fix(deps): update all non-major dependencies

[renovate]

ℹ️ Note

This PR body was truncated due to platform limits.

This PR contains the following updates:

Package	Change	Age	Confidence	Type	Update
@types/node (source)	24.12.2 → 24.12.4			dependencies	patch
@types/node (source)	25.6.0 → 25.9.1			dependencies	minor
@types/node (source)	24.12.2 → 24.12.4			devDependencies	patch
@types/node (source)	25.6.0 → 25.9.1			devDependencies	minor
@types/vscode (source)	1.116.0 → 1.120.0			dependencies	minor
bitflags	2.6.0 → 2.11.1			dependencies	minor
egor-tensin/setup-clang	v2.2 → v2.3			action	minor
eslint (source)	10.2.1 → 10.4.0			devDependencies	minor
golang.org/x/net	v0.53.0 → v0.55.0			require	minor
golang.org/x/sys	v0.43.0 → v0.45.0			require	minor
peaceiris/actions-hugo	v3.0.0 → v3.2.1			action	minor
preact (source)	10.29.1 → 10.29.2			dependencies	patch
ruby (source)	4.0.3 → 4.0.5				patch
ruby/setup-ruby	v1.305.0 → v1.310.0			action	minor
serde (source)	1.0.204 → 1.0.228			dependencies	patch
serde_derive (source)	1.0.204 → 1.0.228			dependencies	patch
serde_json	1.0.149 → 1.0.150			dependencies	patch
serde_json	1.0.120 → 1.0.150			dependencies	patch
tokio (source)	1.52.1 → 1.52.3			dependencies	patch
tsx (source)	4.21.0 → 4.22.3			devDependencies	minor
typescript-eslint (source)	8.59.0 → 8.60.0			devDependencies	minor
vite (source)	8.0.9 → 8.0.14			devDependencies	patch
vitest (source)	4.1.5 → 4.1.7			devDependencies	patch
wasm-bindgen (source)	0.2.118 → 0.2.122			dependencies	patch
zod (source)	4.3.6 → 4.4.3			dependencies	minor
zustand	5.0.12 → 5.0.13			dependencies	patch

---

Warning

Some dependencies could not be looked up. Check the Dependency Dashboard for more information.

---

Release Notes

bitflags/bitflags (bitflags)

v2.11.1

Compare Source

What's Changed

• Bless compile-fail tests for current beta by @​DanielEScherzer in #​478
• example_generated.rs: add missing third slash for doc comment by @​DanielEScherzer in #​477
• Clarify self and other in method docs by @​KodrAus in #​481

New Contributors

• @​DanielEScherzer made their first contribution in #​478

Full Changelog: bitflags/bitflags@2.11.0...2.11.1

v2.11.0

Compare Source

What's Changed

• Fix use of Result in macro output by @​james7132 in #​462
• Add methods to get the known/unknown bits from a flags value by @​WaterWhisperer in #​473

New Contributors

• @​james7132 made their first contribution in #​462
• @​WaterWhisperer made their first contribution in #​473

Full Changelog: bitflags/bitflags@2.10.0...2.11.0

v2.10.0

Compare Source

What's Changed

• Implement iterator for all named flags by @​ssrlive in #​465
• Depend on serde_core instead of serde by @​KodrAus in #​467

New Contributors

• @​ssrlive made their first contribution in #​465

Full Changelog: bitflags/bitflags@2.9.4...2.10.0

v2.9.4

Compare Source

What's Changed

• Add Cargo features to readme by @​KodrAus in #​460

Full Changelog: bitflags/bitflags@2.9.3...2.9.4

v2.9.3

Compare Source

What's Changed

• Streamline generated code by @​nnethercote in #​458

New Contributors

• @​nnethercote made their first contribution in #​458

Full Changelog: bitflags/bitflags@2.9.2...2.9.3

v2.9.2

Compare Source

What's Changed

• Fix difference in the spec by @​KodrAus in #​446
• Fix up inaccurate docs on bitflags_match by @​KodrAus in #​453
• Remove rustc internal crate feature by @​KodrAus in #​454

Full Changelog: bitflags/bitflags@2.9.1...2.9.2

v2.9.1

Compare Source

What's Changed

• Document Cargo features by @​KodrAus in #​444

Full Changelog: bitflags/bitflags@2.9.0...2.9.1

v2.9.0

Compare Source

What's Changed

• Flags trait: add clear(&mut self) method by @​wysiwys in #​437
• Fix up UI tests by @​KodrAus in #​438

Full Changelog: bitflags/bitflags@2.8.0...2.9.0

v2.8.0

Compare Source

What's Changed

• feat(core): Add bitflags_match macro for bitflag matching by @​YuniqueUnic in #​423
• Finalize bitflags_match by @​KodrAus in #​431

New Contributors

• @​YuniqueUnic made their first contribution in #​423

Full Changelog: bitflags/bitflags@2.7.0...2.8.0

v2.7.0

Compare Source

What's Changed

• Fix clippy::doc_lazy_continuation lints by @​waywardmonkeys in #​414
• Run clippy on extra features in CI. by @​waywardmonkeys in #​415
• Fix CI: trybuild refresh, allow some clippy restrictions. by @​waywardmonkeys in #​417
• Update zerocopy version in example by @​KodrAus in #​422
• Add method to check if unknown bits are set by @​wysiwys in #​426
• Update error messages by @​KodrAus in #​427
• Add truncate(&mut self) method to unset unknown bits by @​wysiwys in #​428
• Update error messages by @​KodrAus in #​429

New Contributors

• @​wysiwys made their first contribution in #​426

Full Changelog: bitflags/bitflags@2.6.0...2.7.0

egor-tensin/setup-clang (egor-tensin/setup-clang)

v2.3

Compare Source

eslint/eslint (eslint)

v10.4.0

Compare Source

v10.3.0

Compare Source

peaceiris/actions-hugo (peaceiris/actions-hugo)

v3.2.1: actions-hugo v3.2.1

Compare Source

See CHANGELOG.md for more details.

What's Changed

• Handle Hugo 0.139.5 archive fallback by @​peaceiris in #​696

Full Changelog: peaceiris/actions-hugo@v3.2.0...v3.2.1

v3.2.0: actions-hugo v3.2.0

Compare Source

See CHANGELOG.md for more details.

What's Changed

• feat: support renamed Hugo release assets by @​peaceiris in #​687
• build: update npm dependencies by @​peaceiris in #​689
• fix: Hugo package naming fix by @​peaceiris in #​688

Full Changelog: peaceiris/actions-hugo@v3.1.0...v3.2.0

v3.1.0: actions-hugo v3.1.0

Compare Source

See CHANGELOG.md for more details.

What's Changed

• fix(doc): Update @v2 to @v3 in README.md by @​rhysd in #​649
• docs: add env.HUGO_CACHEDIR by @​Zer0xxxx in #​650
• feat: upgrade action runtime from Node 20 to Node 24 by @​pftg in #​684
• ci: harden workflows and update Node.js by @​peaceiris in #​686

New Contributors

• @​rhysd made their first contribution in #​649
• @​Zer0xxxx made their first contribution in #​650
• @​pftg made their first contribution in #​684

Full Changelog: peaceiris/actions-hugo@v3.0.0...v3.1.0

preactjs/preact (preact)

v10.29.2

Compare Source

Fixes

• Fix hydration when we have defaultValue or value on a textarea (#​5081, thanks @​JoviDeCroock)

Maintenance

• Add CODEOWNERS for GitHub configuration (v10.x) (#​5088, thanks @​JoviDeCroock)
• Fix trusted publishing workflow (#​5084, thanks @​JoviDeCroock)
• Trusted publishing (#​5072, thanks @​JoviDeCroock)

ruby/ruby (ruby)

v4.0.5

Compare Source

v4.0.4: 4.0.4

Compare Source

What's Changed

• Bug #​21955: Fiber#transfer: machine stack not released when fiber terminates, causing FiberError: can't set a guard page - Ruby - Ruby Issue Tracking System
• Bug #​21964: Fiber stack acquire can expand unnecessarily - Ruby - Ruby Issue Tracking System
• Bug #​21971: Fix regexp performance regression for patterns starting with s/k - Ruby - Ruby Issue Tracking System
• Bug #​21961: Marshal.load freeze option fail to freeze linked strings - Ruby - Ruby Issue Tracking System
• Bug #​21959: rb_internal_thread_event_hooks_rw_lock is not reinitialized after fork causing deadlocks - Ruby - Ruby Issue Tracking System
• Bug #​21954: NoMethodError instead of Gem::LoadError on gem activation problem in Ruby 4.0.2 - Ruby - Ruby Issue Tracking System
• Bug #​21844: Inconsistent ArgumentError message for Data::define.new - Ruby - Ruby Issue Tracking System
• Bug #​21992: Defining BasicObject#initialize causes segmentation fault - Ruby - Ruby Issue Tracking System
• Bug #​22018: ISeq created via RubyVM::InstructionSequence.compile don't support coverage - Ruby - Ruby Issue Tracking System
• Bug #​21985: RubyVM::AST negative numbers do not include - in location - Ruby - Ruby Issue Tracking System
• Bug #​21986: RubyVM::AST incorrect location for literals followed by modifier if - Ruby - Ruby Issue Tracking System
• Bug #​21933: Ruby::Box: named capture local variable can become nil after non-matching lines - Ruby - Ruby Issue Tracking System
• Bug #​21940: Ruby::Box: $_ returns stale value due to gvar_tbl caching - Ruby - Ruby Issue Tracking System
• Bug #​22004: parse.y doesn't executes loop body with while true || true condition - Ruby - Ruby Issue Tracking System
• Bug #​21952: Ruby::Box double free at process exit when fiddle/import is required in multiple boxes - Ruby - Ruby Issue Tracking System
• Bug #​22003: .bundle extensions not built when doing out-of-source build - Ruby - Ruby Issue Tracking System
• Bug #​22002: argument stack underflow (-1) - Ruby - Ruby Issue Tracking System

Note: This list is automatically generated by tool/gen-github-release.rb. Because of this, some commits may be missing.

Full Changelog

ruby/setup-ruby (ruby/setup-ruby)

v1.310.0

Compare Source

What's Changed

• Add ruby-4.0.5 by @​ruby-builder-bot in #​918

Full Changelog: ruby/setup-ruby@v1.309.0...v1.310.0

v1.309.0

Compare Source

What's Changed

• Update CRuby releases on Windows by @​ruby-builder-bot in #​917

Full Changelog: ruby/setup-ruby@v1.308.0...v1.309.0

v1.308.0

Compare Source

What's Changed

• Update CRuby releases on Windows by @​ruby-builder-bot in #​912

Full Changelog: ruby/setup-ruby@v1.307.0...v1.308.0

v1.307.0

Compare Source

What's Changed

• Update README: fix outdated URLs and Ruby version examples by @​fkmy in #​910
• Add ruby-4.0.4 by @​ruby-builder-bot in #​911

Full Changelog: ruby/setup-ruby@v1.306.0...v1.307.0

v1.306.0

Compare Source

What's Changed

• Add truffleruby-34.0.1,truffleruby+graalvm-34.0.1 by @​ruby-builder-bot in #​909

Full Changelog: ruby/setup-ruby@v1.305.0...v1.306.0

serde-rs/serde (serde)

v1.0.228

Compare Source

• Allow building documentation with RUSTDOCFLAGS='--cfg=docsrs' set for the whole dependency graph (#​2995)

v1.0.227

Compare Source

• Documentation improvements (#​2991)

v1.0.226

Compare Source

• Deduplicate variant matching logic inside generated Deserialize impl for adjacently tagged enums (#​2935, thanks @​Mingun)

v1.0.225

Compare Source

• Avoid triggering a deprecation warning in derived Serialize and Deserialize impls for a data structure that contains its own deprecations (#​2879, thanks @​rcrisanti)

v1.0.224

Compare Source

• Remove private types being suggested in rustc diagnostics (#​2979)

v1.0.223

Compare Source

• Fix serde_core documentation links (#​2978)

v1.0.222

Compare Source

• Make serialize_with attribute produce code that works if respanned to 2024 edition (#​2950, thanks @​aytey)

v1.0.221

Compare Source

• Documentation improvements (#​2973)
• Deprecate serde_if_integer128! macro (#​2975)

v1.0.220

Compare Source

• Add a way for data formats to depend on serde traits without waiting for serde_derive compilation: https://docs.rs/serde_core (#​2608, thanks @​osiewicz)

v1.0.219

Compare Source

• Prevent absolute_paths Clippy restriction being triggered inside macro-generated code (#​2906, thanks @​davidzeng0)

v1.0.218

Compare Source

• Documentation improvements

v1.0.217

Compare Source

• Support serializing externally tagged unit variant inside flattened field (#​2786, thanks @​Mingun)

v1.0.216

Compare Source

• Mark all generated impls with #[automatically_derived] to exclude from code coverage (#​2866, #​2868, thanks @​tdittr)

v1.0.215

Compare Source

• Produce warning when multiple fields or variants have the same deserialization name (#​2855, #​2856, #​2857)

v1.0.214

Compare Source

• Implement IntoDeserializer for all Deserializers in serde::de::value module (#​2568, thanks @​Mingun)

v1.0.213

Compare Source

• Fix support for macro-generated with attributes inside a newtype struct (#​2847)

v1.0.212

Compare Source

• Fix hygiene of macro-generated local variable accesses in serde(with) wrappers (#​2845)

v1.0.211

Compare Source

• Improve error reporting about mismatched signature in with and default attributes (#​2558, thanks @​Mingun)
• Show variant aliases in error message when variant deserialization fails (#​2566, thanks @​Mingun)
• Improve binary size of untagged enum and internally tagged enum deserialization by about 12% (#​2821)

v1.0.210

Compare Source

• Support serializing and deserializing IpAddr and SocketAddr in no-std mode on Rust 1.77+ (#​2816, thanks @​MathiasKoch)
• Make serde::ser::StdError and serde::de::StdError equivalent to core::error::Error on Rust 1.81+ (#​2818)

v1.0.209

Compare Source

• Fix deserialization of empty structs and empty tuples inside of untagged enums (#​2805, thanks @​Mingun)

v1.0.208

Compare Source

• Support serializing and deserializing unit structs in a flatten field (#​2802, thanks @​jonhoo)

v1.0.207

Compare Source

• Improve interactions between flatten attribute and skip_serializing/skip_deserializing (#​2795, thanks @​Mingun)

v1.0.206

Compare Source

• Improve support for flatten attribute inside of enums (#​2567, thanks @​Mingun)

v1.0.205

Compare Source

• Use serialize_entry instead of serialize_key + serialize_value when serialize flattened newtype enum variants (#​2785, thanks @​Mingun)
• Avoid triggering a collection_is_never_read lint in the deserialization of enums containing flattened fields (#​2791)

serde-rs/json (serde_json)

v1.0.150

Compare Source

• Reject non-string enum object keys (#​1324, thanks @​puneetdixit200)

tokio-rs/tokio (tokio)

v1.52.3: Tokio v1.52.3

Compare Source

1.52.3 (May 8th, 2026)

Fixed

• sync: fix underflow in mpsc channel len() (#​8062)
• sync: notify receivers in mpsc OwnedPermit::release() method (#​8075)
• sync: require that an RwLock has max_readers != 0 (#​8076)
• sync: return Empty from try_recv() when mpsc is closed with outstanding permits (#​8074)

v1.52.2: Tokio v1.52.2

Compare Source

1.52.2 (May 4th, 2026)

This release reverts the LIFO slot stealing change introduced in 1.51.0 (#​7431), due to its performance impact. (#​8100)

privatenumber/tsx (tsx)

v4.22.3

Compare Source

v4.22.2

Compare Source

v4.22.1

Compare Source

v4.22.0

Compare Source

v4.21.1

Compare Source

Bug Fixes

• support Node 20.11/21.2 import.meta paths (acf3d8f)
• support Node.js 24.15.0 (c1d2d45)
• support Node.js 26.1.0 and 25.9.0 (1d7e528)

---

This release is also available on:

• npm package (@​latest dist-tag)

typescript-eslint/typescript-eslint (typescript-eslint)

v8.60.0

Compare Source

This was a version bump only for typescript-eslint to align it with other projects, there were no code changes.

See GitHub Releases for more information.

You can read about our versioning strategy and releases on our website.

v8.59.4

Compare Source

🩹 Fixes

• typescript-eslint: export Compatible* types from typescript-eslint to resolve pnpm TS error (#​12340)

❤️ Thank You

• Kirk Waiblinger @​kirkwaiblinger

See GitHub Releases for more information.

You can read about our versioning strategy and releases on our website.

v8.59.3

Compare Source

This was a version bump only for typescript-eslint to align it with other projects, there were no code changes.

See GitHub Releases for more information.

You can read about our versioning strategy and releases on our website.

v8.59.2

Compare Source

This was a version bump only for typescript-eslint to align it with other projects, there were no code changes.

See GitHub Releases for more information.

You can read about our versioning strategy and releases on our website.

v8.59.1

Compare Source

This was a version bump only for typescript-eslint to align it with other projects, there were no code changes.

See GitHub Releases for more information.

You can read about our versioning strategy and releases on our website.

vitejs/vite (vite)

v8.0.14

Compare Source

Features

• update rolldown to 1.0.2 (#​22484) (96efc88)

Bug Fixes

• deps: update all non-major dependencies (#​22471) (98b8163)
• dev: handle errors when sending messages to vite server (#​22450) (e8e9a34)
• html: handle trailing slash paths in transformIndexHtml (#​22480) (5d94d1b)
• optimizer: pass oxc jsx options to transformSync in dependency scan (#​22342) (b3132da)

Miscellaneous Chores

• deps: update rolldown-related dependencies (#​22470) (7cb728e)
• remove irrelevant commits from changelog (2c69495)

Code Refactoring

• glob: do not rewrite import path for absolute base (#​22310) (0ae2844)

Tests

• css: sass does not use main field (#​22449) (ebf39a0)

v8.0.13

Compare Source

Features

• bundled-dev: add lazy bundling support (#​21406) (4f0949f)
• optimizer: improve the esbuild plugin converter to pass some properties of build result to onEnd (#​22357) (47071ce)
• update rolldown to 1.0.1 (#​22444) (8c766a6)

Bug Fixes

• build: copy public directory after building same environment with write=false (#​22328) (158e8ae)
• css: await sass/less/styl worker disposal on teardown (fix #​22274) (#​22275) (b7edcb7)
• css: keep deprecated name/originalFileName in synthetic assetFileNames call (#​22439) (8e59c97)
• make isBundled per environment (#​22257) (a576326)
• ssr: avoid rewriting labels that collide with imports (#​22451) (d9b18e0)

Miscellaneous Chores

• remove irrelevant commits from changelog (#​22430) (6ea3838)
• update changelog (#​22413) (fcdc87c)

v8.0.12

Compare Source

Features

• update rolldown to 1.0.0 (#​22401) (cf0ff41)

Bug Fixes

• create-vite: pass react framework to TanStack CLI (#​22397) (18f0f90)
• deps: update all non-major dependencies (#​22420) (2be6000)
• module-runner: prevent partial-exports race on concurrent imports of in-flight invalidated re-export chains (#​22369) (f5a22e6)
• refer to rolldownOptions instead of deprecated rollupOptions in messages (#​22400) (b675c7b)
• worker: apply build.target to worker bundle (#​22404) (3c93fde)
• worker: forward define to worker bundle transform (#​22408) (d4838a0)

Miscellaneous Chores

• deps: update dependency eslint-plugin-n to v18 (#​22423) (2fe7bd2)
• deps: update rolldown-related dependencies (#​22421) (66b9eb3)

v8.0.11

Compare Source

Features

• update rolldown to 1.0.0-rc.18 (#​22360) (3f80524)

Bug Fixes

• deps: update all non-major dependencies (#​22334) (672c962)
• deps: update all non-major dependencies (#​22382) (5c0cfcb)
• glob: align hmr matcher options with glob enumeration (#​22306) (30028f9)
• make separate object instance for each environment (#​22276) (7c2aa3b)

Documentation

• create-vite: list react-compiler templates in README (#​22347) (7c3a61f)
• explain mergeConfig skips null/undefined (#​22325) (2151f70)
• mention native config loader in CLI options (#​22348) (0420c5d)
• update evan's x handle (640202a)

Miscellaneous Chores

• deps: update dependency tsdown to ^0.21.10 ([#​22333](https://redirect.github.com/vitejs/vite/issues

✂ Note

PR body was truncated to here.

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • At any time (no schedule defined)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

[renovate]

⚠️ Artifact update problem

Renovate failed to update an artifact related to this branch. You probably do not want to merge this PR as-is.

♻ Renovate will retry this branch, including artifacts, only when one of the following happens:

• any of the package files in this branch needs updating, or
• the branch becomes conflicted, or
• you click the rebase/retry checkbox if found above, or
• you rename this PR's title to start with "rebase!" to trigger it manually

The artifact failure details are included below:

File name: astlib/ast2rust/core/Cargo.lock

Command failed: cargo update --config net.git-fetch-with-cli=true --manifest-path astlib/ast2rust/core/Cargo.toml --package bitflags@2.6.0 --precise 2.11.1
warning: virtual workspace defaulting to `resolver = "1"` despite one or more workspace members being on edition 2021 which implies `resolver = "2"`
  |
  = note: to keep the current resolver, specify `workspace.resolver = "1"` in the workspace root's manifest
  = note: to use the edition 2021 resolver, specify `workspace.resolver = "2"` in the workspace root's manifest
  = note: for more details see https://doc.rust-lang.org/cargo/reference/resolver.html#resolver-versions
error: package ID specification `bitflags@2.6.0` did not match any packages
help: there are similar package ID specifications:

  bitflags@2.8.0

[sisakulint]

Workflow Scan

🔴 8 Critical · 🟠 10 High · 🟡 18 Medium · ⚪ 4 Info

🔴 Critical - 8 findings

artifact-poisoning-critical - Untrusted artifact downloaded to a writable path - RCE possible.

  68 |       - name: Download rebrgen tool

📍 .github/workflows/unictest.yaml:68

artifact-poisoning-critical - Untrusted artifact downloaded to a writable path - RCE possible.

  73 |       - name: Download brgen tool

📍 .github/workflows/unictest.yaml:73

artifact-poisoning-critical - Untrusted artifact downloaded to a writable path - RCE possible.

 107 |       - name: Download shard results

📍 .github/workflows/unictest.yaml:107

artifact-poisoning-critical - Untrusted artifact downloaded to a writable path - RCE possible.

 149 |       - name: Download native tool

📍 .github/workflows/build.yml:149

artifact-poisoning-critical - Untrusted artifact downloaded to a writable path - RCE possible.

 154 |       - name: Download WASM web

📍 .github/workflows/build.yml:154

artifact-poisoning-critical - Untrusted artifact downloaded to a writable path - RCE possible.

 693 |       - name: Download brgen WASM lib

📍 .github/workflows/build.yml:693

artifact-poisoning-critical - Untrusted artifact downloaded to a writable path - RCE possible.

 698 |       - name: Download rebrgen WASM artifacts

📍 .github/workflows/build.yml:698

artifact-poisoning-critical - Untrusted artifact downloaded to a writable path - RCE possible.

 726 |       - name: Download unictest results

📍 .github/workflows/build.yml:726

🟠 High - 10 findings

cache-poisoning - Cache write reachable from untrusted input.

   1 | name: brgen-build

📍 .github/workflows/build.yml:1

cache-poisoning - Cache write reachable from untrusted input.

  34 |       - name: Cache rebrgen native

📍 .github/workflows/build.yml:34

cache-poisoning - Cache write reachable from untrusted input.

  97 |       - name: Cache rebrgen wasm

📍 .github/workflows/build.yml:97

cache-poisoning - Cache write reachable from untrusted input.

 196 |       - name: Cache

📍 .github/workflows/build.yml:196

cache-poisoning - Cache write reachable from untrusted input.

 275 |       - name: Cache

📍 .github/workflows/build.yml:275

cache-poisoning - Cache write reachable from untrusted input.

 341 |       - name: Cache

📍 .github/workflows/build.yml:341

cache-poisoning - Cache write reachable from untrusted input.

 436 |       - name: Cache

📍 .github/workflows/build.yml:436

cache-poisoning - Cache write reachable from untrusted input.

 498 |       - name: Cache

📍 .github/workflows/build.yml:498

cache-poisoning - Cache write reachable from untrusted input.

 623 |       - name: Cache

📍 .github/workflows/build.yml:623

permissions - Workflow grants overly broad permissions (write-all).

   1 | name: brgen-test

📍 .github/workflows/test.yml:1

🟡 Medium - 18 findings

artipacked - Persisted credentials may leak via artifacts.

  18 |       - name: Checkout repository

📍 .github/workflows/unictest.yaml:18

artipacked - Persisted credentials may leak via artifacts.

  39 |       - name: Checkout repository

📍 .github/workflows/unictest.yaml:39

artipacked - Persisted credentials may leak via artifacts.

 105 |       - name: Checkout repository

📍 .github/workflows/unictest.yaml:105

artipacked - Persisted credentials may leak via artifacts.

  23 |       - name: Checkout repository

📍 .github/workflows/build.yml:23

artipacked - Persisted credentials may leak via artifacts.

  79 |       - name: Checkout repository

📍 .github/workflows/build.yml:79

artipacked - Persisted credentials may leak via artifacts.

 147 |       - name: Checkout repository

📍 .github/workflows/build.yml:147

artipacked - Persisted credentials may leak via artifacts.

 184 |       - name: Checkout repository

📍 .github/workflows/build.yml:184

artipacked - Persisted credentials may leak via artifacts.

 254 |       - name: Checkout repository

📍 .github/workflows/build.yml:254

artipacked - Persisted credentials may leak via artifacts.

 332 |       - name: Checkout repository

📍 .github/workflows/build.yml:332

obfuscation - 'shell: cmd' in step 'Pull Utils'. CMD shell is difficult to analyze and may obfuscate malicious commands. Consider using PowerShell or bash.

 355 |         shell: cmd

📍 .github/workflows/build.yml:355

obfuscation - 'shell: cmd' in step 'Pack artifacts'. CMD shell is difficult to analyze and may obfuscate malicious commands. Consider using PowerShell or bash.

 368 |         shell: cmd

📍 .github/workflows/build.yml:368

artipacked - Persisted credentials may leak via artifacts.

 393 |       - name: Checkout repository

📍 .github/workflows/build.yml:393

artipacked - Persisted credentials may leak via artifacts.

 429 |       - name: Checkout repository

📍 .github/workflows/build.yml:429

artipacked - Persisted credentials may leak via artifacts.

 490 |       - name: Checkout repository

📍 .github/workflows/build.yml:490

artipacked - Persisted credentials may leak via artifacts.

 556 |       - name: Checkout repository

📍 .github/workflows/build.yml:556

artipacked - Persisted credentials may leak via artifacts.

 613 |       - name: Checkout

📍 .github/workflows/build.yml:613

artipacked - Persisted credentials may leak via artifacts.

 681 |       - name: Checkout

📍 .github/workflows/build.yml:681

artipacked - Persisted credentials may leak via artifacts.

  14 |       - name: Checkout repository

📍 .github/workflows/test.yml:14

⚪ Info - 4 findings

expression - Expression syntax issue.

 752 |     uses: ./.github/workflows/brgen-test.yaml

📍 .github/workflows/build.yml:752

expression - Expression syntax issue.

 756 |     uses: ./.github/workflows/puppeteer-test.yml

📍 .github/workflows/build.yml:756

workflow-call - workflow_call wiring issue.

 771 |     uses: ./.github/workflows/release.yml

📍 .github/workflows/build.yml:771

workflow-call - workflow_call wiring issue.

 780 |     uses: ./.github/workflows/deploy.yml

📍 .github/workflows/build.yml:780

---

Comment /autofix below to apply the suggested fixes automatically.