Skip to content

fix(deps): update all non-major dependencies - #1

Open
renovate[bot] wants to merge 1 commit into
mainfrom
renovate/all-minor-patch
Open

fix(deps): update all non-major dependencies#1
renovate[bot] wants to merge 1 commit into
mainfrom
renovate/all-minor-patch

Conversation

@renovate

@renovate renovate Bot commented Nov 2, 2026 •
edited
Loading

Copy link
Copy Markdown

Note

This PR body was truncated due to platform limits.

This PR contains the following updates:

Package Change Age Confidence Type Update
@swc-contrib/plugin-graphql-codegen-client-preset (source) 0.32.0 → 0.37.2 age confidence devDependencies minor
@tanstack/react-query (source) 5.105.1 → 5.107.1 age confidence dependencies minor
@tanstack/router-plugin (source) 1.168.48 → 1.169.0 age confidence devDependencies minor
github.com/fsnotify/fsnotify v1.9.0 → v1.10.1 age confidence require minor
github.com/iodesystems/gwag/v2 v2.9.0 → v2.11.0 age confidence require minor
github.com/spf13/pflag v1.0.10 → v1.1.0 age confidence require minor
go 1.26 → 1.27 age confidence uses-with minor
golangci/golangci-lint v2.12.2 → v2.15.0 age confidence uses-with minor
graphql 16.14.2 → 16.15.0 age confidence dependencies minor
mermaid 12.2.0 → 12.3.0 age confidence dependencies minor
modernc.org/sqlite v1.59.0 → v1.62.0 age confidence require minor
oxlint (source) 1.90.0 → 1.92.0 age confidence devDependencies minor
oxlint-tsgolint 7.0.2005 → 7.0.2006 age confidence devDependencies patch
playwright (source) 1.64.1 → 1.65.0 age confidence devDependencies minor
pnpm (source) 10.27.0 → 10.34.9 age confidence packageManager minor
vite (source) 8.3.5 → 8.3.6 age confidence devDependencies patch
vitest (source) 5.0.5 → 5.1.0 age confidence devDependencies minor

Release Notes

swc-project/plugins (@​swc-contrib/plugin-graphql-codegen-client-preset)

v0.37.2

Patch Changes
  • ea2665b: Update swc_core to 84.0.1.

v0.37.1

Patch Changes
  • Update swc_core to 83.0.0.

v0.37.0

Minor Changes
  • 1fa243d: Update swc_core to 82.2.0.

v0.36.0

Minor Changes
  • 5c6d86d: Update swc_core to 82.0.0.

v0.35.0

Minor Changes
  • e995ea5: build!: Update swc_core to v81.0.2
Patch Changes
  • 1a64141: Reuse existing boxed expressions instead of allocating new boxes, fixing clippy::replace_box warnings without changing transform behavior.

v0.34.0

Minor Changes
  • 27f28a4: build!: Update swc_core to v81.0.0

v0.33.0

Minor Changes
  • a9a7fe9: build!: Update swc_core to v78.0.0
TanStack/query (@​tanstack/react-query)

v5.107.1

Compare Source

Patch Changes

v5.107.0

Compare Source

Patch Changes

v5.106.1

Compare Source

Patch Changes

v5.106.0

Compare Source

Patch Changes

v5.105.3

Compare Source

Patch Changes

v5.105.2

Compare Source

Patch Changes
TanStack/router (@​tanstack/router-plugin)

v1.169.0

Compare Source

Minor Changes

  • #​8855 446ce1b - Require Node ^20.19.0 || >=22.12.0 (was >=20.19), so the CommonJS builds can load ESM-only dependencies through require(esm). Node 21 and Node 22.0–22.11 do not enable it by default, so they are no longer supported.

  • #​8851 d250819 - Require Vite 6 or later: the vite peer range is now >=6.0.0. Vite 5 is no longer supported.

Patch Changes

  • 1ba19a0 - fix: webpack and Rspack production builds no longer put the code splitter's "will not be code-split" warning, with the route file's absolute path, into the client bundle when the build process's NODE_ENV isn't production. The bundler's mode decides, and a config without mode counts as production, as it does for webpack and Rspack. The warning still prints in the build output.

  • #​8852 94f36c4 - The esbuild plugin now throws when autoCodeSplitting is enabled, and TanStackRouterCodeSplitterEsbuild throws, instead of silently bundling every route without splitting. Route generation with esbuild is unchanged.

  • #​8856 533ca27 - Remove the undocumented plugin.hmr.style option and the HmrOptions type. Each bundler entry now picks its own HMR runtime: the webpack and Rspack entries already forced 'webpack', and on Vite, 'webpack' broke route HMR.

  • #​8853 13b6256 - Remove internal code-splitter APIs: the codeSplittingOptions.compilerPlugins option, and the root-entry exports unpluginRouterCodeSplitterFactory, getObjectPropertyKeyName, CodeSplitCompilerPlugin, ReferenceRouteCompilerPlugin, ReferenceRouteCompilerPluginContext and VirtualRouteSplitNodeCompilerPluginContext.

  • #​8860 b5e2ac9 - Source maps of split routes now point at the route file. On webpack and Rspack (including Rsbuild), a split component or shared code mapped to the wrong line, because unplugin's loader dropped the router plugin's map; unplugin now requires ^3.5.0, which keeps it. The maps of split and shared modules also name the route file itself instead of its ?tsr-split / ?tsr-shared module id, so debuggers bind breakpoints set in the route file.

  • #​8870 f420d4a - Vite route HMR now writes import.meta.hot.accept( out instead of calling it through a hot alias. Vite only treats a module as a hot boundary when the call is spelled out, so an edit of a route file no framework plugin accepts (a .ts route file, or an app without @vitejs/plugin-react) reloaded the page instead of updating the route in place. With React HMR, a route file that declares its own top-level hot binding no longer fails to compile with Duplicate declaration "hot".

  • Updated dependencies [446ce1b, ad5b3b7, ff157f0]:

fsnotify/fsnotify (github.com/fsnotify/fsnotify)

v1.10.1

Compare Source

Changes and fixes

  • inotify: don't remove sibling watches sharing a path prefix (#​754)

  • inotify, windows: don't rename sibling watches sharing a path prefix
    (#​755)

v1.10.0

Compare Source

This version of fsnotify needs Go 1.23.

Changes and fixes

  • inotify: improve initialization error message (#​731)

  • inotify: send Rename event if recursive watch is renamed (#​696)

  • inotify: avoid copying event buffers when reading names (#​741)

  • kqueue: skip dangling symlinks (ENOENT) in watchDirectoryFiles, so a bad entry no longer aborts Watcher.Add for the whole directory (#​748)

  • kqueue: drop watches directly in Close() to fix a file descriptor leak when recycling watchers (#​740)

  • windows: fix nil pointer dereference in remWatch (#​736)

  • windows: lock watch field updates against concurrent WatchList to fix a race introduced in v1.9.0 (#​709, #​749)

iodesystems/gwag (github.com/iodesystems/gwag/v2)

v2.11.0

Compare Source

GraphQL error extensions default to gat's {status, code} shape (see Migration), proto lists render non-null elements, Connect ingress in the gwag binary, gRPC for gat BYO OpenAPI ops, and a sweep of export, validation and ingress fixes.

Added
  • gwag binary (gwag up, plain serve, gwag serve --graphql / --mcp) mounts gw.ConnectHandler() at /api/connect/: every registered proto service over Connect, gRPC-Web and gRPC (/api/connect/package.Service/Method).
  • gat RegisterGRPC serves the OpenAPI operations of a BYO ServiceRegistration (unary, and itemSchema streams as server streams). They were in the GraphQL schema and the rendered proto, but a gRPC client got Unimplemented. Nested lists and maps are unboxed on the way in and boxed on the way out.
  • WithLegacyErrorCodes() (experimental) keeps the GraphQL error extensions from before v2.11 ({code: "NOT_FOUND"} on a Reject, no code on other errors). For migration; removed in v3.
Changed
  • OpenAPI streamed responses (SSE, JSONL, NDJSON, json-seq): an item that fails to decode is skipped and logged (rate limited) instead of ending the subscription with an error. The subscriber sees no event for it. Errors from the body itself still end the stream. ir.OpenAPIStreamReader.Next no longer returns decode errors; OnSkip reports them.
  • REST ingress: an OpenAPI or GraphQL upstream that fails on a context deadline answers 504 (was 500), and one that fails on cancellation answers 499 (was 500). gat.ErrorCode now checks context.Canceled / DeadlineExceeded ahead of a GetStatus() method, so the gRPC ingress gives DeadlineExceeded / Canceled for the same errors (was Internal).
  • Base64 validation (WithValidation / gat Validation) now also covers multipart string parts that are not file uploads, and oneOf / anyOf with several branches (passes when any branch of matching JSON type accepts). Responses are checked in warn mode only and never fail a call.
  • GraphQL error extensions default to gat's shape, {status: 404, code: "not_found"}: the lower-case gRPC code the gRPC and REST ingresses give the same error, plus its HTTP status, on every dispatch error. Was the upper-case Code name on a Reject and no code otherwise; an upstream 409 is now already_exists (was INVALID_ARGUMENT). Planned for v3, moved forward.
  • Proto list fields render non-null elements: [Book!] (was [Book]), in GraphQL and in the OpenAPI export. A proto list element can never be null. Input lists now refuse a null element at validation.
Deprecated
  • WithConnectErrorCodes() does nothing; its shape is the default.
Fixed
  • gat BYO OpenAPI dispatch errors carry the upstream HTTP status, so an upstream 404 / 409 / 503 is NotFound / AlreadyExists / Unavailable over gRPC and has status / code GraphQL error extensions, instead of Internal with none. Transport failures are 502, undecodable responses 502, argument validation 400.
  • gRPC ingress: two proto slots declaring the same fully-qualified procedure were served by a random one per schema rebuild. The first slot in (namespace, version) order now serves it, and each rebuild logs one warning per service naming the serving and skipped slots.
  • OpenAPI 3.1 to 3.0 downgrade: an operation whose security was only mutualTLS lost its security and inherited the document-level requirements, so it read stricter than the source. It now gets security: []; the original stays in x-gwag-oas31 and returns on the way back to 3.1.
  • OpenAPI export dropped nullability on fields it built from the IR (GraphQL, proto and MCP origins). A list element that may be null ([Int], [[Int]!]) now renders items with nullable: true (3.0) or type: [X, "null"] / oneOf: [$ref, {type: null}] (3.1); a $ref element becomes allOf: [$ref], nullable: true. A required-but-nullable field renders nullable. Re-ingest gives the same nullability.
  • Cross-kind OpenAPI export (GraphQL or proto origin): an op's list parameter, list request body and list response exported as the element schema. They export as arrays now; map args as objects.
Migration
  • GraphQL clients that match extensions.code against upper-case names (NOT_FOUND) must match lower-case gRPC codes (not_found), or the server sets WithLegacyErrorCodes() until they do. Codes can also differ beyond case: an upstream 409 is already_exists, an upstream 502/503/504 is unavailable.

v2.10.0

Compare Source

Nested lists and maps: [][2]float64, [[T]] and map of map render and dispatch correctly over GraphQL, OpenAPI and gRPC, and inline JSON literals parse.

Added
  • ir.TypeRef.List / ir.ListType (experimental): the element of a repeated slot can itself be a list, with its own element nullability. TypeRef.IsList() and TypeRef.Leaf() go with it. ir.IsListRow(md) and ir.IsMapValueBox(md) identify the proto row and map-value boxes.
Fixed
  • Nested lists flattened. An OpenAPI array of array (huma [][2]float64), a downstream-GraphQL [[T]], and an MCP array of array rendered as [T], so a query that sent [[1,2]] failed validation. They now render as nested GraphQL lists in both directions, export as nested OpenAPI arrays, and export to proto as a repeated <Field>Row { repeated T value = 1; } box. gRPC ingress (gat huma ops, and gwag OpenAPI / GraphQL slots) unboxes rows on the way in and boxes them on the way out, so the handler or upstream sees plain nested arrays.
  • Map of map over gRPC ingress. gat huma ops and gwag OpenAPI / GraphQL slots took a map<K, map<K, V>> through its <Field>Value proto box without unboxing, so handlers and upstreams saw {"a":{"value":{...}}} and responses came back empty. Boxes now convert in both directions.
  • gat gRPC ingress: a huma map with 64-bit integer values (map[string]int) failed to bind, since protojson sends int64 as a decimal string and map values had no string-to-number path. Maps are now walked like structs.
  • An inline literal for a JSON or custom-scalar argument (cells: {a: {x: 1}}) reached handlers and upstreams as GraphQL AST nodes; gat failed to bind it. It now parses to plain values (ir.JSONLiteral, experimental). A variable nested inside such a literal is refused at validation; pass the whole argument as a variable.
spf13/pflag (github.com/spf13/pflag)

v1.1.0

Compare Source

It's been long enough, and enough things have been fixed, that it might be time to release a new version, even if there isn't any particular big new issue to market as the reason for this release.

If you notice anything breaking, it is entirely un-intentional, but you might also have been relying on undocumented or buggy behavior. Please file an issue describing what you're doing, how it worked before this release and why it doesn't work anymore, and pin your projects to v1.0.10 (the latest release before this one) while we decide how to address your concerns.

What's Changed

New Contributors

Full Changelog: spf13/pflag@v1.0.10...v1.1.0

actions/go-versions (go)

v1.27.3: 1.27.3

Compare Source

Go 1.27.3

v1.27.2: 1.27.2

Compare Source

Go 1.27.2

v1.27.1: 1.27.1

Compare Source

Go 1.27.1

v1.27.0: 1.27.0

Compare Source

Go 1.27.0

golangci/golangci-lint

v2.15.0

Compare Source

Released on 2026-10-16

  1. Linters new features or changes
    • errcheck: from 1.20.0 to 1.30.0
    • exhaustive: from 0.13.0 to 0.15.0 (⚠️ changes)
    • gocognit: from 1.2.1 to 1.3.0
    • golines: from 0.15.0 to 0.16.0
    • govet-modernize: from 0.50.0 to 0.52.0
    • loggercheck: from 0.12.0 to 0.13.0
    • predeclared: from 0.2.2 to 0.3.0
    • wrapcheck: from 2.12.0 to 2.13.0
  2. Linters bug fixes
    • bidichk: from 0.3.3 to 0.3.4
    • canonicalheader: from a25c71c to e18e5c5
    • gofumpt: improve deprecation logs
    • gosec: improve concurrency default value
    • iface: from 1.5.1 to 1.5.3
    • paralleltest: from 1.0.15 to 1.0.16
    • revive: from 1.17.0 to 1.17.1
    • revive: the rules context-keys-type, errorf, modifies-value-receiver, range-val-address, string-of-int, time-equal, time-naming, unexported-return, unhandled-error, var-declaration are working (less randomly).
    • rowserrcheck: from c5f79b8 to e0740d5
    • staticcheck: from 0.8.1 to 0.8.2
  3. Bug fixes
    • fix: compute custom version hash with module versions
    • fix: env vars loading (related to revive)

⚠️ Changes of the exhaustive linter:

  • The replaced options still exists, and partially works, but they are deprecated.
  • The options explicit-exhaustive-switch and explicit-exhaustive-map have been replaced by explicit-exhaustive.
  • The check the value map has been replaced by mapliteral.
  • The option ignore-enum-members (string) has been replaced by ignore-constants (slice).
  • The option ignore-enum-types (string) has been replaced by ignore-types (slice).
  • New report messages.
  • The linter is a now a "slow" linter.

v2.14.0

Compare Source

Released on 2026-09-24

  1. Bug fixes
    • fix: cache of facts reloading
  2. Linters new features or changes
    • bodyclose: from 73d1f95 to 857993a (new directive handled)
    • exhaustive: from 0.12.0 to 0.13.0
    • exhaustruct_v5: from 5.0.3 to 5.2.0 (new option: allow-empty-blank-assignments)
    • go-check-sumtype: from 0.3.1 to ae6904d
    • gocritic: from 0.14.4 to 0.15.0
    • gofumpt: from 0.11.0 to 0.12.0
    • gomoddirectives: from 0.9.0 to 0.10.0
    • gosec: from 2.28.0 to 2.29.0 (re-enable G407)
    • govet-modernize: from 0.49.0 to 0.50.0
    • loggercheck: from 0.11.0 to 0.12.0
    • revive: from 1.15.0 to 1.17.0 (new rules: marshal-receiver, multiline-if-init, use-slices-concat)
    • tagliatelle: from 0.7.2 to 0.8.0
  3. Linters bug fixes
    • fatcontext: from 0.10.0 to 0.10.1
    • flock: from 0.13.0 to 0.13.1
    • godoclint: from 0.11.2 to 0.11.4
    • protogetter: from 0.3.21 to 1.0.1
    • recvcheck: from 0.3.0 to 0.3.1
    • tagalign: from 1.4.3 to 1.4.4

v2.13.2

Compare Source

Released on 2026-08-28

  1. Bug fixes
    • Decrease cache entropy
  2. Linters bug fixes
    • iface: from 1.5.0 to 1.5.1
    • staticcheck: from 0.8.0 to 0.8.1
    • unparam: from 3f964bc to 2fa3d84
    • canonicalheader: from v1.1.2 to a temporary fork

v2.13.1

Compare Source

Released on 2026-08-20

  1. Linters bug fixes
    • ginkgolinter: from 0.23.1 to 0.24.0
    • gofmt: from d62b90e to e84e050
    • staticcheck: from 0.8.0-rc.1 to 0.8.0
    • wsl_v5: from 5.8.0 to 5.9.0

v2.13.0

Compare Source

Released on 2026-08-19

  1. Enhancements
    • 🎉 go1.27 support
  2. Bug fixes
    • fix: cache package facts
  3. Linters new features or changes
    • dupword: from 0.1.7 to 0.1.8 (new option skip-raw-strings)
    • errcheck: from 1.10.0 to 1.20.0
    • exhaustruct_v5: from 4.0.0 to 5.0.2 (new configuration)
    • exhaustruct: deprecated and replaced by exhaustruct_v5
    • fatcontext: from 0.9.0 to 0.10.0 (new options: check-loops, check-function-literals)
    • goconst: from 1.10.0 to 1.11.0 (new options: ignore-map-keys, exclude-types)
    • gofumpt: from 0.9.2 to 0.11.0 (new options: extra.group-params, extra.clothe-returns, extra.balance-calls)
    • gomoddirectives: from 0.8.0 to 0.9.0 (new option: replace-allow-all)
    • gosec: from 2.26.1 to 2.27.1
    • govet-modernize: from 0.44.0 to 0.49.0 (fmtappendf is removed. New analyzers atomictypes, embedlit, errorsastype, importcomment, reflecttypeassert, slicesclip, and slicesbackward. waitgroup is renamed waitgroupgo)
    • iface: from 1.4.3 to 1.5.0 (new analyzer: unusedmethod)
    • noinlineerr: from 1.0.5 to 1.0.6
    • nonamedreturns: from 1.0.6 to 1.0.8 (new option: allow-unused-named-returns)
    • recvcheck: from 0.2.0 to 0.3.0 (new default exclusions)
    • unparam: from 5beb8c8 to 3f964bc
  4. Linters bug fixes
    • clickhouse-go-linter: from 1.2.0 to 1.2.1
    • errname: from 1.1.1 to 1.1.2
    • exhaustruct_v5: from 5.0.2 to 5.0.3
    • funcorder: add missing Function field
    • ginkgolinter: from 0.23.0 to 0.23.1
    • gocheckcompilerdirectives: from 1.3.0 to 1.4.0
    • gocritic: from 0.14.3 to 0.14.4
    • gomoddirectives: add missing IgnoreForbidden field
    • iface: from 1.4.2 to 1.4.3
    • mirror: from 1.3.0 to 1.3.3
    • nilnil: from 1.1.1 to 1.1.2
    • protogetter: from 0.3.20 to 0.3.21
graphql/graphql-js (graphql)

v16.15.0

Compare Source

v16.15.0 (2026-11-04)

New Feature 🚀

Backports:

[!IMPORTANT]
✂ PR body was truncated to here.

Configuration

📅 Schedule: (UTC)

  • Branch creation
    • Between 12:00 AM and 03:59 AM, only on Monday (* 0-3 * * 1)
  • Automerge
    • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

  • If you want to rebase/retry this PR, check this box

This PR was generated by Mend Renovate. View the repository job log.

@renovate

renovate Bot commented Nov 2, 2026 •
edited
Loading

Copy link
Copy Markdown
Author

ℹ️ Artifact update notice

File name: go.mod

In order to perform the update(s) described in the table above, Renovate ran the go get command, which resulted in the following additional change(s):

  • 3 additional dependencies were updated

Details:

Package Change
github.com/dustin/go-humanize v1.0.1 -> v1.1.0
github.com/ncruces/go-strftime v1.0.0 -> v1.1.0
modernc.org/libc v1.75.7 -> v1.80.1

@renovate
renovate Bot force-pushed the renovate/all-minor-patch branch 4 times, most recently from b75eb2c to fd636da Compare November 7, 2026 03:40
@renovate
renovate Bot force-pushed the renovate/all-minor-patch branch from fd636da to 1ca6840 Compare November 8, 2026 08:07
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

0 participants