fix(deps): update all non-major dependencies by renovate[bot] · Pull Request #396 · on-keyday/brgen

renovate · 2026-07-25T19:13:09Z

ℹ️ Note

This PR body was truncated due to platform limits.

This PR contains the following updates:

Package	Change	Type	Update
@hono/node-server	`2.0.10` → `2.1.1`	dependencies	minor
@modelcontextprotocol/sdk (source)	`1.29.0` → `1.30.0`	dependencies	minor
Kesin11/actions-timeline	`v3.1` → `v3.2`	action	minor
actions/checkout	`v7.0.0` → `v7.0.1`	action	patch
bitflags	`2.6.0` → `2.13.1`	dependencies	minor
cicd-sensor/cicd-sensor-action	`v0.0.36` → `v0.0.38`	action	patch
clap	`4.6.2` → `4.6.6`	dependencies	patch
eslint (source)	`10.7.0` → `10.8.1`	devDependencies	minor
futures (source)	`0.3.33` → `0.3.34`	dependencies	patch
golang.org/x/net	`v0.57.0` → `v0.58.0`	require	minor
inkwell	`0.9.0` → `0.10.0`	dependencies	minor
jdx/mise-action	`v4.2.1` → `v4.2.5`	action	patch
monaco-editor	`^0.55.0` → `^0.56.0`	dependencies	minor
ossf/scorecard-action	`v2.4.3` → `v2.4.4`	action	patch
preact (source)	`10.29.7` → `10.29.8`	dependencies	patch
ruby/setup-ruby	`v1.319.0` → `v1.321.0`	action	minor
scala-cli	`1.15.0` → `1.16.0`	tools	minor
serde (source)	`1.0.204` → `1.0.229`	dependencies	patch
serde_derive (source)	`1.0.204` → `1.0.229`	dependencies	patch
serde_json	`1.0.120` → `1.0.151`	dependencies	patch
tokio (source)	`1.53.0` → `1.53.1`	dependencies	patch
tsx (source)	`4.23.1` → `4.23.12`	devDependencies	patch
typescript-eslint (source)	`8.64.0` → `8.67.0`	devDependencies	minor
wasm-bindgen (source)	`0.2.126` → `0.2.127`	dependencies	patch
zustand	`5.0.14` → `5.0.15`	dependencies	patch

Warning

Some dependencies could not be looked up. Check the Dependency Dashboard for more information.

Release Notes

honojs/node-server (@hono/node-server)

`v2.1.1`

Compare Source

What's Changed

perf: lazily materialize request headers by @BlankParticle in #389

Full Changelog: honojs/node-server@v2.1.0...v2.1.1

`v2.1.0`

Compare Source

What's Changed

feat: add Early Hints (HTTP 103) middleware by @bilal-azam in #378
fix(listener): avoid uncaught error when force-closing a non-standard socket by @mohamedramadan14 in #383

New Contributors

@bilal-azam made their first contribution in #378
@mohamedramadan14 made their first contribution in #383

Full Changelog: honojs/node-server@v2.0.12...v2.1.0

`v2.0.12`

Compare Source

What's Changed

test: replace supertest by @BlankParticle in #379
fix(response): copy headers when init is a foreign Response by @yusukebe in #382

Full Changelog: honojs/node-server@v2.0.11...v2.0.12

`v2.0.11`

Compare Source

What's Changed

test: use a custom helper for path traversal tests by @BlankParticle in #377
perf(request): fast-path QUERY methods by @usualoma in #376
perf(request): fast-path PATCH method by @yusukebe in #380

Full Changelog: honojs/node-server@v2.0.10...v2.0.11

modelcontextprotocol/typescript-sdk (@modelcontextprotocol/sdk)

`v1.30.0`

Compare Source

Kesin11/actions-timeline (Kesin11/actions-timeline)

`v3.2.0`

Compare Source

Changes

Support new parallel syntax.

Similar to composite action expansion, an overall parent span is created for steps executed in parallel. Child span names for steps running in parallel in the background are prefixed with (bg).

Sample screenshot:
https://github.com/user-attachments/assets/d92027fc-ded2-4b6e-9ab0-e3923b698ec3

Features

timeline: Render parallel steps concurrently @Kesin11 (#362)

Fixes

composite: Skip synthetic parallel parents @Kesin11 (#363)

Dependencies

13 changes

chore(deps): update node.js to v24.18.1 @renovate[bot] (#361)
chore(deps): update dependency deno to v2.9.4 @renovate[bot] (#360)
chore(deps): update jdx/mise-action action to v4.2.3 @renovate[bot] (#357)
chore(deps): update dependency deno to v2.9.3 @renovate[bot] (#356)
chore(deps): update actions/setup-node action to v7 @renovate[bot] (#355)
chore(deps): update auto merge major github-actions @renovate[bot] (#354)
chore(deps): update dependency deno to v2.9.2 @renovate[bot] (#353)
chore(deps): update dependency deno to v2.9.1 @renovate[bot] (#352)
chore(deps): update dependency deno to v2.9.0 @renovate[bot] (#351)
chore(deps): update dependency @std/collections to ^1.3.0 @renovate[bot] (#350)
chore(deps): update dependency @std/yaml to ^1.1.2 @renovate[bot] (#349)
chore(deps): update dependency @std/encoding to ^1.0.11 @renovate[bot] (#348)
chore(deps): update node.js to v24 @renovate[bot] (#346)

Internal improvement

Fix GitHub App token creation in rebundle workflow @Kesin11 (#359)
Using new parallel syntax for dogfooding @Kesin11 (#358)
fix: migrate release-drafter.yml to v7 config schema @Kesin11 (#347)

`v3.2`

Compare Source

actions/checkout (actions/checkout)

`v7.0.1`

Compare Source

Bump github/codeql-action from 3 to 4 by @dependabot[bot] in #2475
Bump actions/setup-node from 4 to 6 by @dependabot[bot] in #2477
Bump docker/build-push-action from 6.5.0 to 7.2.0 by @dependabot[bot] in #2478
Bump docker/login-action from 3.3.0 to 4.2.0 by @dependabot[bot] in #2479
Bump actions/checkout from 6 to 7 by @dependabot[bot] in #2488
Bump actions/upload-artifact from 4 to 7 by @dependabot[bot] in #2476
eslint 9 by @dependabot[bot] in #2474
Bump the minor-actions-dependencies group with 2 updates by @dependabot[bot] in #2499
skip running unsafe pr check if input is default by @aiqiaoy in #2518
trim only ascii whitespace for branch by @aiqiaoy in #2521
escape values passed to --unset by @aiqiaoy in #2530

bitflags/bitflags (bitflags)

`v2.13.1`

Compare Source

What's Changed

Lower the LLVM IR output of the generated output by @bolshoytoster in #492

New Contributors

@bolshoytoster made their first contribution in #492

Full Changelog: bitflags/bitflags@2.13.0...2.13.1

`v2.13.0`

Compare Source

What's Changed

add MyFlags::Abc::iter_equal_names() method by @ssrlive in #489

Full Changelog: bitflags/bitflags@2.12.1...2.13.0

`v2.12.1`

Compare Source

What's Changed

Rework the #[flag_name] feature and re-stabilize as #[bitflags(flag_name)] by @KodrAus in #487

Full Changelog: bitflags/bitflags@2.12.0...2.12.1

`v2.12.0`

Compare Source

Yanked

This release has been yanked because the #[flag_name] processing noticeably increases macro recursion, hitting the default limit in cases that are already close to it.

What's Changed

Add a custom #[flag_name] attribute by @KodrAus in #483
Add an all_named ctor for filtering out catch-all flags by @KodrAus in #484

Full Changelog: bitflags/bitflags@2.11.1...2.12.0

`v2.11.1`

Compare Source

What's Changed

Bless compile-fail tests for current beta by @DanielEScherzer in #478
example_generated.rs: add missing third slash for doc comment by @DanielEScherzer in #477
Clarify self and other in method docs by @KodrAus in #481

New Contributors

@DanielEScherzer made their first contribution in #478

Full Changelog: bitflags/bitflags@2.11.0...2.11.1

`v2.11.0`

Compare Source

What's Changed

Fix use of Result in macro output by @james7132 in #462
Add methods to get the known/unknown bits from a flags value by @WaterWhisperer in #473

New Contributors

@james7132 made their first contribution in #462
@WaterWhisperer made their first contribution in #473

Full Changelog: bitflags/bitflags@2.10.0...2.11.0

`v2.10.0`

Compare Source

What's Changed

Implement iterator for all named flags by @ssrlive in #465
Depend on serde_core instead of serde by @KodrAus in #467

New Contributors

@ssrlive made their first contribution in #465

Full Changelog: bitflags/bitflags@2.9.4...2.10.0

`v2.9.4`

Compare Source

What's Changed

Add Cargo features to readme by @KodrAus in #460

Full Changelog: bitflags/bitflags@2.9.3...2.9.4

`v2.9.3`

Compare Source

What's Changed

Streamline generated code by @nnethercote in #458

New Contributors

@nnethercote made their first contribution in #458

Full Changelog: bitflags/bitflags@2.9.2...2.9.3

`v2.9.2`

Compare Source

What's Changed

Fix difference in the spec by @KodrAus in #446
Fix up inaccurate docs on bitflags_match by @KodrAus in #453
Remove rustc internal crate feature by @KodrAus in #454

Full Changelog: bitflags/bitflags@2.9.1...2.9.2

`v2.9.1`

Compare Source

What's Changed

Document Cargo features by @KodrAus in #444

Full Changelog: bitflags/bitflags@2.9.0...2.9.1

`v2.9.0`

Compare Source

What's Changed

Flags trait: add clear(&mut self) method by @wysiwys in #437
Fix up UI tests by @KodrAus in #438

Full Changelog: bitflags/bitflags@2.8.0...2.9.0

`v2.8.0`

Compare Source

What's Changed

feat(core): Add bitflags_match macro for bitflag matching by @YuniqueUnic in #423
Finalize bitflags_match by @KodrAus in #431

New Contributors

@YuniqueUnic made their first contribution in #423

Full Changelog: bitflags/bitflags@2.7.0...2.8.0

`v2.7.0`

Compare Source

What's Changed

Fix clippy::doc_lazy_continuation lints by @waywardmonkeys in #414
Run clippy on extra features in CI. by @waywardmonkeys in #415
Fix CI: trybuild refresh, allow some clippy restrictions. by @waywardmonkeys in #417
Update zerocopy version in example by @KodrAus in #422
Add method to check if unknown bits are set by @wysiwys in #426
Update error messages by @KodrAus in #427
Add truncate(&mut self) method to unset unknown bits by @wysiwys in #428
Update error messages by @KodrAus in #429

New Contributors

@wysiwys made their first contribution in #426

Full Changelog: bitflags/bitflags@2.6.0...2.7.0

cicd-sensor/cicd-sensor-action (cicd-sensor/cicd-sensor-action)

`v0.0.38`

Compare Source

Released by @rung via workflow run.

Highlights

Reliable log delivery during runner teardown

The systemd stop window is extended (TimeoutStopSec=30s, agent --shutdown-grace=20s) so the agent can finish sending buffered logs and the Summary Log before the runner VM is destroyed — verified on GitHub-hosted ubuntu-24.04 runners. Combined with the bundled agent v0.0.45 (cicd-sensor/cicd-sensor#143), this fixes the silent log loss on short jobs.

What's Changed

chore(deps): lock file maintenance by @renovate[bot] in #33
chore(deps): update github actions by @renovate[bot] in #39
fix: align managed agent shutdown timing by @rung in #40
chore(deps): update dependency cicd-sensor/cicd-sensor to v0.0.45 by @renovate[bot] in #41

Full Changelog: cicd-sensor/cicd-sensor-action@v0.0.37...v0.0.38

`v0.0.37`

Compare Source

Released by @rung via workflow run.

Highlights

Third-party Manager token support

This release updates the bundled cicd-sensor to v0.0.44. The Agent now treats Manager bearer tokens as opaque credentials and no longer validates their format. Token format and value validation are delegated to the Manager, allowing third-party Manager implementations to use JWTs, short-lived tokens, custom API keys, or other authentication formats.

The built-in cicd-sensor Manager continues to require the sk_cs_ token format generated by cicd-sensorctl token generate.

What's Changed

chore(deps): update dependency cicd-sensor/cicd-sensor to v0.0.44 by @renovate[bot] in #37
chore(deps): update github actions by @renovate[bot] in #36

Full Changelog: cicd-sensor/cicd-sensor-action@v0.0.36...v0.0.37

clap-rs/clap (clap)

`v4.6.6`

Compare Source

Features

Add Command::get_overridden_usage

`v4.6.5`

Compare Source

`v4.6.4`

Compare Source

Internal

Update to syn v3

`v4.6.3`

Compare Source

Fixes

(derive) Allow "literal".function() as attribute values

eslint/eslint (eslint)

`v10.8.1`

Compare Source

Bug Fixes

18eb0a7 fix: prevent ASI hazard in no-unused-labels autofix (#21173) (dongkyu lee)
151ba3f fix: false positives in getter-return and accessor-pairs (#21163) (Grit)
6898df9 fix: ignore meta-property names in id-denylist (#21166) (Pixel)
4d7db66 fix: ignore meta-property names in id-match (#21167) (Pixel)
677214e fix: handle ASI hazards in no-unused-vars removeVar suggestion (#20935) (kuldeep kumar)

Documentation

7d0cbf8 docs: Update README (GitHub Actions Bot)
0a05812 docs: add missing backticks to no-duplicate-imports.js (#21183) (Lee Daeun)
678c90b docs: Update README (GitHub Actions Bot)
8a10424 docs: Update README (GitHub Actions Bot)
69bb948 docs: Update README (GitHub Actions Bot)

Chores

0a14800 chore: update github/codeql-action action to v4.37.4 (#21196) (renovate[bot])
05adcb1 test: fix failing ecosystem test for eslint-plugin-unicorn (#21191) (Lazizbek Ergashev)
5611035 test: add error locations info to no-void (#21185) (Lee Daeun)
ee47333 ci: bump github/codeql-action from 4 to 4.37.3 (#21176) (dependabot[bot])
f131c03 chore: improve ecosystem test failure reporting (#20937) (crimsonjay0)
1f6edde chore: update ecosystem plugins (#21182) (ESLint Bot)
d3266fb chore: unpin webpack dependency (#21172) (Francesco Trotta)
65a6519 chore: add allowScripts field to package.json (#21092) (GiHoon Noh)
22e5256 ci: add triage:no label to Dependabot PRs (#21141) (lumir)
55c9038 ci: bump actions/labeler from 6 to 7 (#21159) (dependabot[bot])
7280e78 chore: update dependency prettier to v3.9.6 (#21162) (renovate[bot])
eddbad6 test: fix failing ecosystem test for eslint-plugin-unicorn (#21156) (Francesco Trotta)
60a178d chore: update ecosystem plugins (#21150) (ESLint Bot)
f9f61dc test: add error locations to no-unreachable (#21151) (JIYEON)
d086293 test: add error locations to no-undef (#21147) (JIYEON)
cc01b67 test: add error locations to no-useless-catch (#21144) (devoil)
688e75e chore: add missing backticks in JSDoc (#21143) (Bo Hyun Kim)
7c1e175 test: add error locations to require-await (#21145) (Grit)
588a26d test: add error locations to no-extra-label (#21139) (dongkyu lee)
059aa89 test: add error locations to no-useless-concat (#21140) (dongkyu lee)
5a452a8 test: add error locations to no-const-assign (#21138) (dongkyu lee)

`v10.8.0`

Compare Source

Features

2fee9bb feat: export ConfigObject from eslint/config (#21082) (sethamus)

Bug Fixes

6b8d2f7 fix: escape reserved characters in rule id in html formatter (#21129) (Francesco Trotta)
9091071 fix: prevent no-unreachable-loop crash when all loop types are ignored (#21116) (Pixel)
e23fafe fix: prefer-object-spread add semicolon when adding parenthesis (#21081) (synthex-byte)
20b5ad0 fix: quadratic-time regex in prefer-template (#21096) (Milos Djermanovic)
8b6f6c0 fix: apply ignore configs to computed methods in class-methods-use-this (#21094) (Pixel)
b2c608c fix: NewExpression with parenthesized callee in preserve-caught-error (#21083) (Francesco Trotta)

Documentation

6ddf858 docs: fix broken Specify Parser Options anchor link (#21106) (Minsu)
784dfbe docs: Clarify no-eq-null description (#21120) (Park Harin)
7ec733a docs: Fix typos and grammar in glossary (#21095) (Marry (Subin Yang))
92bb13f docs: replace quake link (#21108) (Jung Hyeon Jun)
68eb4a5 docs: fix broken Specify Globals anchor links in rule pages (#21103) (Minsu)
d28f697 docs: replace Code Climate CLI links with Qlty CLI links (#21099) (Jung Hyeon Jun)
eccc68d docs: correct --suppressions-location option description (#21093) (Ga eun Lee)
c5963f7 docs: Update README (GitHub Actions Bot)

Chores

4fbf46d test: pin webpack version to 5.108.4 (#21137) (Francesco Trotta)
2d063e2 chore: update HTTP URLs to HTTPS in JSDoc and comments (#21101) (Bo Hyun Kim)
eccbe7b test: add error locations to no-class-assign (#21123) (devoil)
e7d1e43 ci: bump actions/setup-go from 6 to 7 (#21118) (dependabot[bot])
e9d66d0 ci: bump actions/setup-node from 6 to 7 (#21119) (dependabot[bot])
ee225b6 test: Add error location details to no-eq-null rule (#21117) (Park Harin)
044a627 chore: update minimatch to ^10.2.5 (#21107) (김채영)
fb09aa8 chore: update ecosystem plugins (#21115) (ESLint Bot)
5abd878 test: add error locations to no-proto (#21114) (Gihyeon Jeong / 정기현)
9715887 test: Add error location details to no-div-regex (#21110) (Park Harin)
a746ec6 test: add error locations to no-new-wrappers (#21109) (Gihyeon Jeong / 정기현)
8dde645 test: add error locations to no-ex-assign (#21102) (devoil)
13ab0ec test: add error locations to no-label-var (#21098) (Gihyeon Jeong / 정기현)
a99906f test: Add error location details to no-delete-var rule (#21105) (Park Harin)
c47e8dc chore: add missing backticks to languages/js/index.js (#21104) (beeen)
0174428 chore: add missing backticks to translate-cli-options.js (#21097) (dongkyu lee)
3d36589 chore: add missing backticks to serialization.js (#21091) (이규환)
dcc9312 test: add error locations to eqeqeq (#21090) (Ga eun Lee)
2710b18 ci: Add explicit permissions to rebuild-docs-sites workflow (#21089) (Marry (Subin Yang))
5d2f866 chore: update dependency prettier to v3.9.5 (#21086) (renovate[bot])
d584e31 chore: fix failing ecosystem test for eslint-plugin-unicorn (#21084) (Francesco Trotta)
bf3eda0 chore: update ecosystem plugins (#21079) (ESLint Bot)

rust-lang/futures-rs (futures)

`v0.3.34`

Compare Source

Preserve cloned waker identity. (#3032)
Updato syn to 3. (#3028)

TheDan64/inkwell (inkwell)

`v0.10.0`

Compare Source

What's Changed

Fixes get_current_debug_location error. by @ErisianArchitect in #683
Fixes bug in write_bitcode_to_file in #6. by @ErisianArchitect in #685
Swaps raw pointer types with NonNull for better safety and niches by @ErisianArchitect in #687
Added /.zed/ to .gitignore by @ErisianArchitect in #692
feat(values): derive Clone and Copy for CallableValue (#346) by @mvanhorn in #693
Made this code not weird. by @ErisianArchitect in #694
Fixes #695: Underflow in create_from_memory_range. by @ErisianArchitect in #696
Upgrade to syn 3.0 by @Pat-Lafon in #698
Removal of support for LLVM 11 by @TheDan64 in 91b30c0

New Contributors

@mvanhorn made their first contribution in #693

Full Changelog: TheDan64/inkwell@0.9.0...0.10.0

jdx/mise-action (jdx/mise-action)

`v4.2.5`: : Resilient mise downloads with automatic retries

Compare Source

A small patch release that makes setup more resilient to transient network failures when downloading mise.

Fixed

Retry mise downloads after transient failures (#597 by @jdx)

The download helpers previously made a single curl or wget attempt, so a transient GitHub release-asset HTTP or TLS failure would abort setup before mise or any user command could run (see #596).

Downloads now run through a retry wrapper that makes up to five attempts with a 2s pause between failures, logging a warning on each retry. This applies consistently to binary, checksum, signature, and version fetches. Checksum and minisign verification still run only after a successful download — never inside the retry loop — so integrity guarantees are unchanged.

Full Changelog: jdx/mise-action@v4.2.4...v4.2.5

`v4.2.4`: : Reliable locking detection under forced color

Compare Source

A small patch release that fixes locking-support detection when workflows force colored output.

Fixed

Detect `mise install --locked` reliably under forced color (#580 by @scop)

When colored output was forced globally (for example via CLICOLOR_FORCE=1), ANSI escape codes in mise install --help prevented the action from matching --locked in the help text, so locking support was reported as unavailable even on versions of mise that supported it.

The help probe now runs with NO_COLOR=1 in its environment, which overrides CLICOLOR_FORCE and guarantees plain-text output for the feature detection — regardless of the surrounding workflow's color settings.

Full Changelog: jdx/mise-action@v4.2.3...v4.2.4

✂ Note

PR body was truncated to here.

Configuration

📅 Schedule: (UTC)

Branch creation
- At any time (no schedule defined)
Automerge
- At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

If you want to rebase/retry this PR, check this box

This PR was generated by Mend Renovate. View the repository job log.

renovate · 2026-07-25T19:13:11Z

⚠️ Artifact update problem

Renovate failed to update an artifact related to this branch. You probably do not want to merge this PR as-is.

♻ Renovate will retry this branch, including artifacts, only when one of the following happens:

any of the package files in this branch needs updating, or
the branch becomes conflicted, or
you click the rebase/retry checkbox if found above, or
you rename this PR's title to start with "rebase!" to trigger it manually

The artifact failure details are included below:

File name: astlib/ast2rust/core/Cargo.lock

Command failed: cargo update --config net.git-fetch-with-cli=true --manifest-path astlib/ast2rust/core/Cargo.toml --package bitflags@2.6.0 --precise 2.13.1
warning: virtual workspace defaulting to `resolver = "1"` despite one or more workspace members being on edition 2021 which implies `resolver = "2"`
  |
  = note: to keep the current resolver, specify `workspace.resolver = "1"` in the workspace root's manifest
  = note: to use the edition 2021 resolver, specify `workspace.resolver = "2"` in the workspace root's manifest
  = note: for more details see https://doc.rust-lang.org/cargo/reference/resolver.html#resolver-versions
error: package ID specification `bitflags@2.6.0` did not match any packages
help: there are similar package ID specifications:

  bitflags@2.8.0

sisakulint · 2026-07-25T19:13:15Z

Workflow Scan

🔴 6 Critical · 🟠 12 High · 🟡 23 Medium · ⚪ 1 Info

🔴 Critical - 6 findings

artifact-poisoning-critical - Untrusted artifact downloaded to a writable path - RCE possible.

  75 |       - name: Download rebrgen tool

📍 .github/workflows/unictest.yaml:75

artifact-poisoning-critical - Untrusted artifact downloaded to a writable path - RCE possible.

  80 |       - name: Download brgen tool

📍 .github/workflows/unictest.yaml:80

artifact-poisoning-critical - Untrusted artifact downloaded to a writable path - RCE possible.

 126 |       - name: Download shard results

📍 .github/workflows/unictest.yaml:126

artifact-poisoning-critical - Untrusted artifact downloaded to a writable path - RCE possible.

  21 |       - name: Download artifact

📍 .github/workflows/puppeteer-test.yml:21

artifact-poisoning-critical - Untrusted artifact downloaded to a writable path - RCE possible.

  32 |       - name: Download rebrgen WASM artifacts

📍 .github/workflows/puppeteer-test.yml:32

artifact-poisoning-critical - Untrusted artifact downloaded to a writable path - RCE possible.

  42 |       - name: Download unictest results from triggering run

📍 .github/workflows/unictest-history.yaml:42

🟠 High - 12 findings

commit-sha - Action reference is not pinned to a full-length commit SHA.

  75 |       - name: "Upload to code-scanning"

📍 .github/workflows/scorecard.yml:75

cache-poisoning - Cache write reachable from untrusted input.

   1 | name: brgen-build

📍 .github/workflows/build.yml:1

cache-poisoning - Cache write reachable from untrusted input.

  38 |       - name: Cache rebrgen native

📍 .github/workflows/build.yml:38

cache-poisoning - Cache write reachable from untrusted input.

 101 |       - name: Cache rebrgen wasm

📍 .github/workflows/build.yml:101

cache-poisoning - Cache write reachable from untrusted input.

 204 |       - name: Cache

📍 .github/workflows/build.yml:204

cache-poisoning - Cache write reachable from untrusted input.

 288 |       - name: Cache

📍 .github/workflows/build.yml:288

cache-poisoning - Cache write reachable from untrusted input.

 359 |       - name: Cache

📍 .github/workflows/build.yml:359

cache-poisoning - Cache write reachable from untrusted input.

 460 |       - name: Cache

📍 .github/workflows/build.yml:460

cache-poisoning - Cache write reachable from untrusted input.

 527 |       - name: Cache

📍 .github/workflows/build.yml:527

cache-poisoning - Cache write reachable from untrusted input.

 657 |       - name: Cache

📍 .github/workflows/build.yml:657

permissions - Workflow grants overly broad permissions (write-all).

   1 | name: brgen-test

📍 .github/workflows/test.yml:1

untrusted-checkout - Checkout of attacker-controlled ref.

  39 |           ref: ${{ github.event.workflow_run.head_sha }}

📍 .github/workflows/unictest-history.yaml:39

🟡 Medium - 23 findings

artipacked - Persisted credentials may leak via artifacts.

  18 |       - name: Checkout repository

📍 .github/workflows/unictest.yaml:18

artipacked - Persisted credentials may leak via artifacts.

  46 |       - name: Checkout repository

📍 .github/workflows/unictest.yaml:46

artipacked - Persisted credentials may leak via artifacts.

 124 |       - name: Checkout repository

📍 .github/workflows/unictest.yaml:124

artipacked - Persisted credentials may leak via artifacts.

  23 |       - name: Checkout repository

📍 .github/workflows/build.yml:23

artipacked - Persisted credentials may leak via artifacts.

  83 |       - name: Checkout repository

📍 .github/workflows/build.yml:83

artipacked - Persisted credentials may leak via artifacts.

 151 |       - name: Checkout repository

📍 .github/workflows/build.yml:151

artipacked - Persisted credentials may leak via artifacts.

 188 |       - name: Checkout repository

📍 .github/workflows/build.yml:188

artipacked - Persisted credentials may leak via artifacts.

 263 |       - name: Checkout repository

📍 .github/workflows/build.yml:263

dependabot-ecosystem - package ecosystem "gomod" is used (detected from actions/setup-go) but not configured in dependabot. Add a package-ecosystem entry to .github/dependabot.yaml so dependency updates are automated. See https://sisaku-security.github.io/lint/docs/rules/dependabotecosystemrule/

 268 |         uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0

📍 .github/workflows/build.yml:268

artipacked - Persisted credentials may leak via artifacts.

 346 |       - name: Checkout repository

📍 .github/workflows/build.yml:346

obfuscation - 'shell: cmd' in step 'Pull Utils'. CMD shell is difficult to analyze and may obfuscate malicious commands. Consider using PowerShell or bash.

 373 |         shell: cmd

📍 .github/workflows/build.yml:373

obfuscation - 'shell: cmd' in step 'Pack artifacts'. CMD shell is difficult to analyze and may obfuscate malicious commands. Consider using PowerShell or bash.

 387 |         shell: cmd

📍 .github/workflows/build.yml:387

artipacked - Persisted credentials may leak via artifacts.

 413 |       - name: Checkout repository

📍 .github/workflows/build.yml:413

dependabot-ecosystem - package ecosystem "npm" is used (detected from actions/setup-node) but not configured in dependabot. Add a package-ecosystem entry to .github/dependabot.yaml so dependency updates are automated. See https://sisaku-security.github.io/lint/docs/rules/dependabotecosystemrule/

 416 |         uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0

📍 .github/workflows/build.yml:416

artipacked - Persisted credentials may leak via artifacts.

 449 |       - name: Checkout repository

📍 .github/workflows/build.yml:449

artipacked - Persisted credentials may leak via artifacts.

 515 |       - name: Checkout repository

📍 .github/workflows/build.yml:515

artipacked - Persisted credentials may leak via artifacts.

 586 |       - name: Checkout repository

📍 .github/workflows/build.yml:586

dependabot-ecosystem - package ecosystem "bundler" is used (detected from ruby/setup-ruby) but not configured in dependabot. Add a package-ecosystem entry to .github/dependabot.yaml so dependency updates are automated. See https://sisaku-security.github.io/lint/docs/rules/dependabotecosystemrule/

 613 |         uses: ruby/setup-ruby@95ef2b042f9d7a56d8268cba8559e2842e2ad01b # v1.321.0

📍 .github/workflows/build.yml:613

artipacked - Persisted credentials may leak via artifacts.

 643 |       - name: Checkout

📍 .github/workflows/build.yml:643

artipacked - Persisted credentials may leak via artifacts.

 715 |       - name: Checkout

📍 .github/workflows/build.yml:715

artipacked - Persisted credentials may leak via artifacts.

  14 |       - name: Checkout repository

📍 .github/workflows/test.yml:14

artipacked - Persisted credentials may leak via artifacts.

  19 |       - name: Checkout repository

📍 .github/workflows/puppeteer-test.yml:19

artipacked - Persisted credentials may leak via artifacts.

  36 |       - name: Checkout tested commit

📍 .github/workflows/unictest-history.yaml:36

⚪ Info - 1 finding

dependabot-github-actions - Dependabot config issue for github-actions ecosystem.

   1 | # This workflow uses actions that are not certified by GitHub. They are provided

📍 .github/workflows/scorecard.yml:1

Comment /autofix below to apply the suggested fixes automatically.

✅ 3 clean files

✅ .github/workflows/deploy.yml
✅ .github/workflows/release.yml
✅ .github/workflows/brgen-test.yaml

renovate Bot force-pushed the renovate/all-minor-patch branch 9 times, most recently from f5cfa2d to a0fcf36 Compare August 1, 2026 18:34

renovate Bot force-pushed the renovate/all-minor-patch branch 17 times, most recently from 575da3c to c3d0dbf Compare August 9, 2026 05:56

renovate Bot force-pushed the renovate/all-minor-patch branch 2 times, most recently from 51b8616 to 58f51d7 Compare August 10, 2026 19:17

renovate Bot force-pushed the renovate/all-minor-patch branch 3 times, most recently from 845e25b to 22b9a40 Compare August 13, 2026 12:02

fix(deps): update all non-major dependencies

90b308d

renovate Bot force-pushed the renovate/all-minor-patch branch from 22b9a40 to 90b308d Compare August 14, 2026 03:12

Navigation Menu

fix(deps): update all non-major dependencies - #396

fix(deps): update all non-major dependencies#396
renovate[bot] wants to merge 1 commit into
mainfrom
renovate/all-minor-patch

renovate Bot commented Jul 25, 2026 •

edited

Loading

Uh oh!

renovate Bot commented Jul 25, 2026

Uh oh!

sisakulint Bot commented Jul 25, 2026 •

edited

Loading

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants

Conversation

renovate Bot commented Jul 25, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Release Notes

What's Changed

What's Changed

New Contributors

What's Changed

What's Changed

Changes

Features

Fixes

Dependencies

Internal improvement

What's Changed

New Contributors

What's Changed

What's Changed

Yanked

What's Changed

What's Changed

New Contributors

What's Changed

New Contributors

What's Changed

New Contributors

What's Changed

What's Changed

New Contributors

What's Changed

What's Changed

What's Changed

What's Changed

New Contributors

What's Changed

New Contributors

Highlights

Reliable log delivery during runner teardown

What's Changed

Highlights

Third-party Manager token support

What's Changed

Features

Internal

Fixes

Bug Fixes

Documentation

Chores

Features

Bug Fixes

Documentation

Chores

What's Changed

New Contributors

v4.2.5: : Resilient mise downloads with automatic retries

Fixed

Retry mise downloads after transient failures (#​597 by @​jdx)

v4.2.4: : Reliable locking detection under forced color

Fixed

Detect mise install --locked reliably under forced color (#​580 by @​scop)

Configuration

Uh oh!

renovate Bot commented Jul 25, 2026

⚠️ Artifact update problem

File name: astlib/ast2rust/core/Cargo.lock

Uh oh!

sisakulint Bot commented Jul 25, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Workflow Scan

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants

renovate Bot commented Jul 25, 2026 •

edited

Loading

`v4.2.5`: : Resilient mise downloads with automatic retries

Retry mise downloads after transient failures (#597 by @jdx)

`v4.2.4`: : Reliable locking detection under forced color

Detect `mise install --locked` reliably under forced color (#580 by @scop)

sisakulint Bot commented Jul 25, 2026 •

edited

Loading