fix(deps): update non-major dependencies#1116
Conversation
|
The latest updates on your projects. Learn more about Vercel for GitHub.
|
🚀 Preview Deployment✅ Deployment Ready 🔗 Preview URL: https://pr-1116-midnight-docs.vercel.app 📝 Latest commit: This preview updates automatically when you push new commits to this PR. |
renovate
Bot
force-pushed
the
renovate/non-major-deps
branch
from
0b1a7f0 to
1c7427d
Compare
renovate
Bot
force-pushed
the
renovate/non-major-deps
branch
from
1c7427d to
3a28a2d
Compare
renovate
Bot
force-pushed
the
renovate/non-major-deps
branch
from
3a28a2d to
238e27f
Compare
renovate
Bot
force-pushed
the
renovate/non-major-deps
branch
from
238e27f to
ae4cbda
Compare
renovate
Bot
force-pushed
the
renovate/non-major-deps
branch
from
ae4cbda to
8f199c7
Compare
renovate
Bot
force-pushed
the
renovate/non-major-deps
branch
from
8f199c7 to
0f86f90
Compare
renovate
Bot
force-pushed
the
renovate/non-major-deps
branch
from
0f86f90 to
74fed92
Compare
renovate
Bot
force-pushed
the
renovate/non-major-deps
branch
from
74fed92 to
57ce8a9
Compare
renovate
Bot
force-pushed
the
renovate/non-major-deps
branch
from
57ce8a9 to
a0f659a
Compare
renovate
Bot
force-pushed
the
renovate/non-major-deps
branch
from
a0f659a to
ceec801
Compare
renovate
Bot
force-pushed
the
renovate/non-major-deps
branch
from
ceec801 to
6fc189f
Compare
renovate
Bot
force-pushed
the
renovate/non-major-deps
branch
from
6fc189f to
3900a6d
Compare
Jina ReviewJina has completed this review. Review: https://app.usejina.com/reviews/48634b65-e992-481e-9e8e-bafc34fe5516
|
![jina-simulation[bot]](https://avatars.githubusercontent.com/u/97225700?s=60&v=4){kind=small}
There was a problem hiding this comment.
Runtime Review - Merge Readiness 5/5
0 issues found - Ready to merge
Ready to merge.
No dependency-refresh regression was demonstrated: immutable installation completed, GraphQL 17 schema loading succeeded, and generation produced all 98 expected pages.
The sole candidate is a pre-existing validation gap and is retained only as a non-blocking technical observation.
Final review: The dependency refresh has no accepted runtime issues.
GraphQL loading and generation were directly validated; the remaining pipeline observation is pre-existing and non-blocking.
Review Comments
-
GraphQL reference validation is separate from the normal build
The Docusaurus GraphQL plugin registers generation as a CLI command rather than a normal build hook, and CI runs only yarn build.
Consider adding a CI check that generates or validates the API reference against the committed pages so schema or loader regressions cannot leave stale documentation undetected.
Evidence:
- docusaurus.config.js:132-142 configures the schema and loader without a build hook.
- The installed plugin implementation only registers graphql-to-doc through extendCli.
- .github/workflows/build.yml:31-38 runs yarn build without invoking graphql-to-doc.
- 1 more evidence item(s) recorded.
Related files:
docusaurus.config.js,.github/workflows/build.yml
Issues
No medium/high-confidence runtime issues were found.
Summary
- Status: warned
- Areas investigated: 6
- Tasks/probes performed: 3
- Issues reported: 0
- Publishable issues: 0
- Inline comments: 0
- File-level comments: 0
- Review comments: 1
- Unanchored publishable findings posted as file-level comments: 0
- Blocked validations: 0
- Dashboard: full runtime review
- Commit: 3900a6d
- Changed files: 3
- Tool calls: none
renovate
Bot
force-pushed
the
renovate/non-major-deps
branch
from
3900a6d to
eb4f69a
Compare
Jina ReviewJina has completed this review. Review: https://app.usejina.com/reviews/38a24062-9f25-4160-8546-b1c1185d7591
|
There was a problem hiding this comment.
Runtime Review - Merge Readiness 5/5
0 issues found - Ready to merge
Ready to merge.
No accepted runtime issues remain.
Immutable installation, the production Docusaurus build, CSS compilation, GraphQL schema loading, and generation succeeded, while all other candidates were shown to be pre-existing, unreachable, duplicated, or non-blocking.
Final review: No publishable runtime issues were established.
Installation, production build, CSS compilation, and GraphQL generation succeeded; remaining findings are pre-existing, unreachable, duplicated, or non-blocking.
Review Comments
-
Visual regression failures are non-blocking
The visual regression workflow runs Playwright with continue-on-error, so styling regressions would not fail the check.
This is a pre-existing enforcement gap and does not block this dependency-refresh PR.
Evidence:
- .github/workflows/playwright-visual-regression.yml:67 sets continue-on-error: true.
- The CSS investigation found successful compilation and no demonstrated dependency-refresh visual regression.
Related files:
.github/workflows/playwright-visual-regression.yml
Issues
No medium/high-confidence runtime issues were found.
Summary
- Status: warned
- Areas investigated: 7
- Tasks/probes performed: 0
- Issues reported: 0
- Publishable issues: 0
- Inline comments: 0
- File-level comments: 0
- Review comments: 1
- Unanchored publishable findings posted as file-level comments: 0
- Blocked validations: 0
- Dashboard: full runtime review
- Commit: eb4f69a
- Changed files: 3
- Tool calls: none
renovate
Bot
force-pushed
the
renovate/non-major-deps
branch
from
eb4f69a to
527c341
Compare
Jina ReviewJina has completed this review. Review: https://app.usejina.com/reviews/17e32e09-3efd-45bb-95ff-48a1b7d50f3e
|
There was a problem hiding this comment.
Runtime Review - Merge Readiness 5/5
0 issues found - Ready to merge
Ready to merge.
There are no accepted issues; the GraphQL schema loaded successfully and generation produced all 98 expected pages.
Existing validation gaps are pre-existing and already covered by prior review context.
Final review: No publishable runtime issues were identified.
The validated GraphQL loader and API generation remain compatible, and no candidate issues were submitted for the other areas.
Issues
No medium/high-confidence runtime issues were found.
Summary
- Status: warned
- Areas investigated: 6
- Tasks/probes performed: 3
- Issues reported: 0
- Publishable issues: 0
- Inline comments: 0
- File-level comments: 0
- Review comments: 0
- Unanchored publishable findings posted as file-level comments: 0
- Blocked validations: 0
- Dashboard: full runtime review
- Commit: 527c341
- Changed files: 3
- Tool calls: none
renovate
Bot
force-pushed
the
renovate/non-major-deps
branch
from
527c341 to
dad7166
Compare
Jina ReviewJina has completed this review. Review: https://app.usejina.com/reviews/10faee9e-dc50-444c-91af-be45f2817cc5
|
There was a problem hiding this comment.
Runtime Review - Merge Readiness 5/5
0 issues found - Ready to merge
Ready to merge.
No candidate issues were submitted or substantiated, and prior runtime validation established successful installation, Docusaurus build, GraphQL schema loading, API-reference generation, and CSS compilation.
The remaining visual-test enforcement gap is pre-existing, non-blocking, and already covered by PR thread history.
Final review: No publishable runtime issues were identified.
The dependency refresh remains ready to merge; the only retained finding is a pre-existing visual-regression enforcement gap.
Issues
No medium/high-confidence runtime issues were found.
Summary
- Status: warned
- Areas investigated: 7
- Tasks/probes performed: 3
- Issues reported: 0
- Publishable issues: 0
- Inline comments: 0
- File-level comments: 0
- Review comments: 0
- Unanchored publishable findings posted as file-level comments: 0
- Blocked validations: 1
- Dashboard: full runtime review
- Commit: dad7166
- Changed files: 3
- Tool calls: none
renovate
Bot
force-pushed
the
renovate/non-major-deps
branch
from
dad7166 to
a1a0a56
Compare
Jina ReviewJina has completed this review. Review: https://app.usejina.com/reviews/00d16af2-a6ba-4657-b859-b2cb691d222b
|
There was a problem hiding this comment.
Runtime Review - Merge Readiness 5/5
0 issues found - Ready to merge
Ready to merge.
No candidate issues were submitted or substantiated, and direct validation confirmed a reproducible Yarn install and successful production build.
Existing build warnings are unrelated documentation/link warnings and do not establish a regression from this PR.
Final review: No publishable runtime issues were identified.
Immutable installation and the production Docusaurus build succeeded; observed warnings are pre-existing and unrelated to this dependency refresh.
Issues
No medium/high-confidence runtime issues were found.
Summary
- Status: warned
- Areas investigated: 6
- Tasks/probes performed: 0
- Issues reported: 0
- Publishable issues: 0
- Inline comments: 0
- File-level comments: 0
- Review comments: 0
- Unanchored publishable findings posted as file-level comments: 0
- Blocked validations: 0
- Dashboard: full runtime review
- Commit: a1a0a56
- Changed files: 3
- Tool calls: none
renovate
Bot
force-pushed
the
renovate/non-major-deps
branch
from
a1a0a56 to
6807680
Compare
Jina ReviewJina has completed this review. Review: https://app.usejina.com/reviews/605114af-1870-4202-92df-db098c8ba423
|
There was a problem hiding this comment.
Runtime Review - Merge Readiness 5/5
0 issues found - Ready to merge
Ready to merge.
No accepted issues remain; prior runtime validation found no dependency-refresh regression.
Final review: No publishable runtime issues were identified.
The investigation produced no candidate issues, and prior validation found successful installation, production build, GraphQL loading/generation, and CSS compilation.
Issues
No medium/high-confidence runtime issues were found.
Summary
- Status: warned
- Areas investigated: 8
- Tasks/probes performed: 0
- Issues reported: 0
- Publishable issues: 0
- Inline comments: 0
- File-level comments: 0
- Review comments: 0
- Unanchored publishable findings posted as file-level comments: 0
- Blocked validations: 0
- Dashboard: full runtime review
- Commit: 6807680
- Changed files: 3
- Tool calls: none
This PR contains the following updates:
2.19.0→2.21.08.1.14→8.1.164.3.1→4.3.225.9.4→25.9.50.185.0→0.185.112.42.0→12.42.224.16.0→24.18.08.5.15→8.5.168.5.19(+2)1.395.0→1.399.11.399.3(+1)6.39.1→6.39.23.8.4→3.9.54.3.1→4.3.20.185.0→0.185.1Warning
Some dependencies could not be looked up. Check the Dependency Dashboard for more information.
Release Notes
auth0/auth0-react (@auth0/auth0-react)
v2.21.0Compare Source
Full Changelog
Added
v2.20.0Compare Source
Full Changelog
Added
ardatan/graphql-tools (@graphql-tools/graphql-file-loader)
v8.1.16Compare Source
Patch Changes
[
2609c94]:v8.1.15Compare Source
Patch Changes
[
981d461]:tailwindlabs/tailwindcss (@tailwindcss/postcss)
v4.3.2Compare Source
Fixed
auto-rows-*andauto-cols-*utilities (e.g.auto-rows-12andauto-cols-16) (#20229)@tailwindcss/cliin--watchmode from crashing on Windows when@sourcepoints to a directory that doesn't exist (#20242)@tailwindcss/vitefrom crashing in Deno v2.8.x whencontext.parentURLis not a valid URL (#20245)@tailwindcss/cliin--watchmode rebuilds when the input CSS file changes in an ignored directory (#20246)@variantrules used inaddBase(…)to use custom variants defined later (#20247)@tailwindcss/vitefrom crashing during HMR when scanned files or directories are deleted (#20259)font-sizeinstead ofcolordeclarations fortext-[--spacing(…)](#20260)@sourcepatterns from scanning unrelated sibling files and folders (#20263)%]…[%in.tt,.tt2, and.txfiles (#20269)p.text-black[condition](#20269)@position-tryrules from triggering unknown at-rule warnings when optimizing CSS (#20277)--opacitytheme values (#20287)@tailwindcss/postcsswhen used with newer PostCSS patch releases (#20289)motiondivision/motion (framer-motion)
v12.42.2Compare Source
Fixed
animateView: Cropped group layers now animateborder-radiusfrom the old to new radius.v12.42.1Compare Source
Fixed
animateView: Old layer fade out now cancelled when defining.new().nodejs/node (node)
v24.18.0: 2026-06-23, Version 24.18.0 'Krypton' (LTS), @richardlau prepared by @sxaCompare Source
Notable Changes
e07e7a31e1] - crypto: update root certificates to NSS 3.123.1 (Node.js GitHub Bot) #6352744c8ebcbd6] - http: avoid stream listeners on idle agent sockets (Matteo Collina) #64004d3ef4122ee] - (SEMVER-MINOR) buffer: increase Buffer.poolSize default to 64 KiB (Matteo Collina) #63597bb2857b85a] - (SEMVER-MINOR) crypto: align key argument names in docs and error messages (Filip Skokan) #62527b9d5e87880] - (SEMVER-MINOR) crypto: accept key data in crypto.diffieHellman() and cleanup DH jobs (Filip Skokan) #62527ccd756d61e] - (SEMVER-MINOR) crypto: add TurboSHAKE and KangarooTwelve Web Cryptography algorithms (Filip Skokan) #621834c9251fc09] - (SEMVER-MINOR) http: add writeInformation to send arbitrary 1xx status codes (Tim Perry) #631558c989ec4a3] - (SEMVER-MINOR) inspector: expose precise coverage start to JS runtime (sangwook) #630793f54c8ba32] - Revert "stream: noop pause/resume on destroyed streams" (Stewart X Addison) #63834Commits
d3ef4122ee] - (SEMVER-MINOR) buffer: increase Buffer.poolSize default to 64 KiB (Matteo Collina) #635979ff36e40f0] - build: add --enable-all-experimentals build flag (Paolo Insogna) #627557c22ee23aa] - build: defNODE_USE_NODE_CODE_CACHEonly used in node_mksnapshot (Chengzhong Wu) #635882551abdb4a] - build,win: enable x64 PGO (Stefan Stojanovic) #62761e8a55ce9b1] - crypto: strengthen argument CHECKs in TurboSHAKE (Tobias Nießen) #62763ae61cd68f3] - crypto: harden WebCrypto against prototype pollution (Filip Skokan) #633633d05a1d396] - crypto: pass CryptoKey handles to KDF jobs (Filip Skokan) #63363f9d10a3f6b] - crypto: remove async from WebCrypto methods (Filip Skokan) #63363e431d93e9e] - crypto: add WebCrypto CryptoJob mode (Filip Skokan) #6336356e2505e48] - crypto: wire ML-DSA and ML-KEM for use when using BoringSSL (Filip Skokan) #632553bac77f2a8] - crypto: wire ChaCha20-Poly1305 in Web Cryptography when using BoringSSL (Filip Skokan) #632551bff901b09] - crypto: wire AES-KW in Web Cryptography when using BoringSSL (Filip Skokan) #632554433fca3df] - crypto: harden CryptoKey algorithm slots (Filip Skokan) #63111b5cf01217a] - crypto: harden KeyObject internal slots (Filip Skokan) #63111ce84aef37d] - crypto: add guards and adjust tests for BoringSSL (Filip Skokan) #6288326781689b0] - crypto: reject duplicate ML-KEM JWK key_ops (Filip Skokan) #62905aeea8f4970] - crypto: add JWK support for ML-KEM and SLH-DSA key types (Filip Skokan) #62706407cf91656] - crypto: guard against size_t overflow on experimental 32-bit arch (Filip Skokan) #62626bb2857b85a] - (SEMVER-MINOR) crypto: align key argument names in docs and error messages (Filip Skokan) #62527b9d5e87880] - (SEMVER-MINOR) crypto: accept key data in crypto.diffieHellman() and cleanup DH jobs (Filip Skokan) #62527b46d52b283] - crypto: unify asymmetric key import through KeyObjectHandle::Init (Filip Skokan) #62499ccd756d61e] - (SEMVER-MINOR) crypto: add TurboSHAKE and KangarooTwelve Web Cryptography algorithms (Filip Skokan) #62183e07e7a31e1] - crypto: update root certificates to NSS 3.123.1 (Node.js GitHub Bot) #6352761826df455] - crypto: coerce -0 keylen to +0 in pbkdf2 and scrypt (Jordan Harband) #6353116d2fd3c07] - crypto: align verifyOneShot accepted types (Anshika Jain) #632803b8330deda] - crypto: improve system certificate enumeration logic on macOS (Robo) #62576141de35399] - debugger: add --help tonode inspectand improve docs (Joyee Cheung) #63201b76bfcd4fa] - deps: upgrade npm to 11.16.0 (npm team) #636024ec142314c] - deps: SQLite: cherry-pickb869ed6(Junsu Han) #6352519e8ce1c36] - deps: upgrade npm to 11.15.0 (npm team) #634638a264260e2] - deps: update sqlite to 3.53.1 (Node.js GitHub Bot) #6321750c8ff3f94] - deps: update simdjson to 4.6.4 (Node.js GitHub Bot) #628116e56f01c4b] - deps: V8: cherry-pick435a2cd(Matthias Liedtke) #631363ba813b242] - deps: cherry-pick libuv/libuv@a43e543(Ali Hassan) #632222390e3a5ac] - doc: remove duplicated sentences in large-pull-requests.md (Joyee Cheung) #6365052a1c18374] - doc: updategit node landinstructions for security releases (Antoine du Hamel) #635863e6b4da037] - doc: drop --experimental from --permission (Rafael Gonzaga) #6358384d05163b9] - doc: explicitly ask for reproducible in JS (Rafael Gonzaga) #634797da2a4450e] - doc: fix URL postMessage example in worker_threads (Kit Dallege) #622033d79bd8b29] - doc: clarifyfilteroption ofsqlite.database.applyChangeset(Antoine du Hamel) #635154f4174aace] - doc: fix double spaces in ERR_TLS_INVALID_PROTOCOL_METHOD (Daijiro Wachi) #63511388323ca4b] - doc: fix double space in modules.md (Daijiro Wachi) #635125258ccc058] - doc: fix "options" to "option" in tls.createServer (Daijiro Wachi) #6345343e83e6507] - doc: fix typo in deprecations (Daijiro Wachi) #63434f05a61d54c] - doc: remove unsupported template type from v8.md (René) #63410c39d5fc820] - doc: fix article usage before vowel-sound acronyms (joao-oliveira-softtor) #62696398261f911] - doc: remove the bi-monthly contributor spotlight section (Claudio Wunder) #62734fd9e14c405] - doc: update http2'spushandtrailersevents withrawHeadersparam (YuSheng Chen) #63259b943ce6933] - doc: remove inactive members from Triagers list (Antoine du Hamel) #633294b9cdfc022] - doc: reference correct function in Module docs (Robin Malfait) #63247bed84b6df2] - doc: replace Visual Studio 2022 Evergreen version reference with 17.14 (Mike McCready) #6321132ea70569b] - doc: recommend explicitly Tier 1 or 2 for production applications (Mike McCready) #631874627bcfd82] - doc: run license-builder (github-actions[bot]) #6323228eba71845] - doc: add large pull requests contributing guide (Matteo Collina) #628292648efd438] - doc: remove unnecessary<!-- eslint-magic comments (Antoine du Hamel) #63200a95fc1f8fc] - doc: clarify SEA platform support excludes darwin-x64 (MJSHANG) #63181aaef29e2e1] - doc: update release steps when post-release fails (Rafael Gonzaga) #631317d81419cf2] - doc: add Hmac.digest() documentation-only deprecation (DEP0206) (Anshika Jain) #63121ececd80d81] - doc: document the latest-vX.x schema (Marco Ippolito) #6303327c1c1d842] - doc: remove list of versions inBUILDING.md(Antoine du Hamel) #63113e369886a65] - doc,sqlite: document entryPoint argument for loadExtension (Edy Silva) #63152e4e5137cbd] - errors: handle V8 warnings in DisallowJavascriptExecutionScope (Divyanshu Sharma) #634916d1f6048d2] - fs: makeDateproperties onStatsenumerable (LiviaMedeiros) #6332844c8ebcbd6] - http: avoid stream listeners on idle agent sockets (Matteo Collina) #640044c9251fc09] - (SEMVER-MINOR) http: add writeInformation to send arbitrary 1xx status codes (Tim Perry) #6315539f61fb06c] - http2: emit session close before stream close (Matteo Collina) #634148a8f2127d1] - http2: validate non-link headers in writeEarlyHints (Matteo Collina) #620178c989ec4a3] - (SEMVER-MINOR) inspector: expose precise coverage start to JS runtime (sangwook) #63079c05f38229b] - lib: cleanup stateless diffiehellman key handling (Filip Skokan) #626451c16b45d35] - lib: refactor internal webidl converters (Filip Skokan) #6297902f35d6dce] - lib: definekEnumerablePropertyatomically (Antoine du Hamel) #6360912c51547ba] - lib: fix typos in esm loader comments (RonGamzu) #634659b03b84262] - lib: fix typo idenity => identity (Daijiro Wachi) #63112a84e6b0567] - lib: fixes validator message (Daijiro Wachi) #6282311734166a8] - lib: narrow ReadableStreamBYOBRequest.view return type to Uint8Array (RoomWithOutRoof) #630177cead61d21] - meta: flip mcollina emails in .mailmap (Matteo Collina) #63621a08cfcfd35] - meta: label "source maps" PRs (Chengzhong Wu) #63591d56e8d2512] - meta: addvfssubsystem label (René) #623316201cfe488] - meta: skip scheduled workflows on forks (Jamie Magee) #63565f095e2bd31] - meta: add additional gitignore entries (James M Snell) #632671ea52c444c] - meta: move one or more collaborators to emeritus (Node.js GitHub Bot) #63402b1b2327611] - meta: move one or more collaborators to emeritus (Node.js GitHub Bot) #632357d88e130a9] - meta: ignore AI assistants files (Matteo Collina) #62612a53b51df38] - module: load ESM helpers eagerly in the snapshot (Joyee Cheung) #6355069df688fff] - module: fix sync hook short-circuit in require() in imported CJS (Joyee Cheung) #6292075d9a4ed47] - node-api: support SharedArrayBuffer in napi_create_typedarray (Yilong Li) #62710c20aa4c47b] - quic: add reusePort option to QuicEndpoint (James M Snell) #6326726a30d8a7f] - quic: implement rate limiting for version nego and immediate close (James M Snell) #632670b534b5770] - quic: fixup linting issue after other changes (James M Snell) #632674b367cbe09] - quic: remove unused binding variable in session.cc (James M Snell) #631772574bef5a6] - repl: fix dedup comparing normalized line against raw history (Daijiro Wachi) #6288630e71c7e49] - sqlite: keep source database alive during backup (Matteo Collina) #62673677ca7e76c] - src: simplify OpenSSL feature gates (Filip Skokan) #63255c863c75c39] - src: add BoringSSL EVP enumeration fallback (Filip Skokan) #63206f6b2466921] - src: decouple KeyObject and CryptoKey and move CryptoKey to src (Filip Skokan) #6292492d4f07dd2] - src: remove license headers for new node_profiling files (Chengzhong Wu) #630668ac5d771c8] - src: split profiling helpers from util (Ilyas Shabi) #6300885d1639495] - src: remove TOCTOU race condition when encoding SAB-backedBuffers (Antoine du Hamel) #635179473c5f05c] - src: skip duplicate UTF-8 validation in TextDecoder fatal path (Mert Can Altin) #63231f35c91ee68] - src: improve token return value check (James M Snell) #6348326f677c1c5] - src: exposenode::RegisterContextto make a node managed context (Chengzhong Wu) #62322275cf909b6] - src,sqlite: only passxFilterwhen user provided a callback (Antoine du Hamel) #63516287e02303f] - src,sqlite: remove dead code (Edy Silva) #6320458fa2ee189] - stream: switch to internalsleepbinding (Antoine du Hamel) #63611f954ab3f1a] - stream: use data listener for compose forwarding (Trivikram Kamat) #63593dc57173003] - stream: fix Writable.toWeb() hang on synchronous drain (sangwook) #611973f54c8ba32] - Revert "stream: noop pause/resume on destroyed streams" (Stewart X Addison) #63834cee279c5d6] - stream: remove unnecessary check (Antoine du Hamel) #6303061b20f60a3] - test: update tls/crypto behaviour expectations when using BoringSSL (Filip Skokan) #63161a835363808] - test: update WPT for WebCryptoAPI to97bbc72(Node.js GitHub Bot) #63417a00297480b] - test: update WPT resources, interfaces and WebCryptoAPI (Node.js GitHub Bot) #623895a95a2b055] - test: shorten path in net pipe connect errors (Matteo Collina) #634055e8ff22d8f] - test: remove test-node-output-v8-warning (Joyee Cheung) #63469ee15380950] - test: update test426-fixtures to9b9e225(Node.js GitHub Bot) #633739e063d9bea] - test: update WPT for url toe4a4672(Node.js GitHub Bot) #63372503bee4b43] - test: deflake async-hooks statwatcher test (Trivikram Kamat) #63396cccc7c32d8] - test: avoid test_runner watch restart in spec snapshot (Trivikram Kamat) #63392c89489258c] - test: reduce watch mode restart flakiness (Trivikram Kamat) #63390e4d5e2578e] - test: isolate rerun-failures state file under tmpdir (Chemi Atlow) #63449362644a9ba] - test: wait for ok before initial break after restart (Yuya Inoue) #62807c4058d0e05] - test: disable Maglev in near-heap-limit worker test (Trivikram Kamat) #63398214da630a7] - test: deflake connection refused proxy tests (Trivikram Kamat) #633951d61a29876] - test: avoid repeated writes in watch helper (Trivikram Kamat) #633862004e25387] - test: deflake watch mode worker test (Trivikram Kamat) #63384d691cccfc1] - test: relax test-memory-usage arrayBuffers check (inoway46) #632440ff6bf853c] - test: reduce flakiness ofdifferent-registry-per-thread(Antoine du Hamel) #63244d9f4e8e503] - test: fix flaky test-watch-mode-inspect timeout (Matteo Collina) #633616d7cd50328] - test: relax min assertion in test-performance-eventloopdelay (Marco) #631009dafe1d2d8] - test: avoid flaky restart sync in debugger exceptions test (Yuya Inoue) #62055989b2de973] - test: avoid initial-break wait in restart-message (inoway46) #62060a072a25ee7] - test: move FFI tests toNATIVE_SUITES(Antoine du Hamel) #6316564efbfd878] - test: use ERM to destroy sqlite database handles after tests (René) #630767dee66cd94] - test_runner: dont buffer unordered events in process isolation mode (Moshe Atlow) #63432d257eec1e3] - test_runner: fix --test-rerun-failures swallowing failures on retry (Chemi Atlow) #63431288c320e2f] - test_runner: show replayed-from-attempt hint in spec reporter (Moshe Atlow) #63429904bdf5bb4] - test_runner: preserve run duration when using test-rerun (Moshe Atlow) #63429df183d7bfa] - test_runner: avoid hanging on incomplete v8 frames (Ali Hassan) #62704ec86c69726] - test_runner: fix diagnostics channel context tracking (Moshe Atlow) #6328394e5f63b83] - tls: add unsupported renegotiation error (Filip Skokan) #6316106d308fb61] - tools: prevent lib code from reading KeyObject and CryptoKey accessors (Filip Skokan) #631112e4a0d0c91] - tools: bump brace-expansion from 5.0.5 to 5.0.6 in /tools/eslint (dependabot[bot]) #634154c9666b366] - tools: skip commit-lint on backport pull requests (Marco) #6337867d0c490a8] - tools: fix skip oftest-interneton forks (Antoine du Hamel) #6349202f73c7cac] - tools: bump the eslint group in /tools/eslint with 4 updates (dependabot[bot]) #630755d016d3241] - tools: update gyp-next to 0.22.2 (Node.js GitHub Bot) #6337455af0f0edb] - tools: fix test426 updater (Antoine du Hamel) #63271d8475e167a] - tools: use different branch for tool updates on staging branches (Antoine du Hamel) #63110c605df9e50] - util: remove unused functions (Antoine du Hamel) #63612fe4540ebdb] - util: create hex style cache and fast path (Guilherme Araújo) #62999v24.17.0: 2026-06-18, Version 24.17.0 'Krypton' (LTS), @aduh95Compare Source
This is a security release.
Notable Changes
Commits
9e4dfc7bba] - (CVE-2026-48933) crypto: guard WebCrypto cipher output length (Filip Skokan) nodejs-private/node-private#878cb2aed980c] - deps: update llhttp to 9.4.2 (Antoine du Hamel) nodejs-private/node-private#890a8a0d12875] - (CVE-2026-48937) deps: fix integration issues with the latest nghttp2 (Tim Perry) #6289166e6203c1c] - (SEMVER-MAJOR) deps: update nghttp2 to 1.69.0 (Node.js GitHub Bot) #62891dd627ced27] - deps: update archs files for openssl-3.5.7 (Node.js GitHub Bot) #63820684bae568f] - deps: upgrade openssl sources to openssl-3.5.7 (Node.js GitHub Bot) #638203a631e7f83] - deps: fix aix implicit declaration in OpenSSL (Abdirahim Musse) #62656cf44df3996] - deps: update undici to 7.28.0 (Node.js GitHub Bot) #63703138c70294b] - (CVE-2026-48930) dns,net: reject hostnames with embedded NUL bytes (Matteo Collina) nodejs-private/node-private#868be7e719c3f] - (CVE-2026-48931) http: fix response queue poisoning in http.Agent (Matteo Collina) nodejs-private/node-private#846cc7c11b4d1] - (CVE-2026-48619) http2: cap originSet size to prevent unbounded memory growth (Matteo Collina) nodejs-private/node-private#8559224427b92] - (CVE-2026-48615) lib,test: redact proxy credentials in tunnel errors (Matteo Collina) nodejs-private/node-private#867cf85d54839] - (CVE-2026-48935) permission: disable FileHandle utimes with permission model (RafaelGSS) nodejs-private/node-private#873a1bbc24f96] - (CVE-2026-48617) permission: handle process.chdir on writereport (RafaelGSS) nodejs-private/node-private#870e3723ff2d6] - test: add session reuse host verification regressions (Matteo Collina) nodejs-private/node-private#854a77af4867b] - (CVE-2026-48934) tls: bind reusable sessions to authenticated host (Matteo Collina) nodejs-private/node-private#85431beb4f707] - (CVE-2026-48928) tls: fix case-sensitive SNI context matching (Matteo Collina) nodejs-private/node-private#8578e75c73f91] - (CVE-2026-48618) tls: normalize hostname for server identity checks (Matteo Collina) nodejs-private/node-private#869postcss/postcss (postcss)
v8.5.16Compare Source
Input#origin()position (by @mizdra).rawsafter rehydrating a JSON AST (by @sarathfrancis90).nodesof new node (by @MahinAnowar).offsetinpositionBy()(by @greymoth-jp).rangeBy()onindex: 0(by @sarathfrancis90).PostHog/posthog-js (posthog-js)
v1.399.1Compare Source
v1.399.0Compare Source
1.399.0
Minor Changes
#4115
86bb3a5Thanks @DanielVisca! - add the posthog.metrics API (count, gauge, histogram) — alphaA statsd-style pre-aggregating metrics client for the PostHog Metrics product (alpha). Samples are folded into per-series aggregates in memory (counts sum, gauges keep the last value, histograms accumulate buckets) and flushed periodically as OTLP/JSON to
/i/v1/metrics— one data point per series per flush window, no matter how many calls. No OpenTelemetry SDK setup required:Configure via
metrics: { serviceName, environment, flushIntervalMs, maxSeriesPerFlush, beforeSend, ... }. (2026-07-08)Patch Changes
86bb3a5]:v1.398.7Compare Source
1.398.7
Patch Changes
#4113
45f17eeThanks @TueHaulund! - fix session replay leaking a shadow-root observer when a same-origin iframe is removedFollow-up to the shadow-observer iframe-teardown fix:
takeFullSnapshot'sonSerializeregisters every shadow root with the top-level document, so a root nested in a same-origin iframe was keyed to the wrong document and its observer/buffer were not disconnected when that iframe was removed (they lingered until the next full snapshot).addShadowRootnow derives the owning document from the host element, so per-document teardown matches iframe-nested roots too. (2026-07-08)[
v1.398.6](https://redirect.github.com/PostHog/posthog-js/releases/tag/posthog-jConfiguration
📅 Schedule: (in timezone Europe/London)
🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.
♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.
👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.
This PR was generated by Mend Renovate. View the repository job log.