fix(deps): update all non-major dependencies - #913
Conversation
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 8c4d39ca7e
ℹ️ About Codex in GitHub
Codex has been enabled to automatically review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
When you sign up for Codex through ChatGPT, Codex can also answer questions or update the PR, like "@codex address that feedback".
| specifier: ^17.0.1 | ||
| version: 17.0.3 | ||
| version: 18.0.9 |
There was a problem hiding this comment.
This importer now records marked as 18.0.9 even though apps/differ/package.json still declares ^17.0.1, so the lockfile is not consistent with the workspace manifests; there are similar mismatches later, such as apps/staged resolving prettier-plugin-svelte 3.5.2 for ^4.1.1. The workflows run pnpm install --frozen-lockfile (for example .github/workflows/differ-ci.yml:73), and the pnpm install docs state that in CI, installation fails when a present lockfile needs an update and that workspace installs cover all projects (https://pnpm.io/cli/install), so these CI jobs will stop before tests/builds run.
Useful? React with 👍 / 👎.
40e0f67 to
d226bc1
Compare
d226bc1 to
7f8d2fd
Compare
ℹ️ Artifact update noticeFile name: apps/penpal/go.modIn order to perform the update(s) described in the table above, Renovate ran the
Details:
|
This PR contains the following updates:
7.1.2→7.3.00.5.19→0.5.202.7.1→2.7.22.8.0→2.9.02.4.3→2.4.43.0.4→3.0.524.11.0→24.13.32.16.0→2.16.15.1.4→5.2.0v6.0.3→v6.1.08.18.0→8.20.01.0.102→1.0.1041.0.103→1.0.1040.1.89→0.1.920.22→0.230.4.44→0.4.454.6.0→4.6.60.11→0.120.20→0.21v1.9.0→v1.10.1v1.4.1→v1.7.0v1.8.2→v1.8.56.2.6→6.3.00.4.25→0.4.3329.0.2→29.1.10.2.185→0.2.1890.2.186→0.2.1890.4.29→0.4.3318.0.5→18.0.917.0.3→17.0.611.12.3→11.16.10.4→0.50.31.2→0.31.30.8.4→0.8.510.33.0→10.34.58.5.16→8.5.263.9.4→3.9.63.5.0→3.5.20.9→0.101.12.4→1.13.10.13.2→0.13.40.47→0.480.39→0.402.5.0→2.6.01.96.1→1.97.10.23.41→0.23.432.17.5→2.17.61.0.149→1.0.1511.0.150→1.0.1511.3.0→1.5.05.56.4→5.56.84.7.1→4.7.53.2.2→3.3.12.7.1→2.7.22.8.0→2.9.02.4.3→2.4.42.4.2→2.4.42.0.18→2.0.200.3.53→0.3.551.51.1→1.53.11.52.3→1.53.10.7.18→0.7.190.6→0.70.47→0.481.23.0→1.24.01.23.4→1.24.08.1.0→8.2.17.3.1→7.3.6Release Notes
sveltejs/vite-plugin-svelte (@sveltejs/vite-plugin-svelte)
v7.3.0Compare Source
Minor Changes
dynamicCompileOptions(#1386)Patch Changes
v7.2.0Compare Source
Minor Changes
v7.1.4Compare Source
Patch Changes
v7.1.3Compare Source
Patch Changes
tailwindlabs/tailwindcss-typography (@tailwindcss/typography)
v0.5.20Compare Source
Fixed
tauri-apps/plugins-workspace (@tauri-apps/plugin-dialog)
v2.7.2Compare Source
vitejs/vite-plugin-react (@vitejs/plugin-react)
v5.2.0Compare Source
actions/checkout (actions/checkout)
v6.1.0Compare Source
ajv-validator/ajv (ajv)
v8.20.0Compare Source
What's Changed
Full Changelog: ajv-validator/ajv@v8.19.0...v8.20.0
dtolnay/anyhow (anyhow)
v1.0.104Compare Source
syndev-dependency to version 3v1.0.103Compare Source
Error::downcast_mut(#451, #452)dtolnay/async-trait (async-trait)
v0.1.92Compare Source
v0.1.91Compare Source
v0.1.90Compare Source
marshallpierce/rust-base64 (base64)
v0.23.1Compare Source
v0.23.0Compare Source
simd-unsafefeature:Simdpicks the bestinstruction set at runtime (AVX2 on
x86_64, NEON onaarch64) and falls back to the scalarGeneralPurposeengine, whileAvx2andNeontarget one instruction set with no runtimedetection and work in
no_std. The engines support the standard and URL-safe alphabets.chronotope/chrono (chrono)
v0.4.45: 0.4.45Compare Source
What's Changed
clap-rs/clap (clap)
v4.6.6Compare Source
v4.6.5Compare Source
v4.6.4Compare Source
Internal
v4.6.3Compare Source
Fixes
"literal".function()as attribute valuesv4.6.2Compare Source
Fixes
aliaswhen there is only onev4.6.1Compare Source
Fixes
console-rs/dialoguer (dialoguer)
v0.12.0: 0.12.0Compare Source
What's Changed
select.rsexample by @jwodder in #289thiserrorwith a manual impl by @CosmicHorrorDev in #327rust-lang/git2-rs (git2)
v0.21.0Compare Source
0.20.4...main
Added
unstable-sha256Cargo feature,along with
*_extAPI variants that accept anObjectFormat.#1206
opts::set_cache_max_size()andopts::get_cached_memory().#1188
Repository::object_format()and a newObjectFormatenum.#1204
Repository::set_config().#1208
merge_file()along withMergeFileInput.#1210
Repository::refdb_compress()for packing loose refs.#1221
Refdbtype, along withRepository::refdb()andRepository::set_refdb().Repository::refdb_compress()now delegates toRefdb::compress().#1228
Revspec::into_objects().#1230
BlameHunk::final_committer(),BlameHunk::orig_committer(),BlameHunk::summary(), andBlameHunk::summary_bytes().#1231
CloneforReference.#1233
Repository::author_from_env()andRepository::committer_from_env().#1237
impl From<Utf8Error> for Error.#1239
Changed
ssh,https, andcredCargo features are no longer enabled by default.Previously
default = ["ssh", "https"]; nowdefault = [].Enable them explicitly if you rely on credential helpers or transport support.
#1168
CredentialHelperand theurldependency are now gated behind the newcredCargo feature.Enabling
sshorhttpstransitively enablescred.#1168
#1173
Option<&str>now return
Result<&str, Error>orResult<Option<&str>, Error>,so callers can distinguish a missing value from a non-UTF-8 one.
#1241
BlameHunk::final_signature,BlameHunk::final_committer,BlameHunk::orig_signature, andBlameHunk::orig_committernow return
Optionto avoid segfaults when signature information is missing.#1254
#1242
Fixed
MergeOptions::skip_reuc()to use the correctGIT_MERGE_SKIP_REUCflag.#1194
Repository::submodules()now returns anErrorwhen the underlyinggit_submodule_lookup()call to libgit2 fails, rather than panicking with a failed assertion.#1220
Reference::is_valid_name()now propagates errors fromCStringconversion instead of panicking.#1229
Remote::list()to return an empty list instead of erroringwhen the remote advertises no refs.
#1250
ReferenceNamesnow returns anErrfor non-UTF-8 branch names instead of panicking.#1239
Documentation
git_checkout_head.#1149
IndexAddOptionflags.#1163
sshfeature.#1187
Repository::tag_foreach().#1190
StatusOptions.#1199
#1219
Signature::from_raw_const()docs.#1222
#1223
#1224
CheckoutBuilder::update_index()documentation.#1232
#1235
Repository::stash_save_ext()docs.#1245
#1243
CheckoutBuilder::refresh()docs.#1252
Internals
civet/conduitfrom dev-dependencies.#1170
#1171
#1177
#1182
#1196
#1198
timefrom 0.3.41 to 0.3.47.#1215
#1244
#1246
Repository::statuses().#1251
#1201
#1205
fsnotify/fsnotify (github.com/fsnotify/fsnotify)
v1.10.1Compare Source
Changes and fixes
inotify: don't remove sibling watches sharing a path prefix (#754)
inotify, windows: don't rename sibling watches sharing a path prefix
(#755)
v1.10.0Compare Source
This version of fsnotify needs Go 1.23.
Changes and fixes
inotify: improve initialization error message (#731)
inotify: send Rename event if recursive watch is renamed (#696)
inotify: avoid copying event buffers when reading names (#741)
kqueue: skip dangling symlinks (ENOENT) in watchDirectoryFiles, so a bad entry no longer aborts Watcher.Add for the whole directory (#748)
kqueue: drop watches directly in Close() to fix a file descriptor leak when recycling watchers (#740)
windows: fix nil pointer dereference in remWatch (#736)
windows: lock watch field updates against concurrent WatchList to fix a race introduced in v1.9.0 (#709, #749)
modelcontextprotocol/go-sdk (github.com/modelcontextprotocol/go-sdk)
v1.7.0Compare Source
This release brings full support for protocol version
2026-07-28.The wire protocol is largely rewritten: a stateless model with per-request
_meta, a newserver/discoverRPC replacing theinitializehandshake, multi-round-trip requests (MRTR) replacing server-initiated calls, a unifiedsubscriptions/listenstream replacing free-floating change notifications, standardised HTTP headers, and the formal deprecation of the roots, sampling, and logging features.The streamable HTTP transport accepts requests at protocol version
2026-07-28only whenStreamableHTTPOptions.Stateless = true. If you want to expose the new protocol over HTTP, setStateless = true; if you want to keep stateful sessions, your clients will negotiate down to2025-11-25.Backward compatibility with
2025-11-25and earlier is preserved on every endpoint. The SDK negotiates the highest mutually-supported version at connect time. The new protocol is enabled by default for new clients; existing legacy clients and servers continue to work unchanged.This release consolidates everything shipped in
v1.7.0-pre.1,v1.7.0-pre.2, andv1.7.0-pre.3. Thank you to everyone who exercised the pre-releases and filed feedback.v1.7.0-pre.3is already successfully used by GitHub, serving more than half a million users.Make MCP Stateless (SEP-2575) & Sessionless (SEP-2567)
The
initialize/notifications/initializedhandshake is removed in2026-07-28. Each request now carries_meta.io.modelcontextprotocol/{protocolVersion,clientInfo,clientCapabilities}so the server can validate the peer without state. A newserver/discoverRPC lets clients learn the server's supported versions and capabilities up front; the SDK falls back to legacyinitializeif discover fails. Resumability (Last-Event-ID, standalone GET) is removed;ping,logging/setLevel,resources/subscribe, andresources/unsubscribeare also removed on this revision and rejected withMethodNotFound.MissingRequiredClientCapabilityerror data by @guglielmo-san (#1005)UnsupportedProtocolVersionerror by @guglielmo-san (#989)Subscriptions listen (SEP-2575)
The legacy
tools/list_changed,prompts/list_changed,resources/list_changed, andresources/updatednotifications are replaced by a single long-livedsubscriptions/listenrequest whose response stream multiplexes every change notification the client opted into, each tagged withio.modelcontextprotocol/subscriptionId. The SDK opens this stream automatically onClient.Connectwhen the corresponding list-changed handler is set; servers route notifications only to subscribed sessions.subscriptions/listenrpc (SEP-2575) by @guglielmo-san (#1007)Multi Round-Trip Requests (SEP-2322)
Server-to-client requests for elicitation, sampling, and roots are no longer issued as fresh JSON-RPC requests. Instead a tool/prompt/resource handler returns an
InputRequiredResultwhoseinputRequestsfield carries the requests; the client fulfils each and retries the original call withinputResponsespopulated. The SDK ships client- and server-side middleware that handles this transparently in both directions, including a server-side compatibility shim that lets MRTR handlers also work against legacy clients.Cacheable list results (SEP-2549)
tools/list,prompts/list,resources/list,resources/templates/list,resources/read, andserver/discoverresults now carryttlMsandcacheScopefields. Clients honour them as freshness hints to reduce polling; shared intermediaries usecacheScopeto decide whether responses may be cached.DiscoverResultby @guglielmo-san (#1022)HTTP standardization (SEP-2243)
The streamable HTTP transport now mirrors selected fields from the JSON-RPC body into HTTP headers (
Mcp-Method,Mcp-Name,Mcp-Protocol-Version,Mcp-Param-*) so network intermediaries can route and observe MCP traffic without deep packet inspection. Tools can declare per-parameter passthrough viax-mcp-headerannotations on their input schema. Body↔header mismatches return-32020 HeaderMismatch.x-mcp-headerby @guglielmo-san (#915)Deprecation of roots, sampling, and logging (SEP-2577)
Roots, sampling, and logging are formally deprecated on the
2026-07-28revision. The SDK continues to expose the corresponding Go types for backward compatibility with older peers, but new servers should not rely on them.Behavior changes guarded by MCPGODEBUG
Seven escape-hatch flags are added in this release to restore behavior that changed as part of spec-compliance fixes. All will be removed in v1.9.0.
customresnotfounderrcode=1— restore the old-32002code forResourceNotFoundError.hintomitempty=1— restoreomitemptyonToolAnnotations.ReadOnlyHintandIdempotentHint. The default now always serializes these fields because the Go types are barebool(not*bool), so omittingfalsemade it indistinguishable from "unset".allowsessionsinstateless=1— restore session-id handling on stateless streamable HTTP servers (read/writeMcp-Session-Id, acceptDELETE). The default behavior is now what the spec requires: stateless servers ignore session IDs entirely and return405 Method Not AllowedforDELETE.nomethodnotfoundcodeinerror=1— restore the previous STDIO behavior where the JSON-RPCMethodNotFound(-32601) code is omitted from the error response for unhandled methods. The default now includes the code.noprotocolerrorbody=1— restore the previous streamable HTTP client behavior of not decoding the JSON-RPC error body of a non-2xx HTTP response. The default now surfaces the underlying JSON-RPC error.nowrapinvalidparams=1— restore the previous behavior of returning rawunmarshalParamserrors from receiving handlers instead of wrapping them as a JSON-RPC-32602 Invalid paramserror. Introduced by #1087.disablecompleteparamsvalidation=1— restore the previous behavior of acceptingcompletion/completeresponses without validating the presence of thecompletionparams object. Introduced by #1080.Other Changes to the SDK
Streamable HTTP transport:
streamableClientConn.Closeby @blackwell-systems (#929)Configuration
📅 Schedule: (UTC)
* 0-3 * * 1)🚦 Automerge: Enabled.
♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.
👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.
This PR was generated by Mend Renovate. View the repository job log.