Skip to content

chore(deps): update all non-major dependencies#500

Open
renovate[bot] wants to merge 1 commit intomasterfrom
renovate/all-minor-patch
Open

chore(deps): update all non-major dependencies#500
renovate[bot] wants to merge 1 commit intomasterfrom
renovate/all-minor-patch

Conversation

@renovate
Copy link
Copy Markdown
Contributor

@renovate renovate bot commented Aug 4, 2025 •
edited
Loading

ℹ️ Note

This PR body was truncated due to platform limits.

This PR contains the following updates:

Package Type Update Change Age Confidence
gh minor 2.86.0 → 2.90.0 age confidence
github.com/alecthomas/kong require minor v1.12.1 → v1.15.0 age confidence
github.com/alecthomas/repr require patch v0.5.1 → v0.5.2 age confidence
github.com/antchfx/htmlquery require patch v1.3.4 → v1.3.6 age confidence
github.com/antchfx/xpath require patch v1.3.4 → v1.3.6 age confidence
github.com/gabriel-vasile/mimetype require patch v1.4.9 → v1.4.13 age confidence
github.com/itchyny/gojq require patch v0.12.18 → v0.12.19 age confidence
github.com/klauspost/compress require patch v1.18.0 → v1.18.5 age confidence
github.com/mattn/go-isatty require patch v0.0.20 → v0.0.21 age confidence
github.com/ulikunitz/xz require patch v0.5.12 → v0.5.15 age confidence
go minor 1.24.5 → 1.26.2 age confidence
go (source) toolchain minor 1.24.5 → 1.26.2 age confidence
go uses-with minor 1.24.x → 1.26.x age confidence
golang.org/x/net require minor v0.42.0 → v0.53.0 age confidence
golang.org/x/sync require minor v0.16.0 → v0.20.0 age confidence
golang.org/x/sys require minor v0.38.0 → v0.43.0 age confidence
golang.org/x/term require minor v0.33.0 → v0.42.0 age confidence
hugo minor 0.148.1 → 0.152.2 age confidence
just minor 1.46.0 → 1.49.0 age confidence
markupsafe (changelog) patch ==3.0.2 → ==3.0.3 age confidence
mkdocs-include-markdown-plugin (changelog) minor ==7.1.6 → ==7.2.2 age confidence
protoc minor 3.7.1 → 3.20.3 age confidence
python3 minor 3.13.2 → 3.14.3 age confidence
shellcheck minor 0.10.0 → 0.11.0 age confidence

Warning

Some dependencies could not be looked up. Check the Dependency Dashboard for more information.

Release Notes

cli/cli (gh)

v2.90.0: GitHub CLI 2.90.0

Manage agent skills with gh skill (Public Preview)

Agent skills are portable sets of instructions, scripts, and resources that teach AI coding agents how to perform specific tasks. The new gh skill command makes it easy to discover, install, manage, and publish agent skills from GitHub repositories - right from the CLI.


# Discover skills
gh skill search copilot

# Preview a skill without installing
gh skill preview github/awesome-copilot documentation-writer

# Install a skill
gh skill install github/awesome-copilot documentation-writer

# Pin to a specific version
gh skill install github/awesome-copilot documentation-writer --pin v1.2.0

# Check installed skills for updates
gh skill update --all

# Validate and publish your own skills
gh skill publish --dry-run

Skills are automatically installed to the correct directory for your agent host. gh skill supports GitHub Copilot, Claude Code, Cursor, Codex, Gemini CLI, and Antigravity. Target a specific agent and scope with --agent and --scope flags.

gh skill publish validates skills against the Agent Skills specification and checks remote settings like tag protection and immutable releases to improve supply chain security.

Read the full announcement on the GitHub Blog.

gh skill is launching in public preview and is subject to change without notice.

Official extension suggestions

When you run a command that matches a known official extension that isn't installed (e.g. gh stack), the CLI now offers to install it instead of showing a generic "unknown command" error.

This feature is available for github/gh-aw and github/gh-stack.

When possible, you'll be prompted to install immediately. When prompting isn't possible, the CLI prints the gh extension install command to run.

gh extension install no longer requires authentication

gh extension install previously required a valid auth token even though it only needs to download a public release asset. The auth check has been removed, so you can install extensions without being logged in.

What's Changed

✨ Features
🐛 Fixes
📚 Docs & Chores
:dependabot: Dependencies

New Contributors

Full Changelog: cli/cli@v2.89.0...v2.90.0

v2.89.0: GitHub CLI 2.89.0

:copilot: gh agent-task now works on ghe.com tenancies

gh agent-task commands previously failed with 401 Unauthorized for users on ghe.com tenancy hosts because the Copilot API URL was hardcoded. The URL is now resolved dynamically per host, so gh agent-task works correctly regardless of your GitHub hosting environment.

Experimental new prompter

A new TUI-based prompter powered by charmbracelet/huh is available behind the GH_EXPERIMENTAL_PROMPTER environment variable. This is an early preview — try it out and share feedback!

export GH_EXPERIMENTAL_PROMPTER=1

gh issue create and gh issue transfer no longer require extra token scopes

gh issue create and gh issue transfer previously fetched repository fields they didn't need, which could require additional token scopes. These commands now fetch only the minimal fields necessary for issue operations.

What's Changed

✨ Features
  • gh pr create, gh issue create, gh issue edit: search-based assignee selection and login-based mutation on github.com by @​BagToad in #​13009
  • Add experimental huh-only prompter gated by GH_EXPERIMENTAL_PROMPTER by @​BagToad in #​12859
🐛 Fixes
📚 Docs & Chores
:dependabot: Dependencies

New Contributors

Full Changelog: v2.88.1...v2.89.0

v2.88.1: GitHub CLI 2.88.1

Fix pr commands failing with read:project scope error

v2.88.0 introduced a regression where pr commands would fail with the error:

error: your authentication token is missing required scopes [read:project]
To request it, run:  gh auth refresh -s read:project

Previously, missing read:project scope was gracefully handled, and project data was silently skipped. A change inadvertently broke the error matching that enabled this graceful degradation. v2.88.1 reverts these changes so that pr commands work correctly without requiring the read:project scope.

What's Changed

Full Changelog: cli/cli@v2.88.0...v2.88.1

v2.88.0: GitHub CLI 2.88.0

:copilot: Request Copilot Code Review from gh

image

gh pr create and gh pr edit now support Copilot Code Review as a reviewer. Request a review with --add-reviewer @​copilot, or select Copilot interactively from the searchable reviewer prompt.

Create a pull request and request review from Copilot:

gh pr create --reviewer @​copilot

Edit a pull request and request review from Copilot:

gh pr edit --add-reviewer @​copilot

Close issues as duplicates with gh issue close --duplicate-of

You can now close issues as duplicates and link to a duplicate issue directly from the CLI. The new --duplicate-of flag accepts an issue number or URL and marks the closed issue as a duplicate of the referenced one. You can also use --reason duplicate to set the close reason without linking a specific issue.


# Close as duplicate, linking to the original issue
gh issue close 123 --duplicate-of 456

# Close with duplicate reason only
gh issue close 123 --reason duplicate

JSON support for gh agent-task

gh agent-task list and gh agent-task view now support --json, --jq, and --template flags, consistent with other gh commands.

gh agent-task list --json id,name,state
gh agent-task view <id> --json state --jq '.state'

What's Changed

✨ Features
🐛 Fixes
📚 Docs & Chores
:dependabot: Dependencies

New Contributors

Full Changelog: cli/cli@v2.87.3...v2.88.0

v2.87.3: GitHub CLI 2.87.3

What's Changed

Full Changelog: cli/cli@v2.87.2...v2.87.3

v2.87.2: GitHub CLI 2.87.2

ℹ️ Note

This release was cut primarily to resolve a publishing issue. We recommend reviewing the v2.87.1 release notes for the complete set of latest features and fixes.

What's Changed

Full Changelog: cli/cli@v2.87.1...v2.87.2

v2.87.0: GitHub CLI 2.87.0

gh workflow run immediately returns workflow run URL

One of our most requested features - with the latest changes in GitHub API, gh workflow run will immediately print the created workflow run URL.

Improved gh auth login experience in VM/WSL environments

We have observed rare cases of time drift between the wall and monotonic clocks, mostly in WSL or VM environments, causing failures during polling for the OAuth token. This new release implements measures to account for such situations.

If you continue to experience gh auth login issues in WSL, please comment in #​9370

:copilot: Request Copilot Code Review from gh + performance improvements

gh pr edit now supports Copilot Code Review as a reviewer. You can request a review from Copilot using the --add-reviewer @&#8203;copilot flag or interactively by selecting reviewers in the prompts.

This release also introduces a new search experience for selecting reviewers and assignees in gh pr edit. Instead of loading all collaborators and teams upfront, results are now fetched based on inputs to a new search option. Initial options are suggestions based on those involved with the pull request already.

? Reviewers  [Use arrows to move, space to select, <right> to all, <left> to none, type to filter]
  [ ]  Search (7472 more)
  [x]  BagToad (Kynan Ware)
> [x]  Copilot (AI)

This experience will follow in gh pr create and gh issue for assignees in a later release.

What's Changed

✨ Features
📚 Docs & Chores
:dependabot: Dependencies

New Contributors

Full Changelog: cli/cli@v2.86.0...v2.87.0

alecthomas/kong (github.com/alecthomas/kong)

v1.15.0

Compare Source

v1.14.0

Compare Source

v1.13.0

Compare Source

alecthomas/repr (github.com/alecthomas/repr)

v0.5.2

Compare Source

antchfx/htmlquery (github.com/antchfx/htmlquery)

v1.3.6

Compare Source

Update github.com/antchfx/xpath from v1.3.5 to v1.3.6.

v1.3.5

Compare Source

antchfx/xpath (github.com/antchfx/xpath)

v1.3.6

Compare Source

Merged PR:

Fixed:

v1.3.5

Compare Source

Merged PR:

Fixed:

  • #​113 - (fix string() function)
gabriel-vasile/mimetype (github.com/gabriel-vasile/mimetype)

v1.4.13: Support for .hlp, .inf, .fm, .bufr

Compare Source

What's Changed

New Contributors

Full Changelog: gabriel-vasile/mimetype@v1.4.12...v1.4.13

v1.4.12: RFC822, GRIB, Zlib support

Compare Source

What's Changed

  • zip+json: add benchmarks for better performance tracking of pathological inputs in #​730
  • zip+json: performance improvements for pathological cases in #​732
  • Fix integer overflow panic on 32bit architectures in #​733
  • ci: add more linters and fix their warnings in #​734
  • jar: manifest must be first in #​735
  • rfc822: add support in #​740
  • grib: add support in #​742
  • zlib: add support in #​743

Full Changelog: gabriel-vasile/mimetype@v1.4.11...v1.4.12

v1.4.11: cpio, wordperfect support

Compare Source

What's Changed

  • wordperfect: add support in #​707
  • cpio: add support for binary version in #​709
  • shebang: fix detection with args by @​scop in #​710
  • shebang: support env -S by @​scop in #​712
  • dxf: add support in #​720
  • clone: stop cloning MIME when there is no charset in #​722
  • aaf: remove individual node for aaf in #​724
  • msoxml: match files and directories for first zip entry in #​729

Full Changelog: gabriel-vasile/mimetype@v1.4.10...v1.4.11

v1.4.10: perfomance inprovements, tests and new formats

Compare Source

This release adds support for XHTML, Lotus-1-2-3, KML, shell scripts, VSDX, OneNote, CHM and Netpbm file formats.
Changes were made to make mimetype behave more file linux $ file --mime utility.

https://github.com/gabriel-vasile/mimetype_tests repo is now used for running comparisons between mimetype and $ file --mime. It contains 50 000 samples and mimetype identifies the same format as $ file --mime for ~97% of them. Results are in the Actions tab.

What's Changed

  • charset: remove dependency on x/net for parsing html in #​669
  • CSV: replace stdlib reader with a parser that allocates less in #​672
  • svg: make detection harder in #​674
  • pdf: relax check to match file in #​677
  • csv: stop mutating input byte slices; for #​680 in #​681
  • charset: remove dependency on mime in #​684
  • mso_office: increase limit of checked entries from 4 to 100 in #​685
  • jar: replace application/jar with application/java-archive in #​686
  • Zip container improvements in #​687
  • Jar first entry inside a zip in #​688
  • svg+html: better handling for comments in #​689
  • xhtml: add support in #​690
  • misc: behave more like file in #​691
  • lotus-1-2-3: add support in #​695
  • Add support for zipped KML files by @​dmlambea in #​693
  • shell: add support by [@​scop]

Configuration

📅 Schedule: (UTC)

  • Branch creation
    • Between 12:00 AM and 03:59 AM, only on Monday (* 0-3 * * 1)
  • Automerge
    • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

  • If you want to rebase/retry this PR, check this box

This PR was generated by Mend Renovate. View the repository job log.

@renovate
Copy link
Copy Markdown
Contributor Author

renovate bot commented Aug 4, 2025 •
edited
Loading

⚠️ Artifact update problem

Renovate failed to update an artifact related to this branch. You probably do not want to merge this PR as-is.

♻ Renovate will retry this branch, including artifacts, only when one of the following happens:

  • any of the package files in this branch needs updating, or
  • the branch becomes conflicted, or
  • you click the rebase/retry checkbox if found above, or
  • you rename this PR's title to start with "rebase!" to trigger it manually

The artifact failure details are included below:

File name: from: protoc-3.7.1, to: protoc-3.20.3
Bootstrapping /home/ubuntu/.cache/hermit/pkg/hermit@stable/hermit from https://github.com/cashapp/hermit/releases/download/stable
Creating /home/ubuntu/.cache/hermit/pkg/hermit@stable
Downloading https://github.com/cashapp/hermit/releases/download/stable/hermit-linux-amd64.gz to /home/ubuntu/.cache/hermit/pkg/hermit@stable/hermit
Hermit installed as /home/ubuntu/.cache/hermit/pkg/hermit@stable/hermit
Found Hermit in /home/ubuntu/bin/hermit but it is a different distribution, not overwriting.
Hermit is installed as /home/ubuntu/bin/hermit-stable

See https://cashapp.github.io/hermit/usage/get-started/ for more information.

error:file:///#PWD/../packages/.git: Cloning into '/home/ubuntu/.cache/hermit/sources/f20ea07710435d2335a6d24aca10db13a814bfe509d2a70211a13b2c57bd5690-1607175824'...
fatal: '/#PWD/../packages/.git' does not appear to be a git repository
fatal: Could not read from remote repository.

Please make sure you have the correct access rights
and the repository exists.

fatal:hermit: git sync failed: git clone --depth=1 file:///#PWD/../packages/.git /home/ubuntu/.cache/hermit/sources/f20ea07710435d2335a6d24aca10db13a814bfe509d2a70211a13b2c57bd5690-1607175824 failed: exit status 128

@renovate renovate bot force-pushed the renovate/all-minor-patch branch 6 times, most recently from e1c2d70 to 4ec0308 Compare August 7, 2025 21:37
@renovate renovate bot force-pushed the renovate/all-minor-patch branch 3 times, most recently from 40e2ffe to c692600 Compare August 18, 2025 08:38
@renovate renovate bot force-pushed the renovate/all-minor-patch branch 6 times, most recently from 9d6ae17 to 57f613e Compare August 28, 2025 00:50
@alecthomas
Copy link
Copy Markdown
Collaborator

alecthomas commented Aug 28, 2025

We need to upgrade golangci-lint first.

@renovate renovate bot force-pushed the renovate/all-minor-patch branch 7 times, most recently from bd6a741 to 010c82a Compare September 4, 2025 03:47
@renovate renovate bot force-pushed the renovate/all-minor-patch branch 6 times, most recently from 7ff37fd to d58ef37 Compare September 9, 2025 06:14
@renovate renovate bot force-pushed the renovate/all-minor-patch branch 5 times, most recently from 88a9b52 to 615d416 Compare October 15, 2025 15:36
@renovate renovate bot force-pushed the renovate/all-minor-patch branch 4 times, most recently from 9f1bf83 to 6164102 Compare October 22, 2025 10:54
@renovate renovate bot force-pushed the renovate/all-minor-patch branch 3 times, most recently from da75872 to f1925df Compare October 30, 2025 00:50
@renovate renovate bot force-pushed the renovate/all-minor-patch branch 8 times, most recently from 9f1b3a3 to 4d46fb6 Compare November 12, 2025 01:00
@renovate renovate bot force-pushed the renovate/all-minor-patch branch 2 times, most recently from ec29e8c to 9127c29 Compare November 16, 2025 00:32
@renovate renovate bot force-pushed the renovate/all-minor-patch branch 3 times, most recently from 4e1eaef to 87f10fe Compare December 3, 2025 03:54
@renovate renovate bot force-pushed the renovate/all-minor-patch branch 3 times, most recently from 2b868a5 to 6ac7fd6 Compare December 9, 2025 00:01
@github-advanced-security
Copy link
Copy Markdown

github-advanced-security AI commented Apr 8, 2026

You are seeing this message because GitHub Code Scanning has recently been set up for this repository, or this pull request contains the workflow file for the Code Scanning tool.

What Enabling Code Scanning Means:

  • The 'Security' tab will display more code scanning analysis results (e.g., for the default branch).
  • Depending on your configuration and choice of analysis tool, future pull requests will be annotated with code scanning analysis results.
  • You will be able to see the analysis results for the pull request's branch on this overview once the scans have completed and the checks have passed.

For more information about GitHub Code Scanning, check out the documentation.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

2 participants

@alecthomas @github-advanced-security