007</a></li> </ul> <h2>v4.37.1</h2> <ul> <li><em>Upcoming breaking change</em>: Add a deprecation warning for customers using CodeQL version 2.20.6 and earlier. These versions of CodeQL were discontinued on 1 July 2026 alongside GitHub Enterprise Server 3.16, and will be unsupported by the next minor release of the CodeQL Action. <a href="https://redirect.github.com/github/codeql-action/pull/3956">#3956</a></li> <li>Update default CodeQL bundle version to <a href="https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.26.1">2.26.1</a>. <a href="https://redirect.github.com/github/codeql-action/pull/4019">#4019</a></li> </ul> <h2>v4.37.0</h2> <ul> <li>Update default CodeQL bundle version to <a href="https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.26.0">2.26.0</a>. <a href="https://redirect.github.com/github/codeql-action/pull/3995">#3995</a></li> <li>In addition to the existing input format, the <code>config-file</code> input for the <code>codeql-action/init</code> step will soon support a new <code>[owner/]repo[@ref][:path]</code> format. All components except the repository name are optional. If omitted, <code>owner</code> defaults to the same owner as the repository the analysis is running for, <code>ref</code> to <code>main</code>, and <code>path</code> to <code>.github/codeql-action.yaml</code>. Support for this format ships in this version of the CodeQL Action, but will only be enabled over the coming weeks. <a href="https://redirect.github.com/github/codeql-action/pull/3973">#3973</a></li> </ul> <h2>v4.36.3</h2> <p>No user facing changes.</p> </blockquote> </details> <details> <summary>Changelog</summary> <p><em>Sourced from <a href="https://github.com/github/codeql-action/blob/main/CHANGELOG.md">github/codeql-action/init's changelog</a>.</em></p> <blockquote> <h1>CodeQL Action Changelog</h1> <p>See the <a href="https://github.com/github/codeql-action/releases">releases page</a> for the relevant changes to the CodeQL CLI and language packs.</p> <h2>[UNRELEASED]</h2> <ul> <li>Fixed a bug where a network error while streaming the download of the CodeQL bundle could terminate the <code>init</code> Action instead of falling back to downloading the bundle before extracting it. <a href="https://redirect.github.com/github/codeql-action/pull/4061">#4061</a></li> </ul> <h2>4.37.4 - 29 Jul 2026</h2> <ul> <li>This version of the CodeQL Action adds support for the <code>tools</code> input for the <code>codeql-action/init</code> step to be specified using a <code>github-codeql-tools</code> <a href="https://docs.github.com/en/organizations/managing-organization-settings/managing-custom-properties-for-repositories-in-your-organization">repository property</a>. This feature will gradually be rolled out following the release of this version. Once rolled out, this allows for the CodeQL CLI version that is used in GitHub-managed workflows, such as Default Setup, to be set to a custom value. For example, customers who run into issues with rate limits when a new CodeQL CLI version is released can set the value to <code>toolcache</code> to always use the CodeQL CLI version that is available in the runner toolcache. For Advanced Setup workflows, the value provided for <code>tools</code> in the workflow definition always takes precedence unless the value of the repository property starts with <code>!</code>. <a href="https://redirect.github.com/github/codeql-action/pull/4037">#4037</a></li> <li>Update default CodeQL bundle version to <a href="https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.26.2">2.26.2</a>. <a href="https://redirect.github.com/github/codeql-action/pull/4051">#4051</a></li> </ul> <h2>4.37.3 - 22 Jul 2026</h2> <p>No user facing changes.</p> <h2>4.37.2 - 21 Jul 2026</h2> <ul> <li>The new address format for the <code>config-file</code> input that was introduced in CodeQL Action 4.37.0 is now enabled by default. In addition to the format described there, the <code>remote=</code> prefix can now be used to explicitly indicate that the input refers to a remote file. All previous input formats continue to be accepted as well. <a href="https://redirect.github.com/github/codeql-action/pull/4023">#4023</a></li> <li>The CodeQL Action can now make use of <a href="https://docs.github.com/en/code-security/how-tos/secure-at-scale/configure-organization-security/manage-usage-and-access/giving-org-access-private-registries">configured private registries</a> in Default Setup to retrieve CodeQL configuration files from remote repositories that require authentication. This will allow customers to store their CodeQL configuration in a single repository that can then be referenced by Default Setup workflows in other repositories. We expect to roll this and other, related changes out to everyone in July. <a href="https://redirect.github.com/github/codeql-action/pull/4007">#4007</a></li> </ul> <h2>4.37.1 - 16 Jul 2026</h2> <ul> <li><em>Upcoming breaking change</em>: Add a deprecation warning for customers using CodeQL version 2.20.6 and earlier. These versions of CodeQL were discontinued on 1 July 2026 alongside GitHub Enterprise Server 3.16, and will be unsupported by the next minor release of the CodeQL Action. <a href="https://redirect.github.com/github/codeql-action/pull/3956">#3956</a></li> <li>Update default CodeQL bundle version to <a href="https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.26.1">2.26.1</a>. <a href="https://redirect.github.com/github/codeql-action/pull/4019">#4019</a></li> </ul> <h2>4.37.0 - 08 Jul 2026</h2> <ul> <li>Update default CodeQL bundle version to <a href="https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.26.0">2.26.0</a>. <a href="https://redirect.github.com/github/codeql-action/pull/3995">#3995</a></li> <li>In addition to the existing input format, the <code>config-file</code> input for the <code>codeql-action/init</code> step will soon support a new <code>[owner/]repo[@ref][:path]</code> format. All components except the repository name are optional. If omitted, <code>owner</code> defaults to the same owner as the repository the analysis is running for, <code>ref</code> to <code>main</code>, and <code>path</code> to <code>.github/codeql-action.yaml</code>. Support for this format ships in this version of the CodeQL Action, but will only be enabled over the coming weeks. <a href="https://redirect.github.com/github/codeql-action/pull/3973">#3973</a></li> </ul> <h2>4.36.3 - 01 Jul 2026</h2> <p>No user facing changes.</p> <h2>4.36.2 - 04 Jun 2026</h2> <ul> <li>Cache CodeQL CLI version information across Actions steps. <a href="https://redirect.github.com/github/codeql-action/pull/3943">#3943</a></li> <li>Reduce requests while waiting for analysis processing by using exponential backoff when polling SARIF processing status. <a href="https://redirect.github.com/github/codeql-action/pull/3937">#3937</a></li> <li>Update default CodeQL bundle version to <a href="https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.25.6">2.25.6</a>. <a href="https://redirect.github.com/github/codeql-action/pull/3948">#3948</a></li> </ul> <h2>4.36.1 - 02 Jun 2026</h2> <p>No user facing changes.</p> <h2>4.36.0 - 22 May 2026</h2> <ul> <li><em>Breaking change</em>: Bump the minimum required CodeQL bundle version to 2.19.4. <a href="https://redirect.github.com/github/codeql-action/pull/3894">#3894</a></li> <li>Add support for SHA-256 Git object IDs. <a href="https://redirect.github.com/github/codeql-action/pull/3893">#3893</a></li> </ul> <!-- raw HTML omitted --> </blockquote> <p>... (truncated)</p> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/github/codeql-action/commit/e4fba868fa4b1b91e1fdab776edc8cfbe6e9fb81"><code>e4fba86</code></a> Merge pull request <a href="https://redirect.github.com/github/codeql-action/issues/4031">#4031</a> from github/update-v4.37.3-72f6a9da0</li> <li><a href="https://github.com/github/codeql-action/commit/fb50ab5d62a274adf3ef3e22cfe750ae87a0ede7"><code>fb50ab5</code></a> Update changelog for v4.37.3</li> <li><a href="https://github.com/github/codeql-action/commit/72f6a9da0def52d9193d6a758f0378b65091f8d1"><code>72f6a9d</code></a> Merge pull request <a href="https://redirect.github.com/github/codeql-action/issues/4030">#4030</a> from github/mbg/fix/no-proxy</li> <li><a href="https://github.com/github/codeql-action/commit/3b5ee58597653d9cc6785f3f1277f796d81f3646"><code>3b5ee58</code></a> Use default <code>request</code> options instead of <code>undefined</code></li> <li><a href="https://github.com/github/codeql-action/commit/bfb6be4b5ecd3650f02f530571453e8c64ef0778"><code>bfb6be4</code></a> Merge pull request <a href="https://redirect.github.com/github/codeql-action/issues/4028">#4028</a> from github/mergeback/v4.37.2-to-main-e0647621</li> <li><a href="https://github.com/github/codeql-action/commit/526ab84f9858816d9cf5f7b9df4dd5e2235f0eba"><code>526ab84</code></a> Rebuild</li> <li><a href="https://github.com/github/codeql-action/commit/d6217b9b8c14166e4851db94c11155d03bd13c07"><code>d6217b9</code></a> Update changelog and version after v4.37.2</li> <li><a href="https://github.com/github/codeql-action/commit/e0647621c2984b5ed2f768cb892365bf2a616ad1"><code>e064762</code></a> Merge pull request <a href="https://redirect.github.com/github/codeql-action/issues/4027">#4027</a> from github/update-v4.37.2-385bcdc5a</li> <li><a href="https://github.com/github/codeql-action/commit/e0faed839190caa67a5cd42f1cc16246028ca3df"><code>e0faed8</code></a> Add a couple of change notes</li> <li><a href="https://github.com/github/codeql-action/commit/73aad0eaa9df172668665a150d17b8bc5a650c20"><code>73aad0e</code></a> Update changelog for v4.37.2</li> <li>Additional commits viewable in <a href="https://github.com/github/codeql-action/compare/8aad20d150bbac5944a9f9d289da16a4b0d87c1e...e4fba868fa4b1b91e1fdab776edc8cfbe6e9fb81">compare view</a></li> </ul> </details> <br /> Updates `github/codeql-action/analyze` from 4.36.2 to 4.37.3 <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/github/codeql-action/releases">github/codeql-action/analyze's releases</a>.</em></p> <blockquote> <h2>v4.37.3</h2> <p>No user facing changes.</p> <h2>v4.37.2</h2> <ul> <li>The new address format for the <code>config-file</code> input that was introduced in CodeQL Action 4.37.0 is now enabled by default. In addition to the format described there, the <code>remote=</code> prefix can now be used to explicitly indicate that the input refers to a remote file. All previous input formats continue to be accepted as well. <a href="https://redirect.github.com/github/codeql-action/pull/4023">#4023</a></li> <li>The CodeQL Action can now make use of <a href="https://docs.github.com/en/code-security/how-tos/secure-at-scale/configure-organization-security/manage-usage-and-access/giving-org-access-private-registries">configured private registries</a> in Default Setup to retrieve CodeQL configuration files from remote repositories that require authentication. This will allow customers to store their CodeQL configuration in a single repository that can then be referenced by Default Setup workflows in other repositories. We expect to roll this and other, related changes out to everyone in July. <a href="https://redirect.github.com/github/codeql-action/pull/4007">#4007</a></li> </ul> <h2>v4.37.1</h2> <ul> <li><em>Upcoming breaking change</em>: Add a deprecation warning for customers using CodeQL version 2.20.6 and earlier. These versions of CodeQL were discontinued on 1 July 2026 alongside GitHub Enterprise Server 3.16, and will be unsupported by the next minor release of the CodeQL Action. <a href="https://redirect.github.com/github/codeql-action/pull/3956">#3956</a></li> <li>Update default CodeQL bundle version to <a href="https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.26.1">2.26.1</a>. <a href="https://redirect.github.com/github/codeql-action/pull/4019">#4019</a></li> </ul> <h2>v4.37.0</h2> <ul> <li>Update default CodeQL bundle version to <a href="https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.26.0">2.26.0</a>. <a href="https://redirect.github.com/github/codeql-action/pull/3995">#3995</a></li> <li>In addition to the existing input format, the <code>config-file</code> input for the <code>codeql-action/init</code> step will soon support a new <code>[owner/]repo[@ref][:path]</code> format. All components except the repository name are optional. If omitted, <code>owner</code> defaults to the same owner as the repository the analysis is running for, <code>ref</code> to <code>main</code>, and <code>path</code> to <code>.github/codeql-action.yaml</code>. Support for this format ships in this version of the CodeQL Action, but will only be enabled over the coming weeks. <a href="https://redirect.github.com/github/codeql-action/pull/3973">#3973</a></li> </ul> <h2>v4.36.3</h2> <p>No user facing changes.</p> </blockquote> </details> <details> <summary>Changelog</summary> <p><em>Sourced from <a href="https://github.com/github/codeql-action/blob/main/CHANGELOG.md">github/codeql-action/analyze's changelog</a>.</em></p> <blockquote> <h1>CodeQL Action Changelog</h1> <p>See the <a href="https://github.com/github/codeql-action/releases">releases page</a> for the relevant changes to the CodeQL CLI and language packs.</p> <h2>[UNRELEASED]</h2> <ul> <li>Fixed a bug where a network error while streaming the download of the CodeQL bundle could terminate the <code>init</code> Action instead of falling back to downloading the bundle before extracting it. <a href="https://redirect.github.com/github/codeql-action/pull/4061">#4061</a></li> </ul> <h2>4.37.4 - 29 Jul 2026</h2> <ul> <li>This version of the CodeQL Action adds support for the <code>tools</code> input for the <code>codeql-action/init</code> step to be specified using a <code>github-codeql-tools</code> <a href="https://docs.github.com/en/organizations/managing-organization-settings/managing-custom-properties-for-repositories-in-your-organization">repository property</a>. This feature will gradually be rolled out following the release of this version. Once rolled out, this allows for the CodeQL CLI version that is used in GitHub-managed workflows, such as Default Setup, to be set to a custom value. For example, customers who run into issues with rate limits when a new CodeQL CLI version is released can set the value to <code>toolcache</code> to always use the CodeQL CLI version that is available in the runner toolcache. For Advanced Setup workflows, the value provided for <code>tools</code> in the workflow definition always takes precedence unless the value of the repository property starts with <code>!</code>. <a href="https://redirect.github.com/github/codeql-action/pull/4037">#4037</a></li> <li>Update default CodeQL bundle version to <a href="https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.26.2">2.26.2</a>. <a href="https://redirect.github.com/github/codeql-action/pull/4051">#4051</a></li> </ul> <h2>4.37.3 - 22 Jul 2026</h2> <p>No user facing changes.</p> <h2>4.37.2 - 21 Jul 2026</h2> <ul> <li>The new address format for the <code>config-file</code> input that was introduced in CodeQL Action 4.37.0 is now enabled by default. In addition to the format described there, the <code>remote=</code> prefix can now be used to explicitly indicate that the input refers to a remote file. All previous input formats continue to be accepted as well. <a href="https://redirect.github.com/github/codeql-action/pull/4023">#4023</a></li> <li>The CodeQL Action can now make use of <a href="https://docs.github.com/en/code-security/how-tos/secure-at-scale/configure-organization-security/manage-usage-and-access/giving-org-access-private-registries">configured private registries</a> in Default Setup to retrieve CodeQL configuration files from remote repositories that require authentication. This will allow customers to store their CodeQL configuration in a single repository that can then be referenced by Default Setup workflows in other repositories. We expect to roll this and other, related changes out to everyone in July. <a href="https://redirect.github.com/github/codeql-action/pull/4007">#4007</a></li> </ul> <h2>4.37.1 - 16 Jul 2026</h2> <ul> <li><em>Upcoming breaking change</em>: Add a deprecation warning for customers using CodeQL version 2.20.6 and earlier. These versions of CodeQL were discontinued on 1 July 2026 alongside GitHub Enterprise Server 3.16, and will be unsupported by the next minor release of the CodeQL Action. <a href="https://redirect.github.com/github/codeql-action/pull/3956">#3956</a></li> <li>Update default CodeQL bundle version to <a href="https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.26.1">2.26.1</a>. <a href="https://redirect.github.com/github/codeql-action/pull/4019">#4019</a></li> </ul> <h2>4.37.0 - 08 Jul 2026</h2> <ul> <li>Update default CodeQL bundle version to <a href="https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.26.0">2.26.0</a>. <a href="https://redirect.github.com/github/codeql-action/pull/3995">#3995</a></li> <li>In addition to the existing input format, the <code>config-file</code> input for the <code>codeql-action/init</code> step will soon support a new <code>[owner/]repo[@ref][:path]</code> format. All components except the repository name are optional. If omitted, <code>owner</code> defaults to the same owner as the repository the analysis is running for, <code>ref</code> to <code>main</code>, and <code>path</code> to <code>.github/codeql-action.yaml</code>. Support for this format ships in this version of the CodeQL Action, but will only be enabled over the coming weeks. <a href="https://redirect.github.com/github/codeql-action/pull/3973">#3973</a></li> </ul> <h2>4.36.3 - 01 Jul 2026</h2> <p>No user facing changes.</p> <h2>4.36.2 - 04 Jun 2026</h2> <ul> <li>Cache CodeQL CLI version information across Actions steps. <a href="https://redirect.github.com/github/codeql-action/pull/3943">#3943</a></li> <li>Reduce requests while waiting for analysis processing by using exponential backoff when polling SARIF processing status. <a href="https://redirect.github.com/github/codeql-action/pull/3937">#3937</a></li> <li>Update default CodeQL bundle version to <a href="https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.25.6">2.25.6</a>. <a href="https://redirect.github.com/github/codeql-action/pull/3948">#3948</a></li> </ul> <h2>4.36.1 - 02 Jun 2026</h2> <p>No user facing changes.</p> <h2>4.36.0 - 22 May 2026</h2> <ul> <li><em>Breaking change</em>: Bump the minimum required CodeQL bundle version to 2.19.4. <a href="https://redirect.github.com/github/codeql-action/pull/3894">#3894</a></li> <li>Add support for SHA-256 Git object IDs. <a href="https://redirect.github.com/github/codeql-action/pull/3893">#3893</a></li> </ul> <!-- raw HTML omitted --> </blockquote> <p>... (truncated)</p> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/github/codeql-action/commit/e4fba868fa4b1b91e1fdab776edc8cfbe6e9fb81"><code>e4fba86</code></a> Merge pull request <a href="https://redirect.github.com/github/codeql-action/issues/4031">#4031</a> from github/update-v4.37.3-72f6a9da0</li> <li><a href="https://github.com/github/codeql-action/commit/fb50ab5d62a274adf3ef3e22cfe750ae87a0ede7"><code>fb50ab5</code></a> Update changelog for v4.37.3</li> <li><a href="https://github.com/github/codeql-action/commit/72f6a9da0def52d9193d6a758f0378b65091f8d1"><code>72f6a9d</code></a> Merge pull request <a href="https://redirect.github.com/github/codeql-action/issues/4030">#4030</a> from github/mbg/fix/no-proxy</li> <li><a href="https://github.com/github/codeql-action/commit/3b5ee58597653d9cc6785f3f1277f796d81f3646"><code>3b5ee58</code></a> Use default <code>request</code> options instead of <code>undefined</code></li> <li><a href="https://github.com/github/codeql-action/commit/bfb6be4b5ecd3650f02f530571453e8c64ef0778"><code>bfb6be4</code></a> Merge pull request <a href="https://redirect.github.com/github/codeql-action/issues/4028">#4028</a> from github/mergeback/v4.37.2-to-main-e0647621</li> <li><a href="https://github.com/github/codeql-action/commit/526ab84f9858816d9cf5f7b9df4dd5e2235f0eba"><code>526ab84</code></a> Rebuild</li> <li><a href="https://github.com/github/codeql-action/commit/d6217b9b8c14166e4851db94c11155d03bd13c07"><code>d6217b9</code></a> Update changelog and version after v4.37.2</li> <li><a href="https://github.com/github/codeql-action/commit/e0647621c2984b5ed2f768cb892365bf2a616ad1"><code>e064762</code></a> Merge pull request <a href="https://redirect.github.com/github/codeql-action/issues/4027">#4027</a> from github/update-v4.37.2-385bcdc5a</li> <li><a href="https://github.com/github/codeql-action/commit/e0faed839190caa67a5cd42f1cc16246028ca3df"><code>e0faed8</code></a> Add a couple of change notes</li> <li><a href="https://github.com/github/codeql-action/commit/73aad0eaa9df172668665a150d17b8bc5a650c20"><code>73aad0e</code></a> Update changelog for v4.37.2</li> <li>Additional commits viewable in <a href="https://github.com/github/codeql-action/compare/8aad20d150bbac5944a9f9d289da16a4b0d87c1e...e4fba868fa4b1b91e1fdab776edc8cfbe6e9fb81">compare view</a></li> </ul> </details> <br /> Updates `lycheeverse/lychee-action` from 2.8.0 to 2.9.0 <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/lycheeverse/lychee-action/releases">lycheeverse/lychee-action's releases</a>.</em></p> <blockquote> <h2>v2.9.0</h2> <h2>Summary</h2> <p>This release updates the default lychee version from <code>v0.23.0</code> to <code>v0.24.2</code>.</p> <p>The main reason for this release is compatibility with the new lychee <code>0.24.x</code> release artifacts. Starting with lychee <code>v0.24.0</code>, the archive layout changed, and the <code>lychee</code> binary may now be packaged inside a subdirectory. <code>lychee-action</code> now detects that layout automatically, so users can upgrade without changing their workflows.</p> <p>If you use:</p> <pre lang="yaml"><code>uses: lycheeverse/lychee-action@v2 </code></pre> <p>you will get the new version once the floating <code>v2</code> tag has been updated. If you pin exact versions, update to:</p> <pre lang="yaml"><code>uses: lycheeverse/lychee-action@v2.9.0 </code></pre> <h2>What’s new from lychee <code>v0.24.x</code></h2> <h3>Better diagnostics</h3> <p>lychee now reports line and column numbers for detected links. This makes broken link reports easier to act on, especially in larger documentation sites or generated reports.</p> <h3>Text fragment checking</h3> <p>lychee can now check URL text fragments, such as links containing <code>#:~:text=...</code>. This helps catch links that point to a valid page but no longer points to the intended highlighted text.</p> <h3>Sitemap support</h3> <p>lychee can now read <code>sitemap.xml</code> inputs. This is useful for checking published websites or generated documentation sites where the sitemap is the easiest source of URLs to validate.</p> <h3>JUnit output</h3> <p>lychee now supports JUnit output. This makes it easier to integrate link checking results with CI systems and test reporting tools that understand JUnit XML.</p> <h3>Redirect and remap visibility</h3> <p>lychee can now show redirects and remaps more clearly. This helps explain why a URL was checked as a different final URL and makes debugging link-checking behavior easier.</p> <h3>Multiple config files</h3> <p>lychee now supports multiple configuration files and expanded config handling. This is useful for repositories that split documentation, website, or package-specific link-checking settings.</p> <h3>Timeout handling</h3> <p>lychee can now accept timeouts explicitly. This gives users more control over how strict their link checks should be for flaky or slow endpoints.</p> <h2>Fixes and reliability improvements</h2> <!-- raw HTML omitted --> </blockquote> <p>... (truncated)</p> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/lycheeverse/lychee-action/commit/e7477775783ea5526144ba13e8db5eec57747ce8"><code>e747777</code></a> Bump actions/cache from 5 to 6 (<a href="https://redirect.github.com/lycheeverse/lychee-action/issues/340">#340</a>)</li> <li><a href="https://github.com/lycheeverse/lychee-action/commit/39066c6d1f0de280863a3760160617e188b607ad"><code>39066c6</code></a> Bump actions/checkout from 6 to 7 (<a href="https://redirect.github.com/lycheeverse/lychee-action/issues/339">#339</a>)</li> <li><a href="https://github.com/lycheeverse/lychee-action/commit/6da1d14f3a43098a294b7696d93d938aa8d20fc0"><code>6da1d14</code></a> Install into $RUNNER_TEMP instead of $HOME (<a href="https://redirect.github.com/lycheeverse/lychee-action/issues/338">#338</a>)</li> <li><a href="https://github.com/lycheeverse/lychee-action/commit/a63497c75a5435b151e800818e2286764b6e119a"><code>a63497c</code></a> fixes <a href="https://redirect.github.com/lycheeverse/lychee-action/issues/322">#322</a> check for null (<a href="https://redirect.github.com/lycheeverse/lychee-action/issues/336">#336</a>)</li> <li><a href="https://github.com/lycheeverse/lychee-action/commit/b40e218fdac9481d3c13098d4e1ee56f3b589356"><code>b40e218</code></a> [create-pull-request] automated change</li> <li><a href="https://github.com/lycheeverse/lychee-action/commit/faea714062690f6c2e6f7f388469ec4fa6d9c4e1"><code>faea714</code></a> bump default to 0.24.1 and auto-detect lychee bin in subfolder (<a href="https://redirect.github.com/lycheeverse/lychee-action/issues/330">#330</a>)</li> <li>See full diff in <a href="https://github.com/lycheeverse/lychee-action/compare/8646ba30535128ac92d33dfc9133794bfdd9b411...e7477775783ea5526144ba13e8db5eec57747ce8">compare view</a></li> </ul> </details> <br /> Updates `slackapi/slack-github-action` from 3.0.3 to 4.0.0 <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/slackapi/slack-github-action/releases">slackapi/slack-github-action's releases</a>.</em></p> <blockquote> <h2>Slack GitHub Action v4.0.0</h2> <h3>Major Changes</h3> <ul> <li> <p>b1974f0: build: parse yaml with more strict multiline indentation rules</p> <p>Internal dependencies of <a href="https://github.com/nodeca/js-yaml/blob/master/CHANGELOG.md#500---2026-06-20"><code>js-yaml@v5</code></a> make YAML parsing more strict and compliant with the YAML specification. Indentation is now required for values that span multiple lines against the base value.</p> <p>See the YAML <a href="https://yaml.org/spec/1.2.2/#63-line-prefixes">line prefixes</a> spec for the expected indentation rule:</p> <pre lang="diff"><code> channel: "C0123" text: "first line <ul> <li>second line"</li> </ul> <ul> <li>second line"<br /> </code></pre></li> </ul> </li> </ul> <h3>Patch Changes</h3> <ul> <li>654bb72: chore: provide global fetch proxied configurations with updates to web api and webhook packages</li> </ul> <h2>Slack GitHub Action v3.0.5</h2> <h3>Patch Changes</h3> <ul> <li>96fddbe: fix: revert multiline yaml parsing indentation change</li> </ul> <h2>Slack GitHub Action v3.0.4</h2> <h3>Patch Changes</h3> <ul> <li>fa03fe4: refactor: send webhooks with the <a href="https://docs.slack.dev/tools/node-slack-sdk/webhook"><code>@slack/webhook</code></a> package</li> </ul> </blockquote> </details> <details> <summary>Changelog</summary> <p><em>Sourced from <a href="https://github.com/slackapi/slack-github-action/blob/main/CHANGELOG.md">slackapi/slack-github-action's changelog</a>.</em></p> <blockquote> <h1>slack-github-action</h1> <h2>4.0.0</h2> <h3>Major Changes</h3> <ul> <li> <p>b1974f0: build: parse yaml with more strict multiline indentation rules</p> <p>Internal dependencies of <a href="https://github.com/nodeca/js-yaml/blob/master/CHANGELOG.md#500---2026-06-20"><code>js-yaml@v5</code></a> make YAML parsing more strict and compliant with the YAML specification. Indentation is now required for values that span multiple lines against the base value.</p> <p>See the YAML <a href="https://yaml.org/spec/1.2.2/#63-line-prefixes">line prefixes</a> spec for the expected indentation rule:</p> <pre lang="diff"><code> channel: "C0123" text: "first line <ul> <li>second line"</li> </ul> <ul> <li>second line"<br /> </code></pre></li> </ul> </li> </ul> <h3>Patch Changes</h3> <ul> <li>654bb72: chore: provide global fetch proxied configurations with updates to web api and webhook packages</li> </ul> <h2>3.0.5</h2> <h3>Patch Changes</h3> <ul> <li>96fddbe: fix: revert multiline yaml parsing indentation change</li> </ul> <h2>3.0.4</h2> <h3>Patch Changes</h3> <ul> <li>fa03fe4: refactor: send webhooks with the <a href="https://docs.slack.dev/tools/node-slack-sdk/webhook"><code>@slack/webhook</code></a> package</li> </ul> <h2>3.0.3</h2> <h3>Patch Changes</h3> <ul> <li>66834e4: feat: add instrumentation to address error rates</li> </ul> <h2>3.0.2</h2> <h3>Patch Changes</h3> <ul> <li>79529d7: fix: resolve url.parse deprecation warning for webhook techniques</li> </ul> </blockquote> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/slackapi/slack-github-action/commit/dcb1066f776dd043e64d0e8ba94ca15cc7e1875d"><code>dcb1066</code></a> chore: release</li> <li><a href="https://github.com/slackapi/slack-github-action/commit/53861e0291660faf57ba686eabf046d5a47fa304"><code>53861e0</code></a> chore: release (<a href="https://redirect.github.com/slackapi/slack-github-action/issues/645">#645</a>)</li> <li><... _Description has been truncated_ Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>	2026-08-03 09:52:42 -05:00
dependabot[bot]	d5cde61858	build(deps): bump go.opentelemetry.io/proto/otlp from 1.10.0 to 1.11.0 in the go-opentelemetry-io group across 1 directory (#8963 ) Bumps the go-opentelemetry-io group with 1 update in the / directory: [go.opentelemetry.io/proto/otlp](https://github.com/open-telemetry/opentelemetry-proto-go). Updates `go.opentelemetry.io/proto/otlp` from 1.10.0 to 1.11.0 <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/open-telemetry/opentelemetry-proto-go/commit/bc625d6e040020737ab65c675c87e03bc841fd60"><code>bc625d6</code></a> Release v1.11.0 (<a href="https://redirect.github.com/open-telemetry/opentelemetry-proto-go/issues/659">#659</a>)</li> <li><a href="https://github.com/open-telemetry/opentelemetry-proto-go/commit/22a65e0aeaea2c17c826aaaf17d2edcea39cf24e"><code>22a65e0</code></a> chore(deps): update github/codeql-action action to v4.37.3 (<a href="https://redirect.github.com/open-telemetry/opentelemetry-proto-go/issues/661">#661</a>)</li> <li><a href="https://github.com/open-telemetry/opentelemetry-proto-go/commit/519c2d91d1328cdfe0deaa74b9c771f76dc29d12"><code>519c2d9</code></a> chore(deps): update actions/checkout action to v7.0.1 (<a href="https://redirect.github.com/open-telemetry/opentelemetry-proto-go/issues/657">#657</a>)</li> <li><a href="https://github.com/open-telemetry/opentelemetry-proto-go/commit/08bb19153e5377d8f4723a0ae910c8e6708a71c3"><code>08bb191</code></a> chore(deps): update googleapis to 0afa2a6 (<a href="https://redirect.github.com/open-telemetry/opentelemetry-proto-go/issues/656">#656</a>)</li> <li><a href="https://github.com/open-telemetry/opentelemetry-proto-go/commit/64642b3f49ca8f6c9d29ca6fd988a3a187edae83"><code>64642b3</code></a> chore(deps): update github/codeql-action action to v4.37.2 (<a href="https://redirect.github.com/open-telemetry/opentelemetry-proto-go/issues/660">#660</a>)</li> <li><a href="https://github.com/open-telemetry/opentelemetry-proto-go/commit/13684cd86642ef6b0d3cbe1973b7cc4a5126105f"><code>13684cd</code></a> fix(deps): update module google.golang.org/grpc to v1.82.1 (<a href="https://redirect.github.com/open-telemetry/opentelemetry-proto-go/issues/653">#653</a>)</li> <li><a href="https://github.com/open-telemetry/opentelemetry-proto-go/commit/cbe4701bbba7153ac7823d6a9bc62c1652d11eb0"><code>cbe4701</code></a> chore(deps): update github/codeql-action action to v4.37.1 (<a href="https://redirect.github.com/open-telemetry/opentelemetry-proto-go/issues/655">#655</a>)</li> <li><a href="https://github.com/open-telemetry/opentelemetry-proto-go/commit/cfb456bc4d7778ca70f25c2eeddb76182f08cf4e"><code>cfb456b</code></a> chore(deps): update googleapis to e75dac1 (<a href="https://redirect.github.com/open-telemetry/opentelemetry-proto-go/issues/652">#652</a>)</li> <li><a href="https://github.com/open-telemetry/opentelemetry-proto-go/commit/c72655abae4447d61bbe1a7e29dd888f63c53365"><code>c72655a</code></a> chore(deps): update actions/setup-go action to v7 (<a href="https://redirect.github.com/open-telemetry/opentelemetry-proto-go/issues/654">#654</a>)</li> <li><a href="https://github.com/open-telemetry/opentelemetry-proto-go/commit/cc0174701be29df0d84bbfe2e402649897eb48cd"><code>cc01747</code></a> chore(deps): update google.golang.org/genproto/googleapis/api digest to 142c4...</li> <li>Additional commits viewable in <a href="https://github.com/open-telemetry/opentelemetry-proto-go/compare/v1.10.0...v1.11.0">compare view</a></li> </ul> </details> <br /> [![Dependabot compatibility score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=go.opentelemetry.io/proto/otlp&package-manager=go_modules&previous-version=1.10.0&new-version=1.11.0)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore <dependency name> major version` will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself) - `@dependabot ignore <dependency name> minor version` will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself) - `@dependabot ignore <dependency name>` will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself) - `@dependabot unignore <dependency name>` will remove all of the ignore conditions of the specified dependency - `@dependabot unignore <dependency name> <ignore condition>` will remove the ignore condition of the specified dependency and ignore conditions </details> Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>	2026-08-03 09:52:23 -05:00
Yilia Lin	22b149a05f	docs/website: Refresh Apache APISIX ecosystem resources (#8957 ) The Apache APISIX ecosystem entry does not currently point readers to the maintained `opa` plugin documentation and includes a duplicate Medium cross-post. This update makes the official plugin documentation the primary integration reference, adds a related ASF talk and an authorization-focused APISIX article, and removes the duplicate link. Keeping these resources current will help OPA users find the request and decision contract, configuration, and runnable examples from the ecosystem page. Validation completed: - `make fmt-check` - `make markdownlint-check` - `make lint-check` - `make build` Signed-off-by: Yilia Lin <yilialinn@163.com>	2026-08-03 11:30:42 +01:00
Summy Wu	b3f7c2cb30	debug: allow configuring variable value length limit (#8907 ) ### Why are the changes in this PR needed? The DAP debugger currently truncates variable values to a hardcoded limit of 100 characters, with no way for callers to configure it. Long values cannot be inspected or copied whole from a debugger UI. ### What are the changes in this PR? - Add a new `SetMaxVariableLength` Debugger option (in both `v1/debug` and the top-level `debug` package) - A value of 0 disables truncation; the default stays 100 characters for backward compatibility - Plumb the limit through `variableManager` and `namedVar`, so it applies to top-level and nested (object/array/set) variables alike - Relax `truncatedString` to return the original string unchanged when the limit is <= 0 - Add `TestTruncatedString` and `TestVariableValueLengthLimit` covering the default limit, unlimited (0), negative, custom limits, and boundary cases ### Notes - `go build ./...` and `go test ./v1/debug/...` both pass - Default behavior is unchanged; the new option is opt-in - This PR was developed with AI assistance (Claude Code) ### Further comments Refs #8890 --------- Signed-off-by: summy wu <summy.wu81@gmail.com>	2026-07-31 09:36:34 -05:00
Sebastian Spaink	c93c18f424	Prepare v1.20.0 development (#8956 ) Signed-off-by: Sebastian Spaink <sebastianspaink@gmail.com>	2026-07-30 17:33:57 -05:00
Johan Fylling	1e32c796e8	Prepare v1.19.0 release (#8955 ) Signed-off-by: Johan Fylling <johan.dev@fylling.se> Signed-off-by: Sebastian Spaink <sebastianspaink@gmail.com> Co-authored-by: Sebastian Spaink <sebastianspaink@gmail.com> v1.19.0	2026-07-30 14:38:54 -05:00
Anders Eknert	db035b09fc	Add support for Go 1.27 & jsonv2 (#8947 ) Makes OPA build and pass its tests on Go 1.27, while keeping Go 1.25 and 1.26 working. JSON output is unchanged on every supported version. Go 1.27 json package honours `encoding.TextAppender`. Many v1 ast types implement AppendText to build their Rego string cheaply, so on 1.27 they would have marshalled as Rego text. Files built only with 1.27 now implement MarshalJSONTo. Library users should keep using `json.Marshal` etc. The MarshalJSONTo methods are implementation details, are absent from 1.25 and 1.26 builds, and may change. --------- Signed-off-by: Anders Eknert <anders.eknert@apple.com> Signed-off-by: Charlie Egan <charlie_egan@apple.com> Co-authored-by: Charlie Egan <charlie_egan@apple.com>	2026-07-30 17:41:28 +01:00
Johan Fylling	27fe5ceac8	ast: Fix leaky `future.keywords.not` import in Rego v0 (#8953 ) Fixing an issue where the `future.keywords.not` import would erroneously import other future keywords. E.g. consider the following v0 module: ```rego package example import future.keywords.not p if { not input.x } ``` The `future.keywords.not` import also imports the `if` keyword. This fix makes the above module invalid. Signed-off-by: Johan Fylling <johan.dev@fylling.se>	2026-07-29 19:06:54 +02:00
Kunal Behbudzade	ab2187089a	format: Keep rule body inline when the head spans multiple lines (#8904 ) ### Why the changes in this PR are needed? Fixes #8894. `opa fmt` expands a one-line `if` condition into a block whenever the rule head's value expression spans multiple lines, even though the condition itself is a single simple term. For example: ```rego foo := sprintf( "%d", [1], ) if allow ``` was reformatted to: ```rego foo := sprintf( "%d", [1], ) if { allow } ``` ### What are the changes in this PR? The inline-`if` path in `writeRule` decides whether to keep `if <term>` on one line by comparing the body term's row to the rule head's row: ```go if rule.Body[0].Location.Row == rule.Head.Location.Row { ``` `rule.Head.Location.Row` is the head's start row. Once the head value wraps onto later lines, the single body term sits on a later row than the head start, the equality fails, and formatting falls through to the block form. The fix compares against the head's end row instead (start row plus the number of newlines in the head's location text), so a single body term on the same line as `if` stays inline regardless of how many lines the head value occupies. Single-line heads are unaffected (end row == start row), and genuinely multi-statement bodies still expand as before (they don't hit the `len(rule.Body) == 1` branch). ### Notes to assist PR review: Added `v1/format/testfiles/v1/test_issue_8894.rego` (+`.formatted`) with the exact repro from the issue; it fails on `master` (expands to a block) and passes with this change. The rest of the format golden suite is unchanged. Signed-off-by: Kunalbehbud <b.kunal2002@gmail.com>	2026-07-28 18:47:31 +02:00
WonjuLee	95090fa4eb	Add strings.split_n built-in function (#8915 ) ### Why the changes in this PR are needed? Policies often need only the first or last few parts of a split string, but `split()` always returns every part. The common workarounds add noise: ```rego [name, email, _, _] := split(user, ";") [name, email] := array.slice(split(user, ";"), 0, 2) ``` ### What are the changes in this PR? Adds `strings.split_n(x, delimiter, n)`: - Positive n: returns the first n parts from the left - Negative n: returns the last abs(n) parts from the right - n=0: returns an empty array - If abs(n) exceeds the number of parts, all parts are returned ### Notes to assist PR review: Semantics follow the design agreed on in the review of #8361. ### Further comments: Fixes #8344 This change was developed with AI assistance. Signed-off-by: wonju lee <wonju@kia.com> Co-authored-by: wonju lee <wonju@kia.com>	2026-07-28 08:39:21 -05:00
dependabot[bot]	12a86ed2a7	build(deps): bump find-my-way and prisma in /e2e/api/compile/prisma Bumps [find-my-way](https://github.com/delvedor/find-my-way) to 9.7.0 and updates ancestor dependency [prisma](https://github.com/prisma/prisma/tree/HEAD/packages/cli). These dependencies need to be updated together. Updates `find-my-way` from 9.6.0 to 9.7.0 - [Release notes](https://github.com/delvedor/find-my-way/releases) - [Commits](https://github.com/delvedor/find-my-way/compare/v9.6.0...v9.7.0) Updates `prisma` from 7.9.0 to 7.9.1 - [Release notes](https://github.com/prisma/prisma/releases) - [Commits](https://github.com/prisma/prisma/commits/7.9.1/packages/cli) --- updated-dependencies: - dependency-name: find-my-way dependency-version: 9.7.0 dependency-type: indirect - dependency-name: prisma dependency-version: 7.9.1 dependency-type: direct:development ... Signed-off-by: dependabot[bot] <support@github.com>	2026-07-28 11:22:31 +02:00
dependabot[bot]	18815e2b02	build(deps): bump the dependencies group across 2 directories with 5 updates Bumps the dependencies group with 4 updates in the / directory: [github.com/go-logr/logr](https://github.com/go-logr/logr), [github.com/prometheus/client_golang](https://github.com/prometheus/client_golang), [golang.org/x/term](https://github.com/golang/term) and [google.golang.org/grpc](https://github.com/grpc/grpc-go). Bumps the dependencies group with 1 update in the /e2e directory: [modernc.org/sqlite](https://gitlab.com/cznic/sqlite). Updates `github.com/go-logr/logr` from 1.4.3 to 1.4.4 - [Release notes](https://github.com/go-logr/logr/releases) - [Changelog](https://github.com/go-logr/logr/blob/master/CHANGELOG.md) - [Commits](https://github.com/go-logr/logr/compare/v1.4.3...v1.4.4) Updates `github.com/prometheus/client_golang` from 1.23.2 to 1.24.0 - [Release notes](https://github.com/prometheus/client_golang/releases) - [Changelog](https://github.com/prometheus/client_golang/blob/v1.24.0/CHANGELOG.md) - [Commits](https://github.com/prometheus/client_golang/compare/v1.23.2...v1.24.0) Updates `golang.org/x/term` from 0.44.0 to 0.45.0 - [Commits](https://github.com/golang/term/compare/v0.44.0...v0.45.0) Updates `google.golang.org/grpc` from 1.82.0 to 1.82.1 - [Release notes](https://github.com/grpc/grpc-go/releases) - [Commits](https://github.com/grpc/grpc-go/compare/v1.82.0...v1.82.1) Updates `modernc.org/sqlite` from 1.53.0 to 1.54.0 - [Changelog](https://gitlab.com/cznic/sqlite/blob/master/CHANGELOG.md) - [Commits](https://gitlab.com/cznic/sqlite/compare/v1.53.0...v1.54.0) --- updated-dependencies: - dependency-name: github.com/go-logr/logr dependency-version: 1.4.4 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: dependencies - dependency-name: github.com/prometheus/client_golang dependency-version: 1.24.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: dependencies - dependency-name: golang.org/x/term dependency-version: 0.45.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: dependencies - dependency-name: google.golang.org/grpc dependency-version: 1.82.1 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: dependencies - dependency-name: modernc.org/sqlite dependency-version: 1.54.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: dependencies ... Signed-off-by: dependabot[bot] <support@github.com>	2026-07-28 11:20:02 +02:00
dependabot[bot]	f1e2ac07e4	build(deps): bump postcss from 8.5.15 to 8.5.23 in /docs Bumps [postcss](https://github.com/postcss/postcss) from 8.5.15 to 8.5.23. - [Release notes](https://github.com/postcss/postcss/releases) - [Changelog](https://github.com/postcss/postcss/blob/main/CHANGELOG.md) - [Commits](https://github.com/postcss/postcss/compare/8.5.15...8.5.23) --- updated-dependencies: - dependency-name: postcss dependency-version: 8.5.23 dependency-type: indirect ... Signed-off-by: dependabot[bot] <support@github.com>	2026-07-28 11:19:10 +02:00
dependabot[bot]	d9c7856eae	build(deps): bump js-yaml from 5.2.1 to 5.2.2 in /docs Bumps [js-yaml](https://github.com/nodeca/js-yaml) from 5.2.1 to 5.2.2. - [Changelog](https://github.com/nodeca/js-yaml/blob/master/CHANGELOG.md) - [Commits](https://github.com/nodeca/js-yaml/compare/5.2.1...5.2.2) --- updated-dependencies: - dependency-name: js-yaml dependency-version: 5.2.2 dependency-type: direct:production ... Signed-off-by: dependabot[bot] <support@github.com>	2026-07-28 11:06:38 +02:00
Victor	69d2cc04a0	tester: make Result JSON round-trippable (#8946 ) ## Summary - add a concrete JSON unmarshal path for tester.Result errors - preserve the existing marshaled output byte-for-byte - reconstruct structured topdown errors from opa test --format json output Fixes #8014 ## Testing - go test -count=1 ./v1/tester/... ./tester/... - go test -count=1 ./cmd/... - go build ./... - go vet ./v1/tester/... ./tester/... ./cmd/... - gofmt check on the changed Go files Signed-off-by: Victor Solano <victor.solanonunez@gmail.com>	2026-07-27 16:24:57 -05:00
Ville Vesilehto	986642777c	ucast: Quote SQL filter field identifiers Field names in the SQL emitted by the Compile API come from partially evaluated refs, so a policy selecting a dynamic key such as input.fruits[input.column] puts caller-controlled text in an identifier position. That text was emitted verbatim, which turns WHERE fruit.name = 'allowed' into WHERE fruit.name = 'allowed' OR 1=1 -- = 'allowed' and an application appending the filter to its query returns rows the policy denies. Quote field segments that are not bare identifiers at the UCAST-to-SQL boundary, escaping any embedded quote character. Ordinary column names stay unquoted, so existing filters keep their current shape and remain case-insensitive on Postgres. Signed-off-by: Ville Vesilehto <ville@vesilehto.fi>	2026-07-27 13:54:04 +02:00
KBS	8186bd17e0	docs: document the compile metadata annotation (#8905 ) Documents the `compile` metadata annotation, which was added without documentation. Adds: - a `compile` row to the metadata annotations reference table (alongside `entrypoint` / `custom`). - a "Metadata `compile`" section documenting the `unknowns` and `mask_rule` fields, the annotation scope chain, precedence versus the Compile API request, and a rego example. Closes #8824. Signed-off-by: youdie006 <youdie006@users.noreply.github.com> Co-authored-by: youdie006 <youdie006@users.noreply.github.com>	2026-07-27 13:50:45 +02:00
Sebastian Spaink	fa9cce7d6f	topdown/copypropagation: avoid circular reference through call Partial evaluation can produce a binding where a variable is equated to a call that references itself, e.g. `bt & ut == bt` yields `bt = and(bt, ut)`. Copy propagation would substitute the variable with that binding, reintroducing it on the RHS to form a self-referential term, which sent the following ast.Transform into unbounded recursion and overflowed the stack, crashing the server on /v1/compile. Skip substituting a binding that mentions the variable, so circular calls are left in place instead of expanded. Fixes: #6428 Signed-off-by: Sebastian Spaink <sebastianspaink@gmail.com>	2026-07-25 12:18:17 +02:00
Stephan Renatus	453b2baa18	ast: add benchmark for rule index ref ordering I was wondering what this really bought us. It's not much. NB this is still a rule set shaped to _reward_ ordering (shared high-selectivity gates + unique details). On a homogeneous or low-selectivity rule set the gap collapses toward nothing. Signed-off-by: Stephan Renatus <stephan.renatus@gmail.com>	2026-07-25 12:17:34 +02:00
Johan Fylling	95111ca330	docs: Add recommendations to follow Envoy's best practices (#8944 ) with explicit recommendations to enable `normalize_path`, `merge_slashes`, and `path_with_escaped_slashes_action`. Signed-off-by: Johan Fylling <johan.dev@fylling.se>	2026-07-24 21:37:58 +02:00
Anders Eknert	7934d47f64	perf: Lazy init of scalars map in indexer (#8936 ) Creating the scalars map for each node was expensive, and would in many cases sit unused. Now we initialize it only before use, which shaves off almost a million allocations from `regal lint bundle`, and I imagine is quite a boost for evaluation of many other policy types. Also: - Add benchmarks for the indexer that I used to try things out - Avoid a few heap allocations by avoiding interface boxing to Value Signed-off-by: Anders Eknert <anders.eknert@apple.com> Co-authored-by: Stephan Renatus <stephan.renatus@gmail.com>	2026-07-24 09:59:39 +00:00
Anders Eknert	64b079dea9	Various style fixes Submitting some miscellaneous changes I had locally. A few allocs saved, but mostly style fixes here, like simplifying known var/var equality using `==` and so on. Nothing controversial, or so I'd like to think :) Signed-off-by: Anders Eknert <anders.eknert@apple.com>	2026-07-24 10:15:07 +02:00
Sebastian Spaink	cf1d96ab49	repl: use a plain line reader for non-terminal input (#8941 ) Switching the REPL to reeflective/readline (#8882) dropped liner's fallback to a plain reader for non-terminal stdin. This made `opa run` with piped/redirected stdin spin at 100% CPU instead of exiting, and made the v1/runtime REPL tests flaky via leaked spinning goroutines. Loop now uses the readline editor only for a real terminal and a plain line reader (stops cleanly at EOF) otherwise, configurable via WithConsoleInput / Params.ConsoleInput. Signed-off-by: Sebastian Spaink <sebastianspaink@gmail.com>	2026-07-23 15:32:17 -05:00
Charlie Egan	2867db1526	build: get just the needed commits for CI (#8940 ) Signed-off-by: Charlie Egan <charlie_egan@apple.com>	2026-07-23 16:42:26 +00:00
Johan Fylling	3e41f4f678	ast: Support paren grouping of `and`/`or` expressions (#8924 ) Fixes: #8782 Signed-off-by: Johan Fylling <johan.dev@fylling.se>	2026-07-23 17:25:42 +02:00
Sebastian Spaink	02ea7b7dc2	repl: Enable bracketed paste to fix pasted tabs (#8882 ) Fixes: #962 Pasting a snippet containing a tab into the REPL triggered tab-completion on the pasted tab, corrupting the input (e.g. injecting a completion candidate mid-line and producing a spurious parse error). Spaces were unaffected, so the bug only surfaced with tab-indented pastes. The fix is bracketed paste: with it enabled, a terminal wraps pasted text in paste markers and the line-reader inserts it literally instead of treating an embedded tab as a completion request. The previous reader, peterh/liner, has no bracketed-paste support and is unmaintained (last release 2021; the same fix was proposed upstream in peterh/liner#114 in 2019 with no traction), so this replaces it with reeflective/readline, which supports bracketed paste, completion, and history. OPA's existing multi-line buffering (the r.buffer parse-retry mechanism) is kept as-is; readline's native multi-line editing is left disabled to avoid changing REPL behavior. --------- Signed-off-by: Sebastian Spaink <sebastianspaink@gmail.com>	2026-07-23 14:42:50 +00:00
Sebastian Spaink	5f986bcfda	ast: fix aliased comment buffer in annotation parser (#8925 ) Fixes: #8757 The pooled metadataParser reuses its comment slice across METADATA blocks, and Parse stored it on the Annotations without copying. A later block's parse then overwrote an earlier annotation's comments, corrupting its EndLoc. opa build --optimize=1 prunes comments by each annotation's row range, so a corrupted EndLoc dropped a METADATA block's body while keeping the bare "# METADATA" marker, yielding bundles that fail to parse on load. Clone the slice so each Annotations owns its comments. --------- Signed-off-by: Sebastian Spaink <sebastianspaink@gmail.com>	2026-07-22 14:14:35 +02:00
dependabot[bot]	89a1e7bdfb	build(deps): bump the dependencies group across 1 directory with 4 updates Bumps the dependencies group with 4 updates in the / directory: [github.com/dgraph-io/badger/v4](https://github.com/dgraph-io/badger), [github.com/vektah/gqlparser/v2](https://github.com/vektah/gqlparser), [golang.org/x/text](https://github.com/golang/text) and [google.golang.org/grpc](https://github.com/grpc/grpc-go). Updates `github.com/dgraph-io/badger/v4` from 4.9.2 to 4.9.4 - [Release notes](https://github.com/dgraph-io/badger/releases) - [Changelog](https://github.com/dgraph-io/badger/blob/main/CHANGELOG.md) - [Commits](https://github.com/dgraph-io/badger/compare/v4.9.2...v4.9.4) Updates `github.com/vektah/gqlparser/v2` from 2.5.35 to 2.5.36 - [Release notes](https://github.com/vektah/gqlparser/releases) - [Commits](https://github.com/vektah/gqlparser/compare/v2.5.35...v2.5.36) Updates `golang.org/x/text` from 0.38.0 to 0.40.0 - [Release notes](https://github.com/golang/text/releases) - [Commits](https://github.com/golang/text/compare/v0.38.0...v0.40.0) Updates `google.golang.org/grpc` from 1.81.1 to 1.82.0 - [Release notes](https://github.com/grpc/grpc-go/releases) - [Commits](https://github.com/grpc/grpc-go/compare/v1.81.1...v1.82.0) --- updated-dependencies: - dependency-name: github.com/dgraph-io/badger/v4 dependency-version: 4.9.4 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: dependencies - dependency-name: github.com/vektah/gqlparser/v2 dependency-version: 2.5.36 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: dependencies - dependency-name: golang.org/x/text dependency-version: 0.40.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: dependencies - dependency-name: google.golang.org/grpc dependency-version: 1.82.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: dependencies ... Signed-off-by: dependabot[bot] <support@github.com>	2026-07-22 11:23:09 +02:00
dependabot[bot]	b011c0dca4	build(deps): bump google.golang.org/grpc from 1.81.1 to 1.82.1 in /e2e Bumps [google.golang.org/grpc](https://github.com/grpc/grpc-go) from 1.81.1 to 1.82.1. - [Release notes](https://github.com/grpc/grpc-go/releases) - [Commits](https://github.com/grpc/grpc-go/compare/v1.81.1...v1.82.1) --- updated-dependencies: - dependency-name: google.golang.org/grpc dependency-version: 1.82.1 dependency-type: indirect ... Signed-off-by: dependabot[bot] <support@github.com>	2026-07-22 11:01:54 +02:00
dependabot[bot]	6c51a0bf3a	build(deps): bump @hono/node-server and prisma in /e2e/api/compile/prisma (#8931 ) Removes [@hono/node-server](https://github.com/honojs/node-server). It's no longer used after updating ancestor dependency [prisma](https://github.com/prisma/prisma/tree/HEAD/packages/cli). These dependencies need to be updated together. Removes `@hono/node-server` Updates `prisma` from 7.8.0 to 7.9.0 <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/prisma/prisma/releases">prisma's releases</a>.</em></p> <blockquote> <h2>7.9.0</h2> <p>Today, we are excited to share the <code>7.9.0</code> stable release 🎉</p> <p><strong>🌟 Star this repo for notifications about new releases, bug fixes & features — or <a href="https://pris.ly/x">follow us on X</a>!</strong></p> <h1>Highlights</h1> <h2>ORM</h2> <h3>Tab completions for the Prisma CLI</h3> <p>Typing out CLI commands from memory is now optional. Prisma ships <strong>shell tab completions</strong> for <code>bash</code>, <code>zsh</code>, <code>fish</code>, and PowerShell, covering commands, subcommands, options, flags, and even option values.</p> <p><strong>Setting it up.</strong> Most projects run Prisma through a package manager, so completions are enabled through <code>@bomb.sh/tab</code>'s package-manager integration — install it once, then source the completion for your package manager and shell:</p> <pre lang="bash"><code># 1. Install @bomb.sh/tab globally npm install -g @bomb.sh/tab <h1>2. Wire up your package manager + shell (pnpm shown; swap in npm / yarn / bun):</h1> <p>echo 'source <(tab pnpm zsh)' >> ~/.zshrc # zsh<br /> echo 'source <(tab pnpm bash)' >> ~/.bashrc # bash<br /> tab pnpm fish > ~/.config/fish/completions/pnpm.fish # fish<br /> tab pnpm powershell > ~/.tab-pnpm.ps1 # PowerShell (then dot-source it from $PROFILE)<br /> </code></pre></p> <p><code>@bomb.sh/tab</code> delegates to any locally-installed CLI that ships completions, so <code>pnpm prisma <TAB></code>, <code>pnpm exec prisma <TAB></code>, <code>yarn prisma <TAB></code>, and <code>bun x prisma <TAB></code> all complete Prisma's commands, options, and values — no per-project setup. (<code>npx</code> and <code>bunx</code> don't support completion themselves; use <code>npm exec</code> and <code>bun x</code>.)</p> <p>If instead you have Prisma installed globally on your <code>PATH</code>, source its own completion directly: <code>source <(prisma complete zsh)</code> (or the <code>bash</code> / <code>fish</code> / <code>powershell</code> variant).</p> <p>This is built on <a href="https://github.com/bombshell-dev/tab/"><code>@bomb.sh/tab</code></a>, the same completion library that powers other CLIs in the ecosystem — including Cloudflare, Nuxt, and Vitest — so the package-manager completions you enable for Prisma work for those tools too. A wonderful community contribution from <a href="https://github.com/AmirSa12"><code>@AmirSa12</code></a> (<a href="https://redirect.github.com/prisma/prisma/pull/28351">#28351</a>) — thank you!</p> <p><a href="https://github.com/user-attachments/assets/1f916a60-ee4d-40be-bb7d-74035d48ca83">https://github.com/user-attachments/assets/1f916a60-ee4d-40be-bb7d-74035d48ca83</a></p> <h3>Prisma ORM, ready for AI agents</h3> <p>Coding agents are now a first-class audience for Prisma, and 7.9.0 brings the first wave of work to make Prisma projects safe and productive for them to work in.</p> <p><strong>Agent skills installed with <code>prisma init</code></strong> (<a href="https://redirect.github.com/prisma/prisma/pull/29689">#29689</a>)</p> <p><code>prisma init</code> now installs the <a href="https://github.com/prisma/skills">prisma/skills</a> catalog into freshly scaffolded projects. Agents such as Claude Code, Cursor, Codex, and Windsurf start out with current, version-relevant Prisma knowledge instead of relying on whatever happened to be in their training data. The install is best-effort and never blocks scaffolding; opt out at any time with <code>--no-skills</code>.</p> <pre lang="terminal"><code>npx prisma@latest init </code></pre> <p><img src="https://github.com/user-attachments/assets/8244a6dc-cdad-4028-a652-bb5ac6e4b271" alt="prisma init scaffolds a project and installs the Prisma agent skills catalog" /></p> <p><strong>A safer default around destructive commands</strong> (<a href="https://redirect.github.com/prisma/prisma/pull/29684">#29684</a>, <a href="https://redirect.github.com/prisma/prisma/pull/29691">#29691</a>, <a href="https://redirect.github.com/prisma/prisma/pull/29713">#29713</a>)</p> <!-- raw HTML omitted --> </blockquote> <p>... (truncated)</p> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/prisma/prisma/commit/537583cedbab5a51a9c39405d8e7e18bd9a44c97"><code>537583c</code></a> feat(cli): add <code>@bomb.sh/tab</code> completions (<a href="https://github.com/prisma/prisma/tree/HEAD/packages/cli/issues/28351">#28351</a>)</li> <li><a href="https://github.com/prisma/prisma/commit/bf7c40f9b1828a0187363096c3d9f83b1b3c8a25"><code>bf7c40f</code></a> fix(cli): update Studio to 0.33.0 and suppress aborted response errors (<a href="https://github.com/prisma/prisma/tree/HEAD/packages/cli/issues/29720">#29720</a>)</li> <li><a href="https://github.com/prisma/prisma/commit/9acd8dcdc9395df8f8c4de241b8cfbfd2da227e9"><code>9acd8dc</code></a> feat(cli): install Prisma agent skills during prisma init (<a href="https://github.com/prisma/prisma/tree/HEAD/packages/cli/issues/29689">#29689</a>)</li> <li><a href="https://github.com/prisma/prisma/commit/aef8cb57f395f1d3499d8c472f44306a63cd4aa7"><code>aef8cb5</code></a> fix(cli): remove the migrate-reset tool from the MCP server (<a href="https://github.com/prisma/prisma/tree/HEAD/packages/cli/issues/29691">#29691</a>)</li> <li><a href="https://github.com/prisma/prisma/commit/cdca3335b392483aeb4ee5483cda436e4aaffb1a"><code>cdca333</code></a> chore(deps): update <code>@prisma/dev</code> to 0.24.14 (<a href="https://github.com/prisma/prisma/tree/HEAD/packages/cli/issues/29686">#29686</a>)</li> <li><a href="https://github.com/prisma/prisma/commit/fda8fbce23b3af6b1651bd539da09e62c863ed6e"><code>fda8fbc</code></a> chore(deps): bump <code>@prisma/dev</code> to 0.24.9 (resolves hono GHSA-92pp-h63x-v22m) (...</li> <li>See full diff in <a href="https://github.com/prisma/prisma/commits/7.9.0/packages/cli">compare view</a></li> </ul> </details> <br /> Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>	2026-07-21 17:19:45 -05:00
dependabot[bot]	564a187c1f	build(deps): bump fast-uri from 3.1.2 to 3.1.4 in /docs (#8930 ) Bumps [fast-uri](https://github.com/fastify/fast-uri) from 3.1.2 to 3.1.4. <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/fastify/fast-uri/releases">fast-uri's releases</a>.</em></p> <blockquote> <h2>v3.1.4</h2> <h2>⚠️ Security Release</h2> <p>Fix for <a href="https://github.com/fastify/fast-uri/security/advisories/GHSA-v2hh-gcrm-f6hx">https://github.com/fastify/fast-uri/security/advisories/GHSA-v2hh-gcrm-f6hx</a></p> <p><strong>Full Changelog</strong>: <a href="https://github.com/fastify/fast-uri/compare/v3.1.3...v3.1.4">https://github.com/fastify/fast-uri/compare/v3.1.3...v3.1.4</a></p> <h2>v3.1.3</h2> <h2>⚠️ Security Release</h2> <ul> <li>Fixes: <a href="https://github.com/fastify/fast-uri/security/advisories/GHSA-4c8g-83qw-93j6">https://github.com/fastify/fast-uri/security/advisories/GHSA-4c8g-83qw-93j6</a></li> </ul> <p><strong>Full Changelog</strong>: <a href="https://github.com/fastify/fast-uri/compare/v3.1.2...v3.1.3">https://github.com/fastify/fast-uri/compare/v3.1.2...v3.1.3</a></p> </blockquote> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/fastify/fast-uri/commit/6aeece669e4166b2446a89f17c07a3b15dfb7ed4"><code>6aeece6</code></a> Bumped v3.1.4</li> <li><a href="https://github.com/fastify/fast-uri/commit/2d50fbabc80e4d0884fe0f6a98fe118ce6faa353"><code>2d50fba</code></a> fix: reject literal backslash in URI authority</li> <li><a href="https://github.com/fastify/fast-uri/commit/0549fe35b0d482233f3be2816439f3ec803603fa"><code>0549fe3</code></a> Bumped v3.1.3</li> <li><a href="https://github.com/fastify/fast-uri/commit/2a6d357a18a68e6d812824379fd3388a1ae50d05"><code>2a6d357</code></a> Merge commit from fork</li> <li>See full diff in <a href="https://github.com/fastify/fast-uri/compare/v3.1.2...v3.1.4">compare view</a></li> </ul> </details> <br /> [![Dependabot compatibility score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=fast-uri&package-manager=npm_and_yarn&previous-version=3.1.2&new-version=3.1.4)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself) You can disable automated security fix PRs for this repo from the [Security Alerts page](https://github.com/open-policy-agent/opa/network/alerts). </details> Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>	2026-07-21 16:20:04 -05:00
dependabot[bot]	16b238da79	build(deps): bump dompurify from 3.4.11 to 3.4.12 in /docs (#8929 ) Bumps [dompurify](https://github.com/cure53/DOMPurify) from 3.4.11 to 3.4.12. <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/cure53/DOMPurify/releases">dompurify's releases</a>.</em></p> <blockquote> <h2>DOMPurify 3.4.12</h2> <ul> <li>Fixed an issue where a hook would not get called for custom elements, thanks <a href="https://github.com/Rikuxx0"><code>@Rikuxx0</code></a></li> <li>Hardened the handling of hooks removing elements, <a href="https://github.com/mkrause-bee360"><code>@mkrause-bee360</code></a></li> <li>Added support for a few new SVG attributes, thanks <a href="https://github.com/cbn-falias"><code>@cbn-falias</code></a> & <a href="https://github.com/Develop-KIM"><code>@Develop-KIM</code></a></li> <li>Hardened the handling of declarative partial updates</li> <li>Updated the documentation is several spots, README, wiki, etc.</li> <li>Bumped several dependencies where possible</li> </ul> </blockquote> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/cure53/DOMPurify/commit/a9ca1e537422319a557a9a2aa61f003b23b4a197"><code>a9ca1e5</code></a> release: 3.4.12 (<a href="https://redirect.github.com/cure53/DOMPurify/issues/1537">#1537</a>)</li> <li>See full diff in <a href="https://github.com/cure53/DOMPurify/compare/3.4.11...3.4.12">compare view</a></li> </ul> </details> <br /> [![Dependabot compatibility score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=dompurify&package-manager=npm_and_yarn&previous-version=3.4.11&new-version=3.4.12)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself) You can disable automated security fix PRs for this repo from the [Security Alerts page](https://github.com/open-policy-agent/opa/network/alerts). </details> Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>	2026-07-21 16:19:50 -05:00
dependabot[bot]	522a91ed63	build(deps): bump svgo from 3.3.3 to 3.3.4 in /docs (#8928 ) Bumps [svgo](https://github.com/svg/svgo) from 3.3.3 to 3.3.4. <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/svg/svgo/releases">svgo's releases</a>.</em></p> <blockquote> <h2>v3.3.4</h2> <h2>What's Changed</h2> <h3>Security</h3> <ul> <li><a href="https://svgo.dev/docs/plugins/removeScripts/">removeScriptElement</a>, remove JavaScript URIs case-insensitively and make <code><script></code> handling namespace aware. By <a href="https://github.com/SethFalco"><code>@SethFalco</code></a></li> </ul> <h2>Support</h2> <p>SVGO v3 is not officially supported, please consider upgrading to SVGO v4 instead. We've backported this fix as there are security implications, but there is no commitment to do this for more complex changes in future.</p> <p>Consider reading our <a href="https://svgo.dev/docs/migrations/migration-from-v3-to-v4/">Migration Guide from v3 to v4</a> which should ease the process.</p> </blockquote> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/svg/svgo/commit/72a23886b4698b27624b936f3a15a80afd36d75f"><code>72a2388</code></a> Merge commit from fork</li> <li>See full diff in <a href="https://github.com/svg/svgo/compare/v3.3.3...v3.3.4">compare view</a></li> </ul> </details> <br /> [![Dependabot compatibility score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=svgo&package-manager=npm_and_yarn&previous-version=3.3.3&new-version=3.3.4)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself) You can disable automated security fix PRs for this repo from the [Security Alerts page](https://github.com/open-policy-agent/opa/network/alerts). </details> Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>	2026-07-21 16:19:31 -05:00
dependabot[bot]	ea379447ad	build(deps): bump hono from 4.12.25 to 4.12.31 in /e2e/api/compile/prisma (#8926 ) Bumps [hono](https://github.com/honojs/hono) from 4.12.25 to 4.12.31. <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/honojs/hono/releases">hono's releases</a>.</em></p> <blockquote> <h2>v4.12.31</h2> <h2>What's Changed</h2> <ul> <li>test(context): assert case-insensitive header names in response helpers by <a href="https://github.com/yusukebe"><code>@yusukebe</code></a> in <a href="https://redirect.github.com/honojs/hono/pull/5116">honojs/hono#5116</a></li> <li>chore(benchmark): add app.fetch() overhead benchmark by <a href="https://github.com/yusukebe"><code>@yusukebe</code></a> in <a href="https://redirect.github.com/honojs/hono/pull/5117">honojs/hono#5117</a></li> <li>refactor(aws-lambada): remove FIXME in <code>@ts-expect-error</code> by <a href="https://github.com/yusukebe"><code>@yusukebe</code></a> in <a href="https://redirect.github.com/honojs/hono/pull/5130">honojs/hono#5130</a></li> <li>fix(utils/body): reuse cached formData in <code>parseBody()</code> by <a href="https://github.com/yusukebe"><code>@yusukebe</code></a> in <a href="https://redirect.github.com/honojs/hono/pull/5131">honojs/hono#5131</a></li> <li>fix(request): fix multipart boundary mismatch in <code>cloneRawRequest</code> by <a href="https://github.com/yusukebe"><code>@yusukebe</code></a> in <a href="https://redirect.github.com/honojs/hono/pull/5133">honojs/hono#5133</a></li> <li>fix(sse): emit retry feild when retry is <code>0</code> by <a href="https://github.com/yusukebe"><code>@yusukebe</code></a> in <a href="https://redirect.github.com/honojs/hono/pull/5135">honojs/hono#5135</a></li> <li>test(validator): fix misspelled identifier in transform type test by <a href="https://github.com/yusukebe"><code>@yusukebe</code></a> in <a href="https://redirect.github.com/honojs/hono/pull/5136">honojs/hono#5136</a></li> </ul> <p><strong>Full Changelog</strong>: <a href="https://github.com/honojs/hono/compare/v4.12.30...v4.12.31">https://github.com/honojs/hono/compare/v4.12.30...v4.12.31</a></p> <h2>v4.12.30</h2> <h2>What's Changed</h2> <ul> <li>chore(benchmark/routers): bump deps in <a href="https://redirect.github.com/honojs/hono/pull/5107">honojs/hono#5107</a></li> <li>chore(benchmark): remove not used benchmarks in <a href="https://redirect.github.com/honojs/hono/pull/5108">honojs/hono#5108</a></li> <li>chore: update to ts6 in prep for ts7 in <a href="https://redirect.github.com/honojs/hono/pull/5104">honojs/hono#5104</a></li> <li>fix(cache): deduplicate Cache-Control directives case-insensitively in <a href="https://redirect.github.com/honojs/hono/pull/5025">honojs/hono#5025</a></li> <li>fix(compress): do not compress 206 Partial Content responses in <a href="https://redirect.github.com/honojs/hono/pull/5020">honojs/hono#5020</a></li> <li>fix(client): replaceUrlParam should not match a param that prefixes another in <a href="https://redirect.github.com/honojs/hono/pull/5096">honojs/hono#5096</a></li> <li>fix(method-override): set duplex when forwarding a stream body in query mode in <a href="https://redirect.github.com/honojs/hono/pull/5110">honojs/hono#5110</a></li> </ul> <p><strong>Full Changelog</strong>: <a href="https://github.com/honojs/hono/compare/v4.12.29...v4.12.30">https://github.com/honojs/hono/compare/v4.12.29...v4.12.30</a></p> <h2>v4.12.29</h2> <h2>What's Changed</h2> <ul> <li>fix(client): merge function headers with per-request headers by <a href="https://github.com/yusukebe"><code>@yusukebe</code></a> in <a href="https://redirect.github.com/honojs/hono/pull/5092">honojs/hono#5092</a></li> <li>chore: fix no-op tsc in test script by <a href="https://github.com/yusukebe"><code>@yusukebe</code></a> in <a href="https://redirect.github.com/honojs/hono/pull/5093">honojs/hono#5093</a></li> <li>fix(lambda-edge): resolve the handler with the value passed to the callback by <a href="https://github.com/yusukebe"><code>@yusukebe</code></a> in <a href="https://redirect.github.com/honojs/hono/pull/5094">honojs/hono#5094</a></li> <li>docs(language): add JSDoc <a href="https://github.com/example"><code>@example</code></a> to languageDetector by <a href="https://github.com/codebybilal18"><code>@codebybilal18</code></a> in <a href="https://redirect.github.com/honojs/hono/pull/5081">honojs/hono#5081</a></li> <li>test(workerd): add <code>compatibilityDate</code> by <a href="https://github.com/yusukebe"><code>@yusukebe</code></a> in <a href="https://redirect.github.com/honojs/hono/pull/5100">honojs/hono#5100</a></li> <li>fix(lambda-edge): base64 encode content-encoded response bodies by <a href="https://github.com/yusukebe"><code>@yusukebe</code></a> in <a href="https://redirect.github.com/honojs/hono/pull/5099">honojs/hono#5099</a></li> <li>fix(aws-lambda): treat any non-identity content-encoding as binary by <a href="https://github.com/yusukebe"><code>@yusukebe</code></a> in <a href="https://redirect.github.com/honojs/hono/pull/5101">honojs/hono#5101</a></li> <li>fix(types): strip extra properties from array types in JSONParsed by <a href="https://github.com/Arman-Luthra"><code>@Arman-Luthra</code></a> in <a href="https://redirect.github.com/honojs/hono/pull/5103">honojs/hono#5103</a></li> <li>fix(trie-router): match empty wildcard remainder after regexp param by <a href="https://github.com/usualoma"><code>@usualoma</code></a> in <a href="https://redirect.github.com/honojs/hono/pull/5102">honojs/hono#5102</a></li> <li>fix(etag): treat If-None-Match: <code></code> as a match by <a href="https://github.com/yusukebe"><code>@yusukebe</code></a> in <a href="https://redirect.github.com/honojs/hono/pull/5084">honojs/hono#5084</a></li> </ul> <h2>New Contributors</h2> <ul> <li><a href="https://github.com/codebybilal18"><code>@codebybilal18</code></a> made their first contribution in <a href="https://redirect.github.com/honojs/hono/pull/5081">honojs/hono#5081</a></li> <li><a href="https://github.com/Arman-Luthra"><code>@Arman-Luthra</code></a> made their first contribution in <a href="https://redirect.github.com/honojs/hono/pull/5103">honojs/hono#5103</a></li> </ul> <p><strong>Full Changelog</strong>: <a href="https://github.com/honojs/hono/compare/v4.12.28...v4.12.29">https://github.com/honojs/hono/compare/v4.12.28...v4.12.29</a></p> <h2>v4.12.28</h2> <h2>What's Changed</h2> <ul> <li>fix(serve-static): treat empty string content as found by <a href="https://github.com/yusukebe"><code>@yusukebe</code></a> in <a href="https://redirect.github.com/honojs/hono/pull/5062">honojs/hono#5062</a></li> <li>docs(MIGRATION): fix req.raw.headers reference (property, not method) by <a href="https://github.com/EduardF1"><code>@EduardF1</code></a> in <a href="https://redirect.github.com/honojs/hono/pull/5047">honojs/hono#5047</a></li> <li>chore: don't publish <code>.tsbuildinfo</code> by <a href="https://github.com/yusukebe"><code>@yusukebe</code></a> in <a href="https://redirect.github.com/honojs/hono/pull/5066">honojs/hono#5066</a></li> <li>fix(utils/body,validator): normalize Content-Type media type for case-insensitive matching by <a href="https://github.com/yusukebe"><code>@yusukebe</code></a> in <a href="https://redirect.github.com/honojs/hono/pull/5067">honojs/hono#5067</a></li> <li>fix: avoid circular dependency between body.ts and request.ts by <a href="https://github.com/usualoma"><code>@usualoma</code></a> in <a href="https://redirect.github.com/honojs/hono/pull/5071">honojs/hono#5071</a></li> </ul> <!-- raw HTML omitted --> </blockquote> <p>... (truncated)</p> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/honojs/hono/commit/cadff88bba34153646c9b35f24d7cc0cb61be913"><code>cadff88</code></a> 4.12.31</li> <li><a href="https://github.com/honojs/hono/commit/64c613ab0f15526b0c0edb25ad0c2989eace2ea1"><code>64c613a</code></a> test(validator): fix misspelled identifier in transform type test (<a href="https://redirect.github.com/honojs/hono/issues/5136">#5136</a>)</li> <li><a href="https://github.com/honojs/hono/commit/aeba9ece778fb24953816fd3517858ff80de958f"><code>aeba9ec</code></a> fix(sse): emit retry feild when retry is <code>0</code> (<a href="https://redirect.github.com/honojs/hono/issues/5135">#5135</a>)</li> <li><a href="https://github.com/honojs/hono/commit/d7964503c956ae4af78597b7b11a05f9e5e73d2d"><code>d796450</code></a> fix(request): fix multipart boundary mismatch in <code>cloneRawRequest</code> (<a href="https://redirect.github.com/honojs/hono/issues/5133">#5133</a>)</li> <li><a href="https://github.com/honojs/hono/commit/80959d47d56ac18c2985336ad311917dc56497c5"><code>80959d4</code></a> fix(utils/body): reuse cached formData in <code>parseBody()</code> (<a href="https://redirect.github.com/honojs/hono/issues/5131">#5131</a>)</li> <li><a href="https://github.com/honojs/hono/commit/21b44b6db6118fc77fabb49832fc4cadd0ef8ec8"><code>21b44b6</code></a> refactor(aws-lambada): remove FIXME in <code>@ts-expect-error</code> (<a href="https://redirect.github.com/honojs/hono/issues/5130">#5130</a>)</li> <li><a href="https://github.com/honojs/hono/commit/5f738971b57b54077b9932fb7b916cf8517534a7"><code>5f73897</code></a> docs(combine): close quote in combine JSDoc example (<a href="https://redirect.github.com/honojs/hono/issues/5126">#5126</a>)</li> <li><a href="https://github.com/honojs/hono/commit/c285f9a498623fe0d2992b31c77b3738c0c0a54d"><code>c285f9a</code></a> chore(benchmark): add app.fetch() overhead benchmark (<a href="https://redirect.github.com/honojs/hono/issues/5117">#5117</a>)</li> <li><a href="https://github.com/honojs/hono/commit/fb9d7bf8fb0dd7b3c92a0c289d5dc685edf5f3a3"><code>fb9d7bf</code></a> test(context): assert case-insensitive header names in response helpers (<a href="https://redirect.github.com/honojs/hono/issues/5116">#5116</a>)</li> <li><a href="https://github.com/honojs/hono/commit/b2ae3a2204a48ce15a26448fd746d39745eb1837"><code>b2ae3a2</code></a> 4.12.30</li> <li>Additional commits viewable in <a href="https://github.com/honojs/hono/compare/v4.12.25...v4.12.31">compare view</a></li> </ul> </details> <details> <summary>Maintainer changes</summary> <p>This version was pushed to npm by <a href="https://www.npmjs.com/~GitHub%20Actions">GitHub Actions</a>, a new releaser for hono since your current version.</p> </details> <br /> [![Dependabot compatibility score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=hono&package-manager=npm_and_yarn&previous-version=4.12.25&new-version=4.12.31)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself) You can disable automated security fix PRs for this repo from the [Security Alerts page](https://github.com/open-policy-agent/opa/network/alerts). </details> Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>	2026-07-21 16:19:17 -05:00
dependabot[bot]	1a5a35eb13	build(deps): bump markdown-it and markdownlint-cli2 in /docs (#8923 ) Bumps [markdown-it](https://github.com/markdown-it/markdown-it) to 14.3.0 and updates ancestor dependency [markdownlint-cli2](https://github.com/DavidAnson/markdownlint-cli2). These dependencies need to be updated together. Updates `markdown-it` from 14.1.1 to 14.3.0 <details> <summary>Changelog</summary> <p><em>Sourced from <a href="https://github.com/markdown-it/markdown-it/blob/master/CHANGELOG.md">markdown-it's changelog</a>.</em></p> <blockquote> <h2>[14.3.0] - 2026-07-02</h2> <h3>Changed</h3> <ul> <li>Reworked build pipeline & tools.</li> <li>Added source maps.</li> <li>Bumped <code>linkify-it</code> to 5.0.2.</li> </ul> <h3>Fixed</h3> <ul> <li>Preserve backslash-space hard line breaks, matching CommonMark 6.7, <a href="https://redirect.github.com/markdown-it/markdown-it/issues/1185">#1185</a>.</li> </ul> <h2>[14.2.0] - 2026-05-24</h2> <h3>Added</h3> <ul> <li><code>isPunctCharCode</code> to utilities.</li> </ul> <h3>Fixed</h3> <ul> <li>Don't end HTML comment blocks on a blank line, <a href="https://redirect.github.com/markdown-it/markdown-it/issues/1155">#1155</a>.</li> <li>Properly recognize astral chars (surrogates) in delimiter scans for emphasis-like markers, <a href="https://redirect.github.com/markdown-it/markdown-it/issues/1072">#1072</a>. Big thanks to <a href="https://github.com/tats-u"><code>@tats-u</code></a> for his global efforts with improving CJK support.</li> <li>Preserve unicode whitespaces when trimm headings/paragraphs, <a href="https://redirect.github.com/markdown-it/markdown-it/issues/1074">#1074</a>.</li> <li>More strict entities decode to avoid false positives <code>;</code>, <a href="https://redirect.github.com/markdown-it/markdown-it/issues/1096">#1096</a>.</li> <li>Restore block parser state on fail in <code>lheading</code> rule, <a href="https://redirect.github.com/markdown-it/markdown-it/issues/1131">#1131</a>.</li> </ul> <h3>Security</h3> <ul> <li>Fixed poor smartquotes perfomance on > 70k quotes in single block</li> <li>Bumped linkify-it to 5.0.1 with fixed potential perfomance issues.</li> </ul> </blockquote> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/markdown-it/markdown-it/commit/ff0ee084fc6b0d10fac049fa562bc2925b5cc723"><code>ff0ee08</code></a> 14.3.0 released</li> <li><a href="https://github.com/markdown-it/markdown-it/commit/52e2749ab25aaf841bf74b50560929aa93b8e14d"><code>52e2749</code></a> Bump linkify-it / vite deps</li> <li><a href="https://github.com/markdown-it/markdown-it/commit/56c2404e6d3e78632ce7b37a95f289fc04330c76"><code>56c2404</code></a> fix: keep backslash-space hard line break (CommonMark 6.7) (<a href="https://redirect.github.com/markdown-it/markdown-it/issues/1185">#1185</a>)</li> <li><a href="https://github.com/markdown-it/markdown-it/commit/0fbb18b23145158a39255f7476c781dbce320a16"><code>0fbb18b</code></a> Bump vite from 8.0.14 to 8.0.16 (<a href="https://redirect.github.com/markdown-it/markdown-it/issues/1181">#1181</a>)</li> <li><a href="https://github.com/markdown-it/markdown-it/commit/83450e2bc3836ad9f68f652e5685031e9dce4897"><code>83450e2</code></a> Rework benchmark deps and bump versions</li> <li><a href="https://github.com/markdown-it/markdown-it/commit/57a68632ce317593fe316b7131105b131691b90b"><code>57a6863</code></a> benchmark => tinybench</li> <li><a href="https://github.com/markdown-it/markdown-it/commit/7608db19a5b14f84b47b34cced43c574b1abfd0c"><code>7608db1</code></a> Update CI config</li> <li><a href="https://github.com/markdown-it/markdown-it/commit/9d8eb42a72e0e576125733acc7ae6154e8f6cb5a"><code>9d8eb42</code></a> Added package-lock and updated versions to latest possible</li> <li><a href="https://github.com/markdown-it/markdown-it/commit/0aee70db5e8284c84201d39d64c2b14228fd280a"><code>0aee70d</code></a> lint: enable <code>@stylistic/no-multi-spaces</code> rule</li> <li><a href="https://github.com/markdown-it/markdown-it/commit/88789854dc44db99b7736fd4349487dfda0d4067"><code>8878985</code></a> lint => neostandard</li> <li>Additional commits viewable in <a href="https://github.com/markdown-it/markdown-it/compare/14.1.1...14.3.0">compare view</a></li> </ul> </details> <br /> Updates `markdownlint-cli2` from 0.22.1 to 0.23.1 <details> <summary>Changelog</summary> <p><em>Sourced from <a href="https://github.com/DavidAnson/markdownlint-cli2/blob/main/CHANGELOG.md">markdownlint-cli2's changelog</a>.</em></p> <blockquote> <h2>0.23.1</h2> <ul> <li>Show attempted fix counts after fixing</li> <li>Update dependencies (including <code>markdownlint</code>)</li> </ul> <h2>0.23.0</h2> <ul> <li>Add <code>overrides</code> configuration option</li> <li>Improve options/configuration file handling</li> <li>Update dependencies (including <code>markdownlint</code>)</li> <li>Remove support for end-of-life Node 20</li> </ul> </blockquote> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/DavidAnson/markdownlint-cli2/commit/06f92c99e930c11230426b5edd775021d25e08a8"><code>06f92c9</code></a> Update to version 0.23.1.</li> <li><a href="https://github.com/DavidAnson/markdownlint-cli2/commit/a77352640f8667a658349c68d14db1368c6b22ba"><code>a773526</code></a> Freshen list of external custom rules included with the markdownlint-cli2-rul...</li> <li><a href="https://github.com/DavidAnson/markdownlint-cli2/commit/437b0caae2b2f39d061309567f99f9c23eb1f1e5"><code>437b0ca</code></a> Bump eslint-plugin-jsdoc from 63.0.11 to 63.0.12</li> <li><a href="https://github.com/DavidAnson/markdownlint-cli2/commit/5463e0fa275b9105ed02dbae9ea6848d062d1c1e"><code>5463e0f</code></a> Bump eslint-plugin-unicorn from 70.0.0 to 71.0.0</li> <li><a href="https://github.com/DavidAnson/markdownlint-cli2/commit/b04ac138a26acc3f65a5e5482825cc938885b7b9"><code>b04ac13</code></a> Bump globby from 16.2.0 to 16.2.1</li> <li><a href="https://github.com/DavidAnson/markdownlint-cli2/commit/1e63f97b080fc2aac9a426379e96e82542cf78a8"><code>1e63f97</code></a> Revert commit afb7d9898724f0d96279116bbb6f0d1026fff8df "Pin CI workflow's pnp...</li> <li><a href="https://github.com/DavidAnson/markdownlint-cli2/commit/040594ba722e8d319c2e172bf9771d1ba8474d51"><code>040594b</code></a> Update dependency: markdownlint to 0.41.1.</li> <li><a href="https://github.com/DavidAnson/markdownlint-cli2/commit/4d97fa85a1eff2af23011c7f4838738332847f64"><code>4d97fa8</code></a> Address new ESLint warnings from previous commit.</li> <li><a href="https://github.com/DavidAnson/markdownlint-cli2/commit/50cb033a960853cde873c8895849cae94e9f0db7"><code>50cb033</code></a> Bump eslint-node-test from 0.1.0 to 0.2.0</li> <li><a href="https://github.com/DavidAnson/markdownlint-cli2/commit/a53bf04386f8980a027bbb2ed198a5361dbe2b55"><code>a53bf04</code></a> Bump eslint-plugin-jsdoc from 63.0.10 to 63.0.11</li> <li>Additional commits viewable in <a href="https://github.com/DavidAnson/markdownlint-cli2/compare/v0.22.1...v0.23.1">compare view</a></li> </ul> </details> <br /> Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself) You can disable automated security fix PRs for this repo from the [Security Alerts page](https://github.com/open-policy-agent/opa/network/alerts). </details> Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>	2026-07-21 15:50:21 -05:00
dependabot[bot]	5266415db0	build(deps): bump webpack-dev-server from 5.2.5 to 5.2.6 in /docs (#8922 ) Bumps [webpack-dev-server](https://github.com/webpack/webpack-dev-server) from 5.2.5 to 5.2.6. <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/webpack/webpack-dev-server/releases">webpack-dev-server's releases</a>.</em></p> <blockquote> <h2>v5.2.6</h2> <h3>Patch Changes</h3> <ul> <li> <p>fix: allow <code>undefined</code> as the <code>Server</code> constructor <code>options</code> argument again (by <a href="https://github.com/bjohansebas"><code>@bjohansebas</code></a> in <a href="https://redirect.github.com/webpack/webpack-dev-server/pull/5695">#5695</a>)</p> <p>Restores accepting <code>undefined</code> (defaulting it to <code>{}</code>) for the <code>options</code> argument, so passing a webpack config's optional <code>devServer</code> field type-checks and works as before.</p> </li> <li> <p>Protect the built-in state-changing routes (<code>/webpack-dev-server/invalidate</code> and <code>/webpack-dev-server/open-editor</code>) against cross-site request forgery. Requests are now checked with <code>Sec-Fetch-Site</code> (falling back to an <code>Origin</code>/<code>Host</code> comparison when it is absent), so a cross-site page can no longer trigger a rebuild or open a file in the editor. Same-origin requests, user-initiated navigations, and non-browser clients (e.g. curl) are unaffected. (by <a href="https://github.com/bjohansebas"><code>@bjohansebas</code></a> in <a href="https://redirect.github.com/webpack/webpack-dev-server/pull/5698">#5698</a>)</p> </li> <li> <p>Handle malformed <code>Host</code> and <code>Origin</code> header values gracefully when validating requests. (by <a href="https://github.com/bjohansebas"><code>@bjohansebas</code></a> in <a href="https://redirect.github.com/webpack/webpack-dev-server/pull/5699">#5699</a>)</p> </li> </ul> </blockquote> </details> <details> <summary>Changelog</summary> <p><em>Sourced from <a href="https://github.com/webpack/webpack-dev-server/blob/v5.2.6/CHANGELOG.md">webpack-dev-server's changelog</a>.</em></p> <blockquote> <h2>5.2.6</h2> <h3>Patch Changes</h3> <ul> <li> <p>fix: allow <code>undefined</code> as the <code>Server</code> constructor <code>options</code> argument again (by <a href="https://github.com/bjohansebas"><code>@bjohansebas</code></a> in <a href="https://redirect.github.com/webpack/webpack-dev-server/pull/5695">#5695</a>)</p> <p>Restores accepting <code>undefined</code> (defaulting it to <code>{}</code>) for the <code>options</code> argument, so passing a webpack config's optional <code>devServer</code> field type-checks and works as before.</p> </li> <li> <p>Protect the built-in state-changing routes (<code>/webpack-dev-server/invalidate</code> and <code>/webpack-dev-server/open-editor</code>) against cross-site request forgery. Requests are now checked with <code>Sec-Fetch-Site</code> (falling back to an <code>Origin</code>/<code>Host</code> comparison when it is absent), so a cross-site page can no longer trigger a rebuild or open a file in the editor. Same-origin requests, user-initiated navigations, and non-browser clients (e.g. curl) are unaffected. (by <a href="https://github.com/bjohansebas"><code>@bjohansebas</code></a> in <a href="https://redirect.github.com/webpack/webpack-dev-server/pull/5698">#5698</a>)</p> </li> <li> <p>Handle malformed <code>Host</code> and <code>Origin</code> header values gracefully when validating requests. (by <a href="https://github.com/bjohansebas"><code>@bjohansebas</code></a> in <a href="https://redirect.github.com/webpack/webpack-dev-server/pull/5699">#5699</a>)</p> </li> </ul> </blockquote> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/webpack/webpack-dev-server/commit/8a37b0ed89d07ca81532188fe19f080a2ee51475"><code>8a37b0e</code></a> chore(release): new release (<a href="https://redirect.github.com/webpack/webpack-dev-server/issues/5697">#5697</a>)</li> <li><a href="https://github.com/webpack/webpack-dev-server/commit/f21ed0f44aceb6132abb591ee8b60d770b6e489f"><code>f21ed0f</code></a> fix: handle malformed Host and Origin headers (<a href="https://redirect.github.com/webpack/webpack-dev-server/issues/5699">#5699</a>)</li> <li><a href="https://github.com/webpack/webpack-dev-server/commit/80cd9eea54975fe632a518d8bd902a260f374e7c"><code>80cd9ee</code></a> fix: reject cross-site requests to open-editor and invalidate endpoints (<a href="https://redirect.github.com/webpack/webpack-dev-server/issues/5698">#5698</a>)</li> <li><a href="https://github.com/webpack/webpack-dev-server/commit/308e853808fc8f5d0722276e1a87aa73c91859a5"><code>308e853</code></a> fix: handle undefined options in Server constructor (<a href="https://redirect.github.com/webpack/webpack-dev-server/issues/5695">#5695</a>)</li> <li><a href="https://github.com/webpack/webpack-dev-server/commit/8b2b9151f41e0d6157c8bd051cf5f16bce5dba17"><code>8b2b915</code></a> chore: update branch references from v4 to v5 in workflow configuration</li> <li><a href="https://github.com/webpack/webpack-dev-server/commit/870ed2258dda612c8feeaf8d971afd08233696ad"><code>870ed22</code></a> chore: add v5 branch to release workflow triggers</li> <li>See full diff in <a href="https://github.com/webpack/webpack-dev-server/compare/v5.2.5...v5.2.6">compare view</a></li> </ul> </details> <br /> [![Dependabot compatibility score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=webpack-dev-server&package-manager=npm_and_yarn&previous-version=5.2.5&new-version=5.2.6)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself) You can disable automated security fix PRs for this repo from the [Security Alerts page](https://github.com/open-policy-agent/opa/network/alerts). </details> Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>	2026-07-21 11:26:13 -05:00
Stephan Renatus	0def2cd01e	ast: fix panic when indexing composite literal values in `x in [...]` Building the rule index for `<ref> in <collection>` panicked with "illegal value" whenever the collection contained an object or set element (or an array nesting one), since updateMemberRefInValue inserts each collection element into the trie as-is, without restricting it to scalars/arrays like the equality-based indexing does. Such elements now fall back to the trie's "any" node, like an unbound Var: the rule stays a candidate for every input, and body evaluation determines the actual result. Other Value types considered (Ref, comprehensions, Call) can't actually reach the trie from compiled Rego, since the compiler rewrites them into separate statements before the index is built; verified this individually against `opa eval`, so the panic remains for them as a genuine invariant check. Fixes #8918. Signed-off-by: Stephan Renatus <stephan.renatus@gmail.com>	2026-07-21 18:21:14 +02:00
dependabot[bot]	33fc04b53a	build(deps): bump body-parser from 1.20.4 to 1.20.6 in /docs (#8920 ) Bumps [body-parser](https://github.com/expressjs/body-parser) from 1.20.4 to 1.20.6. <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/expressjs/body-parser/releases">body-parser's releases</a>.</em></p> <blockquote> <h2>1.20.6</h2> <h2>Important: Security</h2> <ul> <li>Security fix for <a href="https://www.cve.org/CVERecord?id=CVE-2025-13466">CVE-2026-12590</a> (<a href="https://github.com/expressjs/body-parser/security/advisories/GHSA-v422-hmwv-36x6">GHSA-v422-hmwv-36x6</a>)</li> </ul> <h2>What's Changed</h2> <ul> <li>fix: improve limit option validation by <a href="https://github.com/Phillip9587"><code>@Phillip9587</code></a> in <a href="https://redirect.github.com/expressjs/body-parser/pull/741">expressjs/body-parser#741</a></li> </ul> <p><strong>Full Changelog</strong>: <a href="https://github.com/expressjs/body-parser/compare/1.20.5...1.20.6">https://github.com/expressjs/body-parser/compare/1.20.5...1.20.6</a></p> <h2>v1.20.5</h2> <h2>What's Changed</h2> <p>The reason for this release is a fix to the extended urlencoded parser returning objects instead of arrays for large array inputs (> 100) on qs@6.14.2+. (<a href="https://redirect.github.com/expressjs/body-parser/pull/716">expressjs/body-parser#716</a>)</p> <ul> <li>refactor(json): simplify strict mode error string construction by <a href="https://github.com/jonchurch"><code>@jonchurch</code></a> in <a href="https://redirect.github.com/expressjs/body-parser/pull/692">expressjs/body-parser#692</a></li> <li>fix: correct off-by-one error in parameterCount by <a href="https://github.com/abhu85"><code>@abhu85</code></a> in <a href="https://redirect.github.com/expressjs/body-parser/pull/716">expressjs/body-parser#716</a></li> <li>deps(qs): bump qs to 6.15.1 by <a href="https://github.com/jonchurch"><code>@jonchurch</code></a> in <a href="https://redirect.github.com/expressjs/body-parser/pull/722">expressjs/body-parser#722</a></li> <li>Release: 1.20.5 by <a href="https://github.com/jonchurch"><code>@jonchurch</code></a> in <a href="https://redirect.github.com/expressjs/body-parser/pull/721">expressjs/body-parser#721</a></li> </ul> <h2>New Contributors</h2> <ul> <li><a href="https://github.com/abhu85"><code>@abhu85</code></a> made their first contribution in <a href="https://redirect.github.com/expressjs/body-parser/pull/716">expressjs/body-parser#716</a></li> </ul> <p>Special thanks to triager <a href="https://github.com/krzysdz"><code>@krzysdz</code></a> for keeping this on our radar and effectively triaging the specific issue!</p> <p><strong>Full Changelog</strong>: <a href="https://github.com/expressjs/body-parser/compare/1.20.4...1.20.5">https://github.com/expressjs/body-parser/compare/1.20.4...1.20.5</a></p> </blockquote> </details> <details> <summary>Changelog</summary> <p><em>Sourced from <a href="https://github.com/expressjs/body-parser/blob/master/HISTORY.md">body-parser's changelog</a>.</em></p> <blockquote> <h1>1.20.6 / 2026-07-09</h1> <ul> <li>Security fix for <a href="https://github.com/expressjs/body-parser/security/advisories/GHSA-v422-hmwv-36x6">GHSA-v422-hmwv-36x6</a></li> <li>fix: improve <code>limit</code> option validation (<a href="https://redirect.github.com/expressjs/body-parser/issues/698">#698</a>) <ul> <li>Invalid <code>limit</code> values (e.g. unparseable strings or <code>NaN</code>) now throw instead of being silently ignored, which previously disabled size limit enforcement</li> <li><code>null</code> and <code>undefined</code> fall back to the default 100kb limit</li> </ul> </li> </ul> <h1>1.20.5 / 2026-04-24</h1> <ul> <li>refactor(json): simplify strict mode error string construction</li> <li>fix: extended urlencoded parsing of arrays with >100 elements (<a href="https://redirect.github.com/expressjs/body-parser/issues/716">#716</a>)</li> <li>deps: qs@~6.15.1</li> <li></li> </ul> </blockquote> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/expressjs/body-parser/commit/5cc4fb8867c93a3aa4455927e38858c9ab89ff43"><code>5cc4fb8</code></a> 1.20.6 (<a href="https://redirect.github.com/expressjs/body-parser/issues/746">#746</a>)</li> <li><a href="https://github.com/expressjs/body-parser/commit/3492672eee593d5c158f239b6e9115498a5dbeac"><code>3492672</code></a> fix: improve limit option validation (<a href="https://redirect.github.com/expressjs/body-parser/issues/741">#741</a>)</li> <li><a href="https://github.com/expressjs/body-parser/commit/0defdbe7f95ad0d3bc007d3a7c59c8c0ab9e6575"><code>0defdbe</code></a> release(patch): 1.20.5</li> <li><a href="https://github.com/expressjs/body-parser/commit/cd0e7a000c53e7be7262d303e57a352b6a00db7f"><code>cd0e7a0</code></a> deps(qs): bump qs to 6.15.1</li> <li><a href="https://github.com/expressjs/body-parser/commit/6f24d7e8bcd9860b136920926ce86da1a7dd1d51"><code>6f24d7e</code></a> fix: correct off-by-one error in parameterCount (<a href="https://redirect.github.com/expressjs/body-parser/issues/716">#716</a>)</li> <li><a href="https://github.com/expressjs/body-parser/commit/b849bd533d8b4abf5576a3e301f28d9befa05ddd"><code>b849bd5</code></a> deps: qs@~6.14.1 (<a href="https://redirect.github.com/expressjs/body-parser/issues/690">#690</a>)</li> <li><a href="https://github.com/expressjs/body-parser/commit/2c55e2f712f320a8e8d0f9fcb1d06526d0e401c9"><code>2c55e2f</code></a> refactor(json): simplify strict mode error string construction (<a href="https://redirect.github.com/expressjs/body-parser/issues/692">#692</a>)</li> <li>See full diff in <a href="https://github.com/expressjs/body-parser/compare/1.20.4...1.20.6">compare view</a></li> </ul> </details> <br /> [![Dependabot compatibility score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=body-parser&package-manager=npm_and_yarn&previous-version=1.20.4&new-version=1.20.6)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself) You can disable automated security fix PRs for this repo from the [Security Alerts page](https://github.com/open-policy-agent/opa/network/alerts). </details> Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>	2026-07-21 11:15:54 -05:00
dependabot[bot]	bf3769c64f	build(deps): bump shell-quote from 1.8.4 to 1.10.0 in /docs (#8921 ) Bumps [shell-quote](https://github.com/ljharb/shell-quote) from 1.8.4 to 1.10.0. <details> <summary>Changelog</summary> <p><em>Sourced from <a href="https://github.com/ljharb/shell-quote/blob/main/CHANGELOG.md">shell-quote's changelog</a>.</em></p> <blockquote> <h2><a href="https://github.com/ljharb/shell-quote/compare/v1.9.0...v1.10.0">v1.10.0</a> - 2026-07-10</h2> <h3>Merged</h3> <ul> <li>[New] <code>parse</code>: add opt-in <code>splitUnquoted</code> option for shell field-splitting of unquoted expansions <a href="https://redirect.github.com/ljharb/shell-quote/pull/1"><code>[#1](https://github.com/ljharb/shell-quote/issues/1)</code></a></li> </ul> <h3>Commits</h3> <ul> <li>[Fix] <code>parse</code>: match nested <code>${...}</code> braces so nested parameter expansion is consumed as one substitution <a href="https://github.com/ljharb/shell-quote/commit/c0842c8a7a034066da2496a75e91cbe500ff736c"><code>c0842c8</code></a></li> <li>[Tests] <code>parse</code>: pin single-quote literalness and unmatched-quote handling <a href="https://github.com/ljharb/shell-quote/commit/a0d03e35c8ede24016502c4433b8f5d6b3100a62"><code>a0d03e3</code></a></li> <li>[readme] remove the space in js code fences so evalmd evaluates them <a href="https://github.com/ljharb/shell-quote/commit/2116fa36aeea77fe8d561b0db46b1f9b26b8cf1b"><code>2116fa3</code></a></li> <li>[Tests] <code>quote</code>: pin conservative escaping of <code>=</code>, <code>@</code>, <code>^</code>, <code>,</code>, <code>:</code>, <code>!</code> (<a href="https://redirect.github.com/ljharb/shell-quote/issues/11">#11</a>) <a href="https://github.com/ljharb/shell-quote/commit/1c36f3ff77d26d200620c1027e5c271050120b8e"><code>1c36f3f</code></a></li> <li>[readme] document that <code>quote</code> outputs POSIX quoting, not <code>cmd.exe</code>/PowerShell <a href="https://github.com/ljharb/shell-quote/commit/100e96e0ffadcca97d63dda15651c70b9f83507c"><code>100e96e</code></a></li> <li>[readme] document <code>parse</code>'s supported parameter-expansion subset <a href="https://github.com/ljharb/shell-quote/commit/e1c75cd6e4a3c60003792c7f2802587d328622cb"><code>e1c75cd</code></a></li> <li>[Fix] <code>parse</code>: a backslash inside single quotes must not escape the closing quote <a href="https://github.com/ljharb/shell-quote/commit/5d460a332b54b83153297fe7d1964330b28fa491"><code>5d460a3</code></a></li> <li>[readme] fix stale example outputs <a href="https://github.com/ljharb/shell-quote/commit/2de86f5d44f44d3ac9df36413d8a05f3534cdec6"><code>2de86f5</code></a></li> <li>[Tests] <code>quote</code>: pin that a backslash with whitespace is not doubled in single quotes (<a href="https://redirect.github.com/ljharb/shell-quote/issues/14">#14</a>) <a href="https://github.com/ljharb/shell-quote/commit/190e236bcf1d81caa8e40e8ea3bb11998575be71"><code>190e236</code></a></li> <li>[readme] <code>quote</code>: use output verbatim; do not re-quote it (<a href="https://redirect.github.com/ljharb/shell-quote/issues/11">#11</a>) <a href="https://github.com/ljharb/shell-quote/commit/1b364683b1e9e8d078fd3017cde82cf10c9c04a5"><code>1b36468</code></a></li> <li>[Refactor] <code>parse</code>: fix swapped <code>SINGLE_QUOTE</code>/<code>DOUBLE_QUOTE</code> variable names <a href="https://github.com/ljharb/shell-quote/commit/801af5c935b27d6dcda63b3975d5e92a7b6f887f"><code>801af5c</code></a></li> <li>[types] fix an error TS v6 ignores but v7 fails on <a href="https://github.com/ljharb/shell-quote/commit/59bbf8b81bf3236842deb72805744d489f650eba"><code>59bbf8b</code></a></li> <li>[Dev Deps] update <code>@arethetypeswrong/cli</code>, <code>evalmd</code> <a href="https://github.com/ljharb/shell-quote/commit/a04d47516e1cd5b1b4d3f720ddf97561ed0082fc"><code>a04d475</code></a></li> <li>[Dev Deps] update <code>@arethetypeswrong/ci</code>, <code>eslint</code> <a href="https://github.com/ljharb/shell-quote/commit/d390f9a92b97a04b1f799298634e90dc581021e6"><code>d390f9a</code></a></li> <li>[Tests] <code>quote</code>: the tilde test escapes every <code>~</code>, not just a leading one (<a href="https://redirect.github.com/ljharb/shell-quote/issues/9">#9</a>) <a href="https://github.com/ljharb/shell-quote/commit/617d119795c7b44d6e49a4d41f80195c4aa5735c"><code>617d119</code></a></li> </ul> <h2><a href="https://github.com/ljharb/shell-quote/compare/v1.8.4...v1.9.0">v1.9.0</a> - 2026-06-24</h2> <h3>Commits</h3> <ul> <li>[New] add types <a href="https://github.com/ljharb/shell-quote/commit/dca6e21a02df4cc1a83ed1b5baa4d82df134170a"><code>dca6e21</code></a></li> <li>[Dev Deps] update <code>eslint</code> <a href="https://github.com/ljharb/shell-quote/commit/9aa9e8f60991f8c4053a29e476795d891ff851ad"><code>9aa9e8f</code></a></li> <li>[Fix] <code>parse</code>: finalize tokens in linear time (GHSA-395f-4hp3-45gv) <a href="https://github.com/ljharb/shell-quote/commit/7ff5488599d01c323514f02f5efb74088dd134ec"><code>7ff5488</code></a></li> <li>[actions] update workflows <a href="https://github.com/ljharb/shell-quote/commit/75e849741ffaf2d3aa53ae0e18ef6bf9929ef478"><code>75e8497</code></a></li> <li>[actions] Windows + node 4/6/7: pin eslint to 9 before install, since npm 2/3 cannot stage eslint 10<code>@types/esrecurse</code> <a href="https://github.com/ljharb/shell-quote/commit/3fb739de44b81c69431947d54fbfc18998dd6d72"><code>3fb739d</code></a></li> <li>[actions] retry <code>npm install</code> on Windows to survive npm 2/3 staging-rename flake <a href="https://github.com/ljharb/shell-quote/commit/abe0163293c82963fa8a16cfaa87181846d5aced"><code>abe0163</code></a></li> <li>[actions] Windows + node 5/7: install deps with a modern node <a href="https://github.com/ljharb/shell-quote/commit/b4bafa2e7e58d53d9839b1c24976f61e54b43326"><code>b4bafa2</code></a></li> <li>[Fix] <code>quote</code>: escape leading <code>~</code> to prevent shell tilde-expansion <a href="https://github.com/ljharb/shell-quote/commit/7a76c1a12d8461c2234a1c655b943cee84cbff91"><code>7a76c1a</code></a></li> <li>[Dev Deps] update <code>auto-changelog</code>, <code>tape</code> <a href="https://github.com/ljharb/shell-quote/commit/7184b4458b65c17b931e126d8cb5f586c6717dc8"><code>7184b44</code></a></li> <li>[Dev Deps] apparently <code>jackspeak</code> is no longer in the graph <a href="https://github.com/ljharb/shell-quote/commit/9ba368a4057b9f498b0fef23b5b15543ef81b98c"><code>9ba368a</code></a></li> </ul> </blockquote> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/ljharb/shell-quote/commit/64988d9a0e73a2ae710488952e3614958ef289d4"><code>64988d9</code></a> v1.10.0</li> <li><a href="https://github.com/ljharb/shell-quote/commit/617d119795c7b44d6e49a4d41f80195c4aa5735c"><code>617d119</code></a> [Tests] <code>quote</code>: the tilde test escapes every <code>~</code>, not just a leading one (<a href="https://redirect.github.com/ljharb/shell-quote/issues/9">#9</a>)</li> <li><a href="https://github.com/ljharb/shell-quote/commit/59bbf8b81bf3236842deb72805744d489f650eba"><code>59bbf8b</code></a> [types] fix an error TS v6 ignores but v7 fails on</li> <li><a href="https://github.com/ljharb/shell-quote/commit/190e236bcf1d81caa8e40e8ea3bb11998575be71"><code>190e236</code></a> [Tests] <code>quote</code>: pin that a backslash with whitespace is not doubled in singl...</li> <li><a href="https://github.com/ljharb/shell-quote/commit/a04d47516e1cd5b1b4d3f720ddf97561ed0082fc"><code>a04d475</code></a> [Dev Deps] update <code>@arethetypeswrong/cli</code>, <code>evalmd</code></li> <li><a href="https://github.com/ljharb/shell-quote/commit/b9545b39f4de17aa169410823c98acf58387e474"><code>b9545b3</code></a> [New] <code>parse</code>: add opt-in <code>splitUnquoted</code> option for shell field-splitting of...</li> <li><a href="https://github.com/ljharb/shell-quote/commit/1b364683b1e9e8d078fd3017cde82cf10c9c04a5"><code>1b36468</code></a> [readme] <code>quote</code>: use output verbatim; do not re-quote it (<a href="https://redirect.github.com/ljharb/shell-quote/issues/11">#11</a>)</li> <li><a href="https://github.com/ljharb/shell-quote/commit/1c36f3ff77d26d200620c1027e5c271050120b8e"><code>1c36f3f</code></a> [Tests] <code>quote</code>: pin conservative escaping of <code>=</code>, <code>@</code>, <code>^</code>, <code>,</code>, <code>:</code>, <code>!</code> (<a href="https://redirect.github.com/ljharb/shell-quote/issues/11">#11</a>)</li> <li><a href="https://github.com/ljharb/shell-quote/commit/e1c75cd6e4a3c60003792c7f2802587d328622cb"><code>e1c75cd</code></a> [readme] document <code>parse</code>'s supported parameter-expansion subset</li> <li><a href="https://github.com/ljharb/shell-quote/commit/c0842c8a7a034066da2496a75e91cbe500ff736c"><code>c0842c8</code></a> [Fix] <code>parse</code>: match nested <code>${...}</code> braces so nested parameter expansion is ...</li> <li>Additional commits viewable in <a href="https://github.com/ljharb/shell-quote/compare/v1.8.4...v1.10.0">compare view</a></li> </ul> </details> <br /> [![Dependabot compatibility score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=shell-quote&package-manager=npm_and_yarn&previous-version=1.8.4&new-version=1.10.0)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself) You can disable automated security fix PRs for this repo from the [Security Alerts page](https://github.com/open-policy-agent/opa/network/alerts). </details> Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>	2026-07-21 11:13:08 -05:00
dependabot[bot]	8c750eb490	build(deps): bump js-yaml from 5.1.0 to 5.2.1 in /docs (#8914 ) Bumps [js-yaml](https://github.com/nodeca/js-yaml) from 5.1.0 to 5.2.1. <details> <summary>Changelog</summary> <p><em>Sourced from <a href="https://github.com/nodeca/js-yaml/blob/master/CHANGELOG.md">js-yaml's changelog</a>.</em></p> <blockquote> <h2>[5.2.1] - 2026-07-02</h2> <h3>Fixed</h3> <ul> <li>Add <code>Map</code> support to !!omap (should work when <code>realMapTag</code> used)</li> </ul> <h3>Security</h3> <ul> <li>Remove quadratic complexity from !!omap <code>addItem</code>. Regression from v5 (usually not critical, because YAML11_SCHEMA is not default anymore).</li> </ul> <h2>4.3.0, 3.15.0 - 2026-06-27</h2> <h3>Security</h3> <ul> <li>Backported <code>maxTotalMergeKeys</code> option.</li> </ul> <h2>[5.2.0] - 2026-06-26</h2> <h3>Added</h3> <ul> <li>Added <code>maxTotalMergeKeys</code> (10000) loader option to limit the total number of keys processed by YAML merge (<code><<</code>) across one <code>load()</code> / <code>loadAll()</code> call.</li> <li>Added <code>maxAliases</code> (-1) loader option to limit the number of YAML aliases per document.</li> </ul> <h3>Removed</h3> <ul> <li><code>maxMergeSeqLength</code> replaced with <code>maxTotalMergeKeys</code> for limiting YAML merge processing.</li> </ul> <h3>Fixed</h3> <ul> <li>Round-trip of integers with exponential form (>= <code>1e21</code>)</li> </ul> </blockquote> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/nodeca/js-yaml/commit/ac16b42c46c11c5c7f66062bfc78b168b5f07ecd"><code>ac16b42</code></a> 5.2.1 released</li> <li><a href="https://github.com/nodeca/js-yaml/commit/4a864e55eec5044da67ca95a13f48c73e9ae8c0d"><code>4a864e5</code></a> Deps bump</li> <li><a href="https://github.com/nodeca/js-yaml/commit/39f3211a2f01b3c6982710cf21434ab7060acefe"><code>39f3211</code></a> !!omap: add <code>Map</code> support and remove quadratic complexity</li> <li><a href="https://github.com/nodeca/js-yaml/commit/ff17f1e5bbd1d0dcfb9567ff4526f7206a666f7b"><code>ff17f1e</code></a> Changelog update</li> <li><a href="https://github.com/nodeca/js-yaml/commit/8ed15f1cf6a0f1818ea4c0cd5d3973e87af2158f"><code>8ed15f1</code></a> deps bump</li> <li><a href="https://github.com/nodeca/js-yaml/commit/1a562dc14cac81354643e45936cde968b6da324c"><code>1a562dc</code></a> Fix changelog link</li> <li><a href="https://github.com/nodeca/js-yaml/commit/c28ed5ec1aa66a37b8202e17d0caa122922a1b00"><code>c28ed5e</code></a> 5.2.0 released</li> <li><a href="https://github.com/nodeca/js-yaml/commit/125cd5ab9f1355d4edaf6d95bf3a7099dc333d35"><code>125cd5a</code></a> Add <code>maxAliases</code> option</li> <li><a href="https://github.com/nodeca/js-yaml/commit/3105455b81dee69e0fd36e09ac0b2ccfdb54adc1"><code>3105455</code></a> Replace <code>maxMergeSeqLength</code>option with <code>maxTotalMergeKeys</code> (more robust)</li> <li><a href="https://github.com/nodeca/js-yaml/commit/39d00d65eb6b88362a5c806cea57541e687aaccb"><code>39d00d6</code></a> numbers: Drop boxed numbers support, simplify .identify() checks, clarify rou...</li> <li>Additional commits viewable in <a href="https://github.com/nodeca/js-yaml/compare/5.1.0...5.2.1">compare view</a></li> </ul> </details> <br /> [![Dependabot compatibility score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=js-yaml&package-manager=npm_and_yarn&previous-version=5.1.0&new-version=5.2.1)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself) You can disable automated security fix PRs for this repo from the [Security Alerts page](https://github.com/open-policy-agent/opa/network/alerts). </details> Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>	2026-07-21 10:14:52 -05:00
Charlie Egan	efebe8044d	docs: Some minor bug fixes to improve reporting (#8917 ) Signed-off-by: Charlie Egan <charlie_egan@apple.com>	2026-07-21 10:49:44 +00:00
Stephan Renatus	bdf1d301e0	server/failtracer: skip self-referential undefined-ref hints The compile-time fail hints used a fuzzy match against the ref's top-level segment to suggest typo fixes (e.g. input.frut -> input.fruit). levenshtein.ClosestStrings returns the exact match itself when the top-level segment already matches a declared unknown, so any failure caused by a missing/undefined sub-field (rather than a misspelled top-level name) produced a hint suggesting the exact same ref back, e.g. "input.resource.heading undefined, did you mean input.resource.heading?". Skip the hint entirely in that case, since the fuzzy matcher has no visibility into sub-fields and suggesting the ref unchanged is a no-op. Signed-off-by: Stephan Renatus <stephan.renatus@gmail.com>	2026-07-21 12:20:33 +02:00
Sebastian Spaink	31065f123e	cmd/check: report wrapped structured errors individually (#8912 ) Fixes #3663 In JSON mode, `opa check -b` collapsed all compilation errors into one opaque string, unlike non-bundle mode which lists each with its code and location. The bundle loader wraps errors as `fmt.Errorf("bundle %s: %w", ...)`, and NewOutputErrors default case stringified the wrapper instead of the structured ast.Errors inside it. The default case now unwraps and recurses, keeping the wrapper's message only when unwrapping reveals nothing structured. Signed-off-by: Sebastian Spaink <sebastianspaink@gmail.com>	2026-07-20 14:58:34 -05:00
Anders Eknert	3368497a96	test: Start decomissioning `test.WithTempFS` (#8908 ) The `test.WithTempFS` helper is used _extensively_ throughout our tests. Since `t.TempDir()` became a thing (Go 1.16), it probably shouldn't be, as that function does all the same things but in a more idiomatic manner. Main issues with `test.WithTempFS`: - It doesn't take a `*testing.T`, making failures reported without correct/helpful location. - It creates a new scope for no particular reason, where it could just have returned the root directory instead. An additional scope == an additionl level of indentation. This change adds the new `test.TempDir` and `test.TempDirOf` functions, which tries to address these issues. There are way too many places where `test.WithTempFS` is used for me to fix in a single PR, so more will have to come later. Most of the changes here don't even use the new functions, but replace the use of `test.WithTempFS` with `t.TempDir()` directly, as no files were passed to the function there. Also: - Replace a number of `reflect.DeepEqual` calls with better alternatives (not using reflection) Recommended reviewing with whitespace diffs hidden! Signed-off-by: Anders Eknert <anders.eknert@apple.com>	2026-07-20 20:48:24 +02:00
Anders Eknert	5a33432bd4	cmd: Avoid intermediate buffer when writing bundle (#8909 ) While likely not important for small bundles, using `opa build` to build large bundles would previously allocate much more memory than was needed, as the bundle would first be written to an intermediate in-memory buffer before getting written to disk. This fixes that by deferring the creation of the output file to the first write, then writing to that directly. Signed-off-by: Anders Eknert <anders.eknert@apple.com>	2026-07-20 20:29:46 +02:00
Oluwajuwon Omotayo	4cefcaff21	ecosystem: add agt-policies-africa — African data protection OPA policy pack (#8850 ) ### Why the changes in this PR are needed? The OPA Ecosystem page has no coverage of African data protection regulations or AI agent compliance in the African context. Nine African data protection laws are now in force (Nigeria NDPA 2023, Kenya DPA 2019, Ghana Act 843, Rwanda Law 058/2021, Egypt PDPL 151/2020, Mauritius DPA 2017, South Africa POPIA, Tanzania PDPA 2022, Uganda DPPA 2019), and developers building AI agents for African markets have no discoverable OPA policy reference for these jurisdictions. This entry surfaces an existing open-source resource to that audience directly on openpolicyagent.org/ecosystem. ### What are the changes in this PR? Adds a single ecosystem entry file: - `docs/src/data/ecosystem/entries/agt-policies-africa.md` The entry covers: - 9 African jurisdictions, each with a Rego policy and a full `opa test` suite (140+ tests) - Decision semantics: `deny / escalate / audit / allow` — structured for AI agent runtimes - Highlights two OPA docs features: `policy-testing` and `learning-rego` - Uses `allow_missing_image: true` (no logo file included — same pattern as `awesome-opa.md`) ### Notes to assist PR review: - No docs page, sidebar, or Go code changes — ecosystem entry only - Ecosystem entries are auto-discovered; no `sidebars.js` update required - The project is already listed in `awesome-opa` (PR #82, merged June 2026), so the URL is established ### Further comments: The project's primary audience is developers building AI agents for Nigerian and broader African fintech/financial markets, where data residency, transaction-limit enforcement, and PII protection (BVN/NIN/national IDs) are regulatory requirements. OPA is used as the policy decision engine via the REST API and Go SDK. The ecosystem entry brings this niche but growing use case into the discoverability of the OPA ecosystem page alongside other security and compliance tools. I have read the project's [AI tool use guidelines](https://www.openpolicyagent.org/docs/contrib-code#ai-guidelines). Claude Code was used to assist with formatting; all content reflects my own work and understanding of the referenced regulations. --------- Signed-off-by: oluwajuwon omotayo <ginuxtechacademy@gmail.com> Signed-off-by: Charlie Egan <charlie_egan@apple.com> Co-authored-by: Charlie Egan <charlie_egan@apple.com>	2026-07-17 09:43:16 -05:00

1 2 3 4 5 ...

6644 Commits