Skip to content

fix(deps): update all non-major dependencies - #281

Open
renovate[bot] wants to merge 2 commits into
mainfrom
renovate/all-minor-patch
Open

fix(deps): update all non-major dependencies#281
renovate[bot] wants to merge 2 commits into
mainfrom
renovate/all-minor-patch

Conversation

@renovate

@renovate renovate Bot commented Nov 8, 2026

Copy link
Copy Markdown
Contributor

Note

This PR body was truncated due to platform limits.

This PR contains the following updates:

Package Change Age Confidence Type Update Pending
@discordjs/builders (source) ^1.14.1 → ^1.15.0 age confidence dependencies minor
@discordjs/core (source) ^2.6.0 → ^2.7.0 age confidence dependencies minor
@swc/core (source) ^1.16.20 → ^1.16.21 age confidence devDependencies patch 1.16.22
@vitest/coverage-v8 (source) ^5.0.5 → ^5.1.0 age confidence devDependencies minor
bullmq (source) ^6.5.1 → ^6.7.0 age confidence dependencies minor 6.7.2 (+1)
evlog (source) ^2.34.0 → ^2.35.0 age confidence devDependencies minor 2.35.1
i18next (source) ^26.5.11 → ^26.7.1 age confidence dependencies minor 26.7.2
knip (source) 6.43.0 → 6.44.1 age confidence devDependencies minor 6.44.2
msgpackr ^2.1.3 → ^2.1.4 age confidence devDependencies patch
oxfmt (source) 0.75.0 → 0.76.0 age confidence devDependencies minor 0.77.0
oxlint (source) 1.90.0 → 1.91.0 age confidence devDependencies minor 1.92.0
pkg-pr-new (source) ^0.0.92 → ^0.0.93 age confidence devDependencies patch
pnpm (source) 12.16.1 → 12.18.0 age confidence packageManager minor
pnpm/action-setup v6.1.0 → v6.1.1 age confidence action patch
pullfrog/pullfrog v0.1.103 → v0.1.114 age confidence action patch v0.1.122 (+7)
semver ^7.8.5 → ^7.8.6 age confidence devDependencies patch
tsdown (source) ^0.23.3 → ^0.23.5 age confidence devDependencies patch 0.23.7
vitest (source) ^5.0.5 → ^5.1.0 age confidence devDependencies minor
zizmorcore/zizmor-action v0.8.0 → v0.8.1 age confidence action patch

Release Notes

discordjs/discord.js (@​discordjs/builders)

v1.15.0

Compare Source

Bug Fixes

Documentation

Features

  • file types for builders (8047fe7)
swc-project/swc (@​swc/core)

v1.16.21

Compare Source

Bug Fixes
Documentation
Miscellaneous Tasks
Ci
vitest-dev/vitest (@​vitest/coverage-v8)

v5.1.0

Compare Source

   🚀 Features
   🐞 Bug Fixes
   🏎 Performance
    View changes on GitHub
taskforcesh/bullmq (bullmq)

v6.7.0

Compare Source

Features

v6.6.1

Compare Source

Bug Fixes
  • deps: update dependency cron-parser to v5.10.3 [security] (#​5061) (5152f03)
  • sandbox: let worker threads finish their current job on close(true) (#​4991) (467afe5)

v6.6.0

Compare Source

Features
  • deduplication: support schedule option (python) (elixir) (php) (rust) (dotnet) (#​5048) (31b151d)

v6.5.4

Compare Source

Bug Fixes
  • deps: update dependency msgpackr to v2.1.3 [security] (#​5051) (fce8223)

v6.5.3

Compare Source

Bug Fixes
  • node-redis: clear ended status when connect() reopens the client (#​4952) (0928d9f)
evloghq/evlog (evlog)

v2.35.0

Compare Source

What's Changed

Features 🚀
  • Add three opt-in redaction built-ins that detect credentials by value, under any key and inside longer strings by @​HugoRCD in #​999
Bug Fixes 🐞
  • Parse stack frames in linear time by @​HugoRCD in #​988
  • Escape control characters in pretty output on Node by @​HugoRCD in #​981
  • Widen the optional nitro peer range so that nitro@3.0.261029-rc installs without a peer conflict by @​evlogai[bot] in #​974
  • Keep request errors in Nitro 3 wide events when an earlier async error hook delays evlog's hook by @​onmax in #​963
Refactoring 🛠
  • refactor: trim trailing slashes in drain endpoints without a regex by @​HugoRCD in #​991
Dependency Updates 📦

Changelog: https://github.com/evloghq/evlog/blob/evlog@2.35.0/packages/evlog/CHANGELOG.md#2350
Full Changelog: https://github.com/evloghq/evlog/compare/evlog@2.34.0...evlog@2.35.0

i18next/i18next (i18next)

v26.7.1

Compare Source

  • fix: reloadResources() retries the bundles that failed to load. The load queue skipped them also when reloading, so a language whose first load failed (a backend or network outage at startup) stayed missing. i18next-http-backend 4.0.8, i18next-chained-backend 5.0.7 and i18next-locize-backend 10.0.5 reload through reloadResources() with i18next 26.7, so their reloadInterval no longer recovered from such a failure, as their own reload did before.
  • fix: reloadResources() without languages reloads the current languages and every language the backend loaded or tried to load, for the instance and its clones, as the API docs describe ("pass languages and namespaces if you don't want to reload all"). It reloaded only the current languages, so on a server (one clone per request with i18next-http-middleware) a backend's reloadInterval never refreshed the languages loaded for requests. It never requests cimode. With languages given, nothing changes.

v26.7.0

Compare Source

The last 26.x minor before v27, which follows in about a week. It adds the APIs v27 builds on, and with debug: true it warns wherever a setup relies on something v27 changes. Most of the v27 defaults are existing options, so you can try them now:

i18next.init({
  debug: true, // prints the warnings below
  fallbackLng: 'en', // v27: fallbackLng defaults to false, set your source language (no implicit 'dev')
  returnEmptyString: false, // v27 default: an empty string falls back like a missing key
  cleanCode: true, // close to v27, which canonicalizes codes without a region ('EN' becomes 'en')
});
declare module 'i18next' {
  interface CustomTypeOptions {
    strictInterpolationChecks: true; // v27 default
    returnEmptyString: false; // v27 default
  }
}

The other v27 changes (/ no longer escaped in values, a logger and post-processors per instance, the key instead of a sentence for an object hit, the dotted-language store calls and *Escaped options removed) have no switch; the debug warnings below show where they apply.

  • feat: with the default skipOnVariables: true, a missing interpolation variable is now logged in debug mode, once per string and variable: missed to pass in variable name for interpolating Hello {{name}}. The raw {{name}} reached the UI without any log line, even with debug: true, because the warning only ran with skipOnVariables: false. A variable passed as undefined and a missingInterpolationHandler still log nothing.
  • feat: i18next.hydrate(resources, lng) puts resources rendered on the server into the store and changes to the server's language, each only the first time. It does what react-i18next's useSSR did by writing resourceStore.data, options.ns, isInitialized, initializedStoreOnce and initializedLanguageOnce directly, and sets the same flags, so integrations can switch to it and stay compatible with code that still reads or writes them. On a clone it does nothing, as useSSR does: a clone shares its parent's store (one clone per request with i18next-http-middleware). Called before init(), it logs a warning and changes nothing.
  • feat: services.utils.reloadResources() lets a backend reload its bundles through i18next (as i18next.reloadResources(), with retries and the loaded event), instead of calling backendConnector.read() and loaded() itself as the reloadInterval of i18next-http-backend and i18next-chained-backend does. Without languages (no lng, no detector, the default fallbackLng), reloadResources() reloads nothing instead of throwing Cannot read properties of undefined (reading 'forEach'); a backend that also reloads preload passes its languages.
  • feat: backends and async language detectors can declare their calling convention with callbackApi (an instance or static property). true: read(language, namespace, callback), create(languages, namespace, key, fallbackValue, callback, options) and detect(callback); false: they return a promise or a value, and create gets the options as its fifth argument. Without it, i18next keeps guessing from the number of parameters (Function.length), which default and rest parameters change: i18next-chained-backend's create(..., clb = () => {}, opts = {}) has length 4 and never got its options (isUpdate), and i18next-http-backend's callback form of create has length 5, the length reserved for the callback-less form. Guessing is deprecated: in debug mode an unmarked backend or async detector logs a deprecation warning, once per init().
  • feat: isSafeLanguageCode(code) is exported for plugins that take a language from a request, a URL or storage: letters, digits, -, _, @ and . (no ..), at most 128 characters, not a prototype key. It is not a BCP 47 check, so en_US, zh_Hant_TW, sr@latin and de_DE.UTF-8 pass; markup, slashes and spaces do not. The language detector, i18next-http-middleware and i18next-http-backend each have their own rule today.
  • feat: use() logs a warning in debug mode when a second backend, language detector, i18nFormat or formatter replaces the first one; only one of each is used per instance, and losing an ICU setup this way was silent. As use() usually runs before init(), the warning is printed once init() has set up the logger.
  • feat(types): ParseKeysWithoutVariables<Ns, KPrefix>, the keys t() takes without options: their string has no variables, and a plural key is left out when its forms take count. A wrapper typed with it, like (key: ParseKeysWithoutVariables<'common'>) => t(key), compiles with strictInterpolationChecks without a cast.
  • feat(types): defaultVariables in CustomTypeOptions declares the variables interpolation.defaultVariables fills in at runtime (defaultVariables: { appName: string }). They become optional in the t() options, also with strictInterpolationChecks; passed, they keep their type.
  • feat(types): interpolationFormatSeparator in CustomTypeOptions for a custom interpolation.formatSeparator: the types split {{price, currency}} at a hard-coded ,, so with formatSeparator: ';' th

[!IMPORTANT]
✂ PR body was truncated to here.

Configuration

📅 Schedule: (UTC)

  • Branch creation
    • "before 12pm on Sunday"
  • Automerge
    • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

  • If you want to rebase/retry this PR, check this box

This PR was generated by Mend Renovate. View the repository job log.

@renovate
renovate Bot requested a review from RedStar071 as a code owner November 8, 2026 01:42
@renovate renovate Bot added the dependencies label Nov 8, 2026
@coldtea-pr-lens

coldtea-pr-lens Bot commented Nov 8, 2026

Copy link
Copy Markdown

Note

renovate[bot] opened this pull request, so PR Lens left it undrawn. Comment @pr-lens draw to draw it

github.comment.notice: false in .github/pr-lens.yml turns this note off

@wolfstarbot wolfstarbot added packages:plugin-i18next Changes in plugin-i18next packages:plugin-logger Changes in plugin-logger packages:plugin-cache Changes in plugin-cache packages:plugin-gateway Changes in plugin-gateway packages:plugin-scheduled-tasks Changes in plugin-scheduled-tasks labels Nov 8, 2026
@socket-security

socket-security Bot commented Nov 8, 2026

Copy link
Copy Markdown

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff Package Supply Chain
Security		 Vulnerability Quality Maintenance License
Updatedpkg-pr-new@​0.0.92 ⏵ 0.0.931001007096 +1100
Updated@​vitest/​coverage-v8@​5.0.5 ⏵ 5.1.09910079 +198100
Updatedvitest@​5.0.5 ⏵ 5.1.098 +110079 +199100
Updatedoxfmt@​0.75.0 ⏵ 0.76.094 +81008895 -1100
Updatedtsdown@​0.23.4 ⏵ 0.23.798 +110088 +197 +1100
Updatedoxlint@​1.90.0 ⏵ 1.91.099 +11009196 +2100
Updated@​swc/​core@​1.16.20 ⏵ 1.16.229210010096100
Updatedbullmq@​6.5.2 ⏵ 6.7.19210010096 +1100
Updatedi18next@​26.5.12 ⏵ 26.7.2100 +11009398 +1100
Updatedknip@​6.43.0 ⏵ 6.44.193 -61009596100
Updatedmsgpackr@​2.1.3 ⏵ 2.1.4100100100 +194100
Updated@​discordjs/​builders@​1.14.1 ⏵ 1.15.0100 +110095 +198 +2100
Updatedsemver@​7.8.5 ⏵ 7.8.6100 +1100100 +195100
Updatedevlog@​2.34.0 ⏵ 2.35.198 +110010096 +1100
Updated@​discordjs/​core@​2.6.0 ⏵ 2.7.0100 +710010096 -1100

View full report

@socket-security

socket-security Bot commented Nov 8, 2026

Copy link
Copy Markdown

Warning

Review the following alerts detected in dependencies.

According to your organization's Security Policy, it is recommended to resolve "Warn" alerts. Learn more about Socket for GitHub.

Priority Alert  (click "▶" to expand/collapse) Action
Low priority
License policy violation: npm @vitest/istanbul-lib-report under OFL-1.1

License: OFL-1.1 - The applicable license policy does not permit this license (5) (package/dist/reports/html/assets/readex-pro-license.txt)

From: pnpm-lock.yaml → npm/@vitest/coverage-v8@5.1.0 → npm/@vitest/istanbul-lib-report@2.1.0

ℹ Read more on: This package | This alert | What is a license policy violation?

Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev.

Suggestion: Find a package that does not violate your license policy or adjust your policy to allow this package's license.

Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/@vitest/istanbul-lib-report@2.1.0. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

Warn

View full report

@codecov

codecov Bot commented Nov 8, 2026

Copy link
Copy Markdown

❌ 1 Tests Failed:

Tests completed Failed Passed Skipped
1966 1 1965 0
View the top 1 failed test(s) by shortest run time 
packages/plugin-gateway/tests/application-commands.test.ts > ApplicationCommandManager > GIVEN fetch without options THEN it lists the global commands by ID
Stack Traces | 0.0139s run time 
AssertionError: expected "get" to be called with arguments: [ …(2) ]

Received:

  1st get call:

  [
    ".../applications/266624760782258186/commands",
    {
-     "query": Any<URLSearchParams>,
+     "headers": {},
+     "query": URLSearchParams {},
      "signal": undefined,
    },
  ]


Number of calls: 1

 ❯ .../plugin-gateway/tests/application-commands.test.ts:510:17

To view more test analytics, go to the Test Analytics Dashboard
📋 Got 3 mins? Take this short survey to help us improve Test Analytics.

@pkg-pr-new

pkg-pr-new Bot commented Nov 8, 2026

Copy link
Copy Markdown

Open in StackBlitz

@wolfstar/plugin-api

pnpm add https://pkg.pr.new/@wolfstar/plugin-api@281

@wolfstar/plugin-broker

pnpm add https://pkg.pr.new/@wolfstar/plugin-broker@281

@wolfstar/plugin-cache

pnpm add https://pkg.pr.new/@wolfstar/plugin-cache@281

@wolfstar/plugin-gateway

pnpm add https://pkg.pr.new/@wolfstar/plugin-gateway@281

@wolfstar/plugin-i18next

pnpm add https://pkg.pr.new/@wolfstar/plugin-i18next@281

@wolfstar/plugin-logger

pnpm add https://pkg.pr.new/@wolfstar/plugin-logger@281

@wolfstar/plugin-opentelemetry

pnpm add https://pkg.pr.new/@wolfstar/plugin-opentelemetry@281

@wolfstar/plugin-scheduled-tasks

pnpm add https://pkg.pr.new/@wolfstar/plugin-scheduled-tasks@281

@wolfstar/plugin-sharder

pnpm add https://pkg.pr.new/@wolfstar/plugin-sharder@281

@wolfstar/plugin-subcommands-advanced

pnpm add https://pkg.pr.new/@wolfstar/plugin-subcommands-advanced@281

commit: 7a3d0bc

@renovate

renovate Bot commented Nov 8, 2026

Copy link
Copy Markdown
Contributor Author

Edited/Blocked Notification

Renovate will not automatically rebase this PR, because it does not recognize the last commit author and assumes somebody else may have edited the PR.

You can manually request rebase by checking the rebase/retry box above.

⚠️ Warning: custom changes will be lost.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@RedStar071 RedStar071 Awaiting requested review from RedStar071 RedStar071 is a code owner

At least 1 approving review is required to merge this pull request.

Assignees

No one assigned

Labels

dependencies packages:plugin-cache Changes in plugin-cache packages:plugin-gateway Changes in plugin-gateway packages:plugin-i18next Changes in plugin-i18next packages:plugin-logger Changes in plugin-logger packages:plugin-scheduled-tasks Changes in plugin-scheduled-tasks

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

1 participant

@wolfstarbot