fix(deps): update all non-major dependencies

[renovate]

This PR contains the following updates:

Package	Change	Age	Confidence
@commitlint/cli (source)	^20.4.0 → ^20.4.1
@commitlint/config-conventional (source)	^20.4.0 → ^20.4.1
@types/node (source)	^24.10.9 → ^24.10.12
bullmq (source)	5.67.2 → 5.67.3
i18next (source)	^25.8.0 → ^25.8.4
tldts	^7.0.20 → ^7.0.22
turbo (source)	^2.8.1 → ^2.8.3
undici (source)	^7.19.2 → ^7.21.0

---

Release Notes

conventional-changelog/commitlint (@​commitlint/cli)

v20.4.1

Compare Source

Note: Version bump only for package @​commitlint/cli

conventional-changelog/commitlint (@​commitlint/config-conventional)

v20.4.1

Compare Source

Note: Version bump only for package @​commitlint/config-conventional

taskforcesh/bullmq (bullmq)

v5.67.3

Compare Source

Bug Fixes

• connection: merge redisOptions when duplicating cluster (#​3759) (afb878f)

i18next/i18next (i18next)

v25.8.4

Compare Source

• fix: crashes when backend in backends array has no name property 2386

v25.8.3

Compare Source

• ts: document option to suppress the support message 2385

v25.8.2

Compare Source

• option to suppress the support message 2385

v25.8.1

Compare Source

• fix(types): Selector API - fix Namespace inference for selector ns option 2384

remusao/tldts (tldts)

v7.0.22

Compare Source

📜 Update Public Suffix List

• tldts-experimental, tldts-icann, tldts
  • Update upstream public suffix list #​2500 (@​remusao)

🔩 Dependencies

• Bump @​types/node from 25.1.0 to 25.2.0 #​2499 (@​dependabot[bot])
• tldts-core, tldts-experimental, tldts-icann, tldts-tests, tldts-utils, tldts
  • Bump chai from 4.5.0 to 6.2.2 #​2482 (@​dependabot[bot])
  • chore: upgrade dependencies #​2498 (@​remusao)

Authors: 2

• @​dependabot[bot]
• Rémi (@​remusao)

---

v7.0.21

Compare Source

📜 Update Public Suffix List

• tldts-core, tldts-experimental, tldts-icann, tldts-tests, tldts-utils, tldts
  • Update PSL + dependencies #​2497 (@​remusao)

⚠️ Pushed to master

• Fix publishing (@​remusao)

Authors: 1

• Rémi (@​remusao)

---

vercel/turborepo (turbo)

v2.8.3: Turborepo v2.8.3

Compare Source

What's Changed

Changelog

• fix: Upgrade capnp to 0.24 by @​anthonyshew in #​11656
• fix: Upgrade h2 to fix CONTINUATION Flood by @​anthonyshew in #​11658
• fix: Upgrade crossbeam-channel to 0.5.15 by @​anthonyshew in #​11657
• chore: Remove abandoned turbo clone command by @​anthonyshew in #​11673
• fix: Upgrade rustls and ring by @​anthonyshew in #​11659
• fix: Upgrade openssl to 0.10.75 by @​anthonyshew in #​11660
• fix: Replace unmaintained adler with adler2 by @​anthonyshew in #​11661

Full Changelog: vercel/turborepo@v2.8.2...v2.8.3

v2.8.2: Turborepo v2.8.2

Compare Source

What's Changed

Docs

• fix: Upgrade next to fix HTTP deserialization DoS by @​anthonyshew in #​11597
• fix: Upgrade mermaid to fix lodash-es vulnerability by @​anthonyshew in #​11611
• fix: Upgrade recharts to fix lodash vulnerability by @​anthonyshew in #​11606
• chore: Move applications to apps/ directory by @​anthonyshew in #​11613
• fix: Upgrade rehype packages to fix mdast-util-to-hast vulnerability by @​anthonyshew in #​11616

create-turbo

• fix: Upgrade tsup to fix rollup and glob vulnerabilities by @​anthonyshew in #​11601
• fix: Upgrade inquirer to 8.2.7 to fix tmp vulnerability by @​anthonyshew in #​11622
• fix: Upgrade ts-jest to 29.4.6 to fix brace-expansion ReDoS vulnerabilities by @​anthonyshew in #​11623
• feat: Migrate from tsup to tsdown by @​anthonyshew in #​11649

@​turbo/codemod

• fix: Upgrade axios to fix SSRF vulnerability by @​anthonyshew in #​11599
• fix: Replace axios with native fetch in turbo-codemod by @​anthonyshew in #​11600
• fix: Upgrade diff to fix DoS vulnerabilities by @​anthonyshew in #​11621

eslint

• fix: Upgrade eslint devDependency to fix stack overflow vulnerability by @​anthonyshew in #​11610
• fix: Upgrade esbuild to fix arbitrary request vulnerability by @​anthonyshew in #​11615

Examples

• examples: Update NODE_VERSION to 24.13.1 in Dockerfile by @​i5d6 in #​11591
• fix: escaping for link titles in LinksService by @​odaysec in #​11632

Changelog

• fix: Add allowComments and allowTrailingCommas to turbo.json schema by @​ddmoney420 in #​11579
• chore: Eliminate ts-rs serde attribute parse warnings by @​anthonyshew in #​11589
• fix: Extract git argument validation into reusable helper by @​anthonyshew in #​11593
• fix: Upgrade fast-xml-parser to fix RangeError DoS by @​anthonyshew in #​11598
• fix: Upgrade semver to fix ReDoS vulnerability by @​anthonyshew in #​11596
• fix: Upgrade tar to fix security vulnerabilities by @​anthonyshew in #​11602
• fix: Upgrade @​actions/github to fix @​octokit vulnerabilities by @​anthonyshew in #​11607
• fix: Upgrade @​vercel/blob and @​actions packages to fix undici vulnerability by @​anthonyshew in #​11608
• docs: Running Root Tasks by @​Netail in #​11630
• Update README.md title and remove features section by @​anthonyshew in #​11651
• docs: Update using-environment-variables.mdx by @​anthonyshew in #​11652
• fix: Upgrade js-yaml to address CVE-2025-64718 by @​alexmkio in #​11650
• fix: Remove smooth scrolling from docs by @​anthonyshew in #​11654
• fix: Add sitemap link to 404 page and fix TurborepoLogo gradient by @​anthonyshew in #​11655

New Contributors

• @​ddmoney420 made their first contribution in #​11579
• @​i5d6 made their first contribution in #​11591
• @​Netail made their first contribution in #​11630
• @​alexmkio made their first contribution in #​11650

Full Changelog: vercel/turborepo@v2.8.1...v2.8.2

nodejs/undici (undici)

v7.21.0

Compare Source

What's Changed

• build(deps): bump actions/setup-node from 6.0.0 to 6.2.0 by @​dependabot[bot] in #​4796
• test: restore global dispatcher after fetch tests by @​mcollina in #​4790
• Add missing close method to WebSocketStream interface by @​piotr-cz in #​4802
• fix: error stream instead of canceling by @​KhafraDev in #​4804
• Fix clientTtl cleanup race in Agent by @​mcollina in #​4807
• feat(#​4230): Implement pingInterval for dispatching PING frames by @​metcoder95 in #​4296
• fix: handle undefined __filename in bundled environments by @​mcollina in #​4812
• fix: set finalizer only for fetch responses by @​tsctx in #​4803

New Contributors

• @​piotr-cz made their first contribution in #​4802

Full Changelog: nodejs/undici@v7.20.0...v7.21.0

v7.20.0

Compare Source

What's Changed

• fix: preserve fetch stack traces by @​mcollina in #​4778
• Fix error handling in MockPool example by @​dave-kennedy in #​4781
• feat: expose statusText in request() ResponseData by @​domenic in #​4784
• test: reduce retry-after invalid date flake by @​mcollina in #​4788
• extractBody fixes by @​KhafraDev in #​4791
• fix: MockAgent delayed response with AbortSignal (#​4693) by @​mcollina in #​4772
• fix: onParserTimeout potentially accessing undefined by @​vbfox in #​4758

New Contributors

• @​dave-kennedy made their first contribution in #​4781
• @​vbfox made their first contribution in #​4758

Full Changelog: nodejs/undici@v7.19.2...v7.20.0

---

Configuration

📅 Schedule: Branch creation - "before 12pm on Sunday" (UTC), Automerge - At any time (no schedule defined).

🚦 Automerge: Enabled.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud