fix(deps): update non-major dependencies #336
Merged
Conversation
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
renovate
bot
force-pushed
the
renovate/non-major-dependencies
branch
2 times, most recently
from
a887b04 to
26594ec
Compare
renovate
bot
force-pushed
the
renovate/non-major-dependencies
branch
2 times, most recently
from
2c1fbf5 to
1d2590b
Compare
renovate
bot
changed the title
renovate
bot
force-pushed
the
renovate/non-major-dependencies
branch
4 times, most recently
from
d3c23e7 to
9cb6a2d
Compare
renovate
bot
force-pushed
the
renovate/non-major-dependencies
branch
3 times, most recently
from
5a23849 to
83023fb
Compare
renovate
bot
force-pushed
the
renovate/non-major-dependencies
branch
2 times, most recently
from
3b4cc3d to
ad9ab4a
Compare
renovate
bot
force-pushed
the
renovate/non-major-dependencies
branch
from
ad9ab4a to
dc2613d
Compare
owine
added a commit
that referenced
this pull request
Jan 7, 2026
Force update quic-go to v0.57.0 via replace directive to fix HTTP/3 QPACK Header Expansion DoS vulnerability. Gin v1.11.0 currently pins to vulnerable v0.54.0, so we override until Gin releases an update. This fixes the CI test failures in PR #336 which were caused by govulncheck detecting this vulnerability in the security checks. Changes: - Added replace directive for github.com/quic-go/quic-go v0.57.0 - Updated github.com/quic-go/qpack to v0.6.0 (transitive dependency) - Cleaned up unused indirect dependencies Fixes: GO-2025-4233 CVE: CVE-2025-64702 Advisory: GHSA-g754-hx8w-x2g6 🤖 Generated with [Claude Code](https://claude.com/claude-code) Co-Authored-By: Claude Sonnet 4.5 <noreply@anthropic.com>
renovate
bot
force-pushed
the
renovate/non-major-dependencies
branch
from
dc2613d to
083a0ce
Compare
Codecov Report✅ All modified and coverable lines are covered by tests. Additional details and impacted files@@ Coverage Diff @@
## main #336 +/- ##
=====================================
Coverage 6.98% 6.98%
=====================================
Files 82 82
Lines 15183 15183
=====================================
Hits 1060 1060
Misses 14075 14075
Partials 48 48
Flags with carried forward coverage won't be shown. Click here to find out more. ☔ View full report in Codecov by Sentry. 🚀 New features to boost your workflow:
|
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
This PR contains the following updates:
3.23.0→3.23.2v3.11.1→v3.12.00.4.25→0.4.260.52.1→0.54.1v5.7.6→v5.8.0v0.57.0→v0.57.1v4.31.8→v4.31.912.3.0→12.3.10.561.0→0.562.010.5.0→10.6.00.29.0→0.30.0v3.8.0→v3.8.13.8.0→3.8.17.10.1→7.11.08.49.0→8.50.07.3.0→7.3.1Release Notes
docker/setup-buildx-action (docker/setup-buildx-action)
v3.12.0Compare Source
installinput by @crazy-max in #455Full Changelog: docker/setup-buildx-action@v3.11.1...v3.12.0
ArnaudBarre/eslint-plugin-react-refresh (eslint-plugin-react-refresh)
v0.4.26Compare Source
jackc/pgx (github.com/jackc/pgx/v5)
v5.8.0Compare Source
quic-go/quic-go (github.com/quic-go/quic-go)
v0.57.1Compare Source
This release resolves a panic during the server handshake when using the upcoming Go 1.26 toolchain, specifically occurring with TLS session tickets disabled (#5462). This issue does not impact builds on Go 1.25 or earlier versions.
github/codeql-action (github/codeql-action)
v4.31.9Compare Source
grafana/grafana (grafana/grafana)
v12.3.1Compare Source
Features and enhancements
Bug fixes
dcountaggregation #114907, @aangeliscpercentilesyntax #114707, @aangelisclucide-icons/lucide (lucide-react)
v0.562.0Compare Source
csstools/postcss-plugins (postcss-preset-env)
v10.6.0Compare Source
December 27, 2025
@csstools/postcss-property-rule-prelude-listCheck the plugin README for usage details.@csstools/postcss-syntax-descriptor-syntax-productionCheck the plugin README for usage details.cssdbto8.6.0prometheus/alertmanager (prom/alertmanager)
v0.30.0: 0.30.0 / 2025-12-15Compare Source
phantom_threadingto group email alerts into threads. #4623client_allowed_sans. #4706s/client/alerts_api/g' broken link in 0.29. #4718rocketchat_configdocs. #4767<mute_time_interval>was renamed. #4729prometheus/prometheus (prom/prometheus)
v3.8.1: 3.8.1 / 2025-12-16Compare Source
remix-run/react-router (react-router-dom)
v7.11.0Compare Source
Patch Changes
react-router@7.11.0typescript-eslint/typescript-eslint (typescript-eslint)
v8.50.0Compare Source
This was a version bump only for typescript-eslint to align it with other projects, there were no code changes.
You can read about our versioning strategy and releases on our website.
vitejs/vite (vite)
v7.3.1Compare Source
Please refer to CHANGELOG.md for details.
Configuration
📅 Schedule: Branch creation - At any time (no schedule defined), Automerge - At any time (no schedule defined).
🚦 Automerge: Enabled.
♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.
👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.
This PR was generated by Mend Renovate. View the repository job log.