chore(deps): update all non-major dependencies

[renovate]

ℹ️ Note

This PR body was truncated due to platform limits.

This PR contains the following updates:

Package	Type	Update	Change	Age	Adoption	Passing	Confidence
gitguardian/gg-shield	repository	minor	v1.53.0 → v1.54.0
jsii-rosetta (source)	dependencies	patch	6.0.11 → 6.0.12
node (source)		minor	24.19.0 → 24.20.0

---

Warning

Some dependencies could not be looked up. Check the Dependency Dashboard for more information.

Note: The pre-commit manager in Renovate is not supported by the pre-commit maintainers or community. Please do not report any problems there, instead create a Discussion in the Renovate repository if you have any questions.

---

Release Notes

gitguardian/gg-shield (gitguardian/gg-shield)

v1.54.0: 1.54.0

Compare Source

• pip/pipx installs now ship the native Rust ggshield on common platforms
  (Linux x86-64/aarch64 for glibc and musl, macOS universal2, Windows x86-64); the Python implementation is installed
  alongside as ggshield-py. Platforms without a native wheel fall back to the
  pure-Python wheel, where ggshield is the Python entry point — as does
  Homebrew, which builds from the source distribution.

Added

• Add secret-scanning hook support for Mistral Vibe 2.21 and later. Global and
  project installation preserves existing hooks.toml content and configures
  Vibe's pre_tool and post_tool events.

• A native ggshield-hook binary implements ggshield secret scan ai-hook,
  removing the interpreter startup cost the hook paid twice per tool call. It
  resolves the instance's scan limits from the same places ggshield does
  (GG_MAX_DOC_SIZE / GG_MAX_DOCS, the on-disk auth-check cache, then
  /v1/metadata), so a document or a batch the instance would reject is split or
  skipped instead of failing the scan. It caches what it learns from
  /v1/metadata for five minutes, so a hook path where only the native binary
  runs does not pay that round trip on every scan.

• The native hook now honours the GITGUARDIAN_INSTANCE, GITGUARDIAN_API_URL
  and GITGUARDIAN_API_KEY settings a .env file provides, instead of declining
  to scan when it found one. It reads the file from the same places ggshield does
  (GITGUARDIAN_DOTENV_PATH, then the working directory, then the repository
  root), and gives it the same precedence: a value in the .env overrides the
  same variable already exported in the environment. A self-hosted instance
  configured through a .env is therefore scanned against, rather than left
  unscanned. Two caveats: an unbraced $ in a value is expanded as a variable
  reference (so GITGUARDIAN_API_KEY=abc$def resolves to abc — quote it as
  'abc$def' to keep the $), and a GITGUARDIAN_* line the parser rejects
  still leaves the action unscanned, with a message naming the variable.

• AI discovery now reports, per agent, the email of the assistant subscription that agent is signed into, so a personal
  subscription can be told apart from a company one. Read locally from Claude Code, Codex and Cursor. Mistral Vibe and
  VSCode keep no account on disk and report nothing.

• GGSHIELD_NO_NOTIFICATION suppresses the AI hook's desktop notification. The
  secret is still detected and the tool call still blocked; only the banner is
  withheld.

Changed

• Release binaries are now built with Python 3.14 instead of 3.10, ahead of Python 3.10's
  end-of-life. This also updates the SQLite bundled in the released binaries, fixing
  CVE-2025-6965 and CVE-2025-7709.

• AI hooks no longer call the API twice for the same document. An unambiguously clean
  scan result is cached locally for 15 minutes, keyed on the exact document sent and on
  the instance and token it was sent with, so a file read costs one API round trip
  instead of two (PreToolUse and PostToolUse scan the same file).

• ggshield starts faster: each command now imports only the modules it needs, and
  plugin discovery runs only when a plugin command is actually resolved. This speeds
  up every invocation, in particular the ones that run automatically on every git
  commit (secret scan pre-commit) and on every AI agent tool call
  (secret scan ai-hook).

• ggshield secret scan ai-hook is now much faster on MCP tool calls: the local
  discovery walk is cached for an hour instead of running on every call, and the
  secret scan and the MCP activity call now run concurrently instead of one after
  the other. Measured against a mock API at the production p50 latency, an MCP
  PreToolUse event goes from 1183 ms to 387 ms (p50). Other events are
  unaffected. As a consequence, an MCP tool call is now reported to GitGuardian
  even when the secret scan blocks it.

• AI hooks now scan all the payloads of an event in a single API call instead of one
  call each. A prompt mentioning three files used to cost four round trips; measured
  against a mock API at the production p50 latency, such a UserPromptSubmit goes from
  1561 ms to 395 ms (p50). Single-payload events are unchanged.

• In the standalone packages (.pkg, .deb, .rpm, .msi, Chocolatey, archives), ggshield
  is now a small native dispatcher: it runs ggshield secret scan ai-hook and hands every other
  command to the bundled Python implementation. There is still a single ggshield command, and
  every command behaves as before.

• AI hooks now resolve the file paths of Read tool calls and prompt @-mentions to an
  absolute path against the event's working directory. A file mentioned in a prompt and the
  same file later read by a tool now share one verdict-cache key, so it is scanned once
  instead of twice. As a result, the file path reported in block messages (and sent for
  scanning) is now absolute for prompt-mentioned files.

• The native hook accepts a .gitguardian.yaml key spelled with - or with _,
  but no longer resolves a config that sets the same key in both spellings the
  way the Python implementation does: the last spelling in the file wins. Using
  one spelling per key, which every documented example does, is unaffected.

• When the AI hook blocks, its message now shows the secret.ignored_matches
  entry that would silence it, one line per detected secret. The message censors
  every match, so the entry could not previously be written by hand from what it
  showed. The value shown is the ignore sha, a digest rather than the secret,
  and is the same one ggshield secret ignore --last-found writes.

• ggshield plugin install and ggshield plugin update no longer send an
  installation report to the GitGuardian instance. The endpoint it targeted was
  never implemented, so the call always failed and was silently discarded.

• The GitGuardian logo shipped with ggshield is the refreshed one: the Chocolatey
  package icon uses the solid black mark, and the macOS desktop notification icon
  uses the app icon on its own dark ground.

• ggshield now requires py-gitguardian 1.34.0, which carries the
  AgentInfo.subscription_email field the AI discovery report sends.

Fixed

• On macOS, ggshield no longer triggers the Xcode Command Line Tools install prompt
  when the tools are not installed.

• On macOS, ggshield no longer pops a "Keychain Not Found" dialog when checking
  whether the keyring is usable. The check now only reads from the credential
  store instead of writing a probe entry, which also stops it from silently
  falling back to file-based token storage on machines where the keychain can be
  read but not written.

• ggshield secret scan ai-hook no longer skips the scan when a Bash command starting with
  cat or Get-Content is not a plain file read (a heredoc, a redirection...).
  Such commands are now always scanned as text.

• ggshield secret scan ai-hook now scans only the lines an agent actually reads, instead of
  the whole file. A file over the API's 1 MiB document limit was skipped outright — allowed
  without being scanned at all — even when the agent only read a few hundred lines of it;
  that slice now scans normally. Ranges are read from Claude Code (offset/limit) and
  VS Code (startLine/endLine); a read without a range still scans the whole file.

• The AI discovery is now submitted to GitGuardian only when the local AI/MCP
  configuration actually changed, as it was always meant to be. A type mismatch
  between a freshly discovered MCP configuration and one read back from the local
  cache made the comparison always report a change, so every MCP tool call
  uploaded a full discovery payload.

• When a secret is found in a file mentioned in a prompt (@path), AI hooks now name
  that file in the block message instead of reporting it as a secret "in your prompt".
  The previous wording pointed at the wrong content and asked the user to edit a prompt
  that did not contain the secret.

• On macOS, the token stored by ggshield auth login is now created with a
  Keychain ACL trusting every ggshield binary, so the native hook can read it
  without prompting. Previously only the writing binary was trusted and each
  login reset the ACL, making "Always Allow" wear off.

• On macOS, ggshield no longer asks for Keychain access again after every upgrade. The
  code-signing identifier embedded a per-build hash, so the "Always Allow" grant recorded
  for one release stopped matching the next one; it is now pinned to
  com.gitguardian.ggshield. One grant made from a release built with this fix onwards
  keeps working across upgrades.

• The AI hooks no longer create incidents on your dashboard when secret.source_uuid is set
  in your configuration (a setting shared with CI scanning): a hook event is not a source
  scan, and every prompt and every file the agent read was creating an incident. They also
  now always scan with all_secrets, so they can block on a secret that is already known to
  GitGuardian instead of letting it through.

• tomli was added to the dev dependency group, without a marker, so dev environments always have it regardless of the
  Python interpreter, and ty can resolve the fallback branch it insists on analyzing

• secret scan ai-hook now honours secret.ignored_paths from
  .gitguardian.yaml, as every other secret scan command already did. A file
  excluded there is no longer read, sent, or blocked on when an agent reads it.
  Previously the setting was silently inert on this path. ignored_matches and
  ignored_detectors were never affected. This also brings the default
  exclusions to the hook: reads under node_modules/, .venv/, vendor/,
  .git/ and the other IGNORED_DEFAULT_WILDCARDS entries are no longer
  scanned. Those defaults are matched against the path relative to the project
  and with symlinks resolved, so a checkout that itself lives under a directory
  named vendor/, node_modules/ or .venv/ is still scanned normally, and a
  symlink parked in a vendored tree cannot hide a file living outside it.

• On macOS, ggshield auth login no longer writes the token straight to the
  Apple Keychain when PYTHON_KEYRING_BACKEND selects another backend: the write
  now follows the backend the token is read back from. Previously login reported
  success while nothing could authenticate afterwards.

• keyring now requires 25.0 or later, the first version carrying the
  create_cf binding the Keychain ACL is built with. On 24.x the ACL silently
  never applied.

• AI discovery no longer reports MCP server configurations for agents that are not
  installed. A project .mcp.json is read by several agents, and Copilot also declared a
  hardcoded GitHub MCP server, so machines without those agents reported configurations
  they could not run.

• On macOS and Windows, ggshield now finds VSCode's user directory, so its global MCP
  servers and its known workspaces are discovered there too.

• The cryptography shipped in the released binaries is now 50.0.0, fixing
  CVE-2026-69247, a Bleichenbacher oracle in PKCS#7 EnvelopedData decryption.
  ggshield does not use that code path.

• The AI hook installed from the macOS standalone package now points at
  /usr/local/bin/ggshield instead of the versioned /opt/gitguardian/ggshield-<version>/
  directory an upgrade removes, so it keeps scanning after an upgrade.

• ggshield machine setup now repoints an AI hook command whose ggshield binary is gone,
  or is reachable through a more stable path, instead of leaving the broken command in
  place.

• On macOS, ggshield machine setup now asks the Keychain for access as the binary
  that actually runs the AI hook. Keychain grants are per binary, so the hook used to
  raise its own authorization dialog inside an agent-spawned process, where the agent's
  timeout could kill it before "Always Allow" was recorded and the dialog came back on
  every prompt.

• ggshield no longer reads the OS credential store on startup. The token is now
  fetched when a command actually needs it, so commands that do not use one (such as
  ggshield config list, ggshield plugin list and ggshield install) no longer
  trigger a macOS Keychain password prompt.

• ggshield secret scan ai-hook no longer leaves a whole event unscanned when the file path
  it guessed from a Bash command or an @-mention cannot be read. Such a candidate is
  dropped instead of being sent to the scanner, where the read error aborted the event and
  allowed the action with a "could not scan" warning, so the command or prompt text of that
  same event is now always scanned. A candidate longer than the filesystem's limits (a
  heredoc mistaken for a file name) is also recognized as text without a filesystem call.

aws/jsii-rosetta (jsii-rosetta)

v6.0.12

Compare Source

What's Changed

• chore(deps): upgrade dependencies by @​aws-cdk-automation in #​3793
• chore(deps): upgrade dependencies by @​aws-cdk-automation in #​3795

Full Changelog: aws/jsii-rosetta@v6.0.11...v6.0.12

nodejs/node (node)

v24.20.0: 2026-08-26, Version 24.20.0 'Krypton' (LTS), @​aduh95

Compare Source

Notable Changes

• [b12bcc9ae1] - (SEMVER-MINOR) async_hooks: add using scopes to AsyncLocalStorage (Stephen Belanger) #​61674
• [e2eb88b36b] - (SEMVER-MINOR) buffer: add end parameter (Robert Nagy) #​62390
• [1fefdda18e] - crypto: update root certificates to NSS 3.125 (Node.js GitHub Bot) #​64746
• [4a158cf1ab] - doc: add MikeMcC399 as collaborator (Mike McCready) #​64656
• [d4cafce076] - (SEMVER-MINOR) lib,permission: add permission.drop (Rafael Gonzaga) #​62672
• [b3cfb55267] - (SEMVER-MINOR) loader: implement package maps (Maël Nison) #​62239
• [cd1eb3e60b] - (SEMVER-MINOR) src,permission: add --permission-audit (RafaelGSS) #​61869
• [28dc85d8d2] - (SEMVER-MINOR) stream: add node:stream/iter implementation (James M Snell) #​62066
• [d31c168740] - (SEMVER-MINOR) test_runner: add context.log() and test:log event (Moshe Atlow) #​64389
• [add1edbc42] - (SEMVER-MINOR) test_runner: report entryFile in TestStream events (Moshe Atlow) #​64309
• [d937c8c6cd] - (SEMVER-MINOR) wasm: enable JSPI (Guy Bedford) #​59941

Commits

• [1822c0f335] - assert,util: fix TypeError on Maps with null keys (Paul Bouchon) #​64441
• [b12bcc9ae1] - (SEMVER-MINOR) async_hooks: add using scopes to AsyncLocalStorage (Stephen Belanger) #​61674
• [984260bf44] - async_hooks: use validateBoolean for trackPromises (Soul Lee) #​64731
• [ba2612cca2] - benchmark: fix calibrate-n option handling (Luan Muniz) #​64146
• [236dc4d2d7] - benchmark: add bytes variant to webstreams async-iterator (Matteo Collina) #​64291
• [b022a1419c] - benchmark: respect stream/iter broadcast backpressure (Trivikram Kamat) #​63314
• [a290f51f15] - (SEMVER-MINOR) benchmark: add benchmarks for experimental stream/iter (James M Snell) #​62066
• [465f2bfb74] - buffer: use Clamp conversion in Blob slice (Donghoon Kang) #​64739
• [74a22cd0c5] - buffer: validate copyArrayBuffer offsets against buffer length (Ilia Alshanetsky) #​63904
• [21e24208dc] - buffer: normalize lone "\r" in Blob native line endings (Daijiro Wachi) #​64115
• [ddacb3ff10] - buffer: fix Blob.stream() leaking source buffer (semimikoh) #​63577
• [49198d2313] - buffer: fix end parameter bugs in indexOf/lastIndexOf (Robert Nagy) #​62711
• [e2eb88b36b] - (SEMVER-MINOR) buffer: add end parameter (Robert Nagy) #​62390
• [e2e5c4fe88] - build: update binary-upload to use correct tarball name (Stewart X Addison) #​65282
• [b78a212553] - build: pin envinfo versions in github actions (Joyee Cheung) #​64117
• [094fb840aa] - build: add QUIC CI job for PRs matching QUIC related paths (Tim Perry) #​63875
• [91f5003cad] - build: fix flags for ngtcp2 on IBM i (SRAVANI GUNDEPALLI) #​60073
• [e83648effd] - build,test: add tests for binary linked with shared libnode (Joyee Cheung) #​61463
• [4a425b41d9] - build,tools: fix shared library cross-compile (Kirill Saied) #​63963
• [fe8fa45ff2] - cli: style node --help output with util.styleText (Adrián Estrada) #​64484
• [3cd1576cb2] - crypto: preserve OpenSSL errors from KDF failures (Filip Skokan) #​64776
• [74b3023565] - crypto: handle XOF output allocation failure (Filip Skokan) #​64851
• [fea0666a1b] - crypto: clarify missing cipher error (Filip Skokan) #​64852
• [33fec91b54] - crypto: reuse X509 issuer result (Filip Skokan) #​64852
• [44c1473348] - crypto: validate key generation options (Filip Skokan) #​64852
• [c2c53a18e5] - crypto: fix Argon2 validation errors (Filip Skokan) #​64852
• [edc1f2126d] - crypto: initialize KeyObjectData mutex eagerly (Filip Skokan) #​64851
• [be8237240c] - crypto: handle DH operation failures (Filip Skokan) #​64851
• [b65a8f3875] - crypto: preserve RSA-PSS legacy pubkey DER (Filip Skokan) #​64547
• [49f2ae204b] - crypto: cleanse provider private key copies (Filip Skokan) #​64547
• [a5d4ac8208] - crypto: handle incomplete RSA private keys (Filip Skokan) #​64547
• [b72c0b9616] - crypto: retain legacy DH validation (Filip Skokan) #​64547
• [24a1be5886] - crypto: limit KangarooTwelveParams customization to 512 bytes (Filip Skokan) #​64557
• [0290e0a61e] - crypto: split OpenSSL 3, BoringSSL, and legacy backends (Filip Skokan) #​64211
• [ba27e72ff8] - crypto: fix Argon2 bypassing FIPS mode (Filip Skokan) #​64776
• [1fefdda18e] - crypto: update root certificates to NSS 3.125 (Node.js GitHub Bot) #​64746
• [c0dd022081] - crypto: use user-facing error for output encoding changes (Archkon) #​64692
• [ff485a9410] - crypto: make --use-system-ca per-env rather than per-process (Aditi) #​60678
• [1329d9b9f1] - debugger: preserve overlapping CDP request state (Trivikram Kamat) #​64467
• [82a02336aa] - deps: V8: backport d259a9e (Leszek Swirski) #​63865
• [f0fc82d404] - deps: update ngtcp2 to 1.25.0 (Node.js GitHub Bot) #​64944
• [c4e02f0fbc] - deps: upgrade npm to 11.19.0 (npm team) #​64883
• [d5a57ed4dd] - deps: update nghttp3 to 1.18.0 (Node.js GitHub Bot) #​64943
• [51d413150a] - deps: update minimatch to 10.2.6 (Node.js GitHub Bot) #​64945
• [21f79ce140] - deps: update simdjson to 4.6.6 (Node.js GitHub Bot) #​64942
• [7a4960d6a9] - deps: update acorn to 8.18.0 (Node.js GitHub Bot) #​64941
• [5c423aa113] - deps: update googletest to 1b6f64d (Node.js GitHub Bot) #​64940
• [40561e61b0] - deps: update nghttp2 to 1.70.0 (Node.js GitHub Bot) #​64939
• [51090925b0] - deps: update zlib to 1.3.2.1-motley-42c2f19 (Node.js GitHub Bot) #​64744
• [7c534bf8e5] - deps: V8: backport 5177b10 (avivkeller) #​64631
• [7b1898a341] - deps: update ada to 4.0.0 (Node.js GitHub Bot) #​64790
• [9209cc4095] - deps: update sqlite to 3.53.4 (Node.js GitHub Bot) #​64745
• [3833fceff6] - deps: update googletest to fa005b2 (Node.js GitHub Bot) #​64587
• [bc7ce488d1] - deps: histogram: cherry-pick 62ea52b (StefanStojanovic) #​64296
• [e3fa05841d] - deps: update histogram to 0.11.10 (Node.js GitHub Bot) #​64296
• [e75bdb9bbe] - deps: update amaro to 1.1.11 (Node.js GitHub Bot) #​64586
• [1e034e6e40] - deps: update timezone to 2026c (Node.js GitHub Bot) #​64588
• [2b8f1f27bd] - deps: update googletest to 8240fa7 (Node.js GitHub Bot) #​64439
• [241ece0417] - deps: enable OpenSSL asm support for riscv64 (Jamie Magee) #​62606
• [215105eb90] - deps: update c-ares to 1.34.8 (Node.js GitHub Bot) #​64330
• [7ac97fc84e] - deps: upgrade npm to 11.18.0 (npm team) #​64199
• [8d4cb9ae46] - deps: update zlib to 1.3.2.1-motley-8b3aa8a (Node.js GitHub Bot) #​64295
• [564c0f4592] - deps: update ngtcp2 to 1.24.0 (Node.js GitHub Bot) #​64297
• [e3304cd31a] - deps: update nghttp3 to 1.17.0 (Node.js GitHub Bot) #​64182
• [345d6ad4eb] - deps: update ngtcp2 to 1.23.0 (Node.js GitHub Bot) #​63777
• [a53db015e6] - deps: update nghttp3 to 1.16.0 (Node.js GitHub Bot) #​63776
• [1f4a5c1c76] - deps: update ngtcp2 to 1.22.1 (Node.js GitHub Bot) #​62812
• [080c4d7cda] - deps: update ngtcp2 to 1.22.0 (Node.js GitHub Bot) #​62595
• [4309e7c82f] - deps: update ngtcp2 to 1.21.0 (Node.js GitHub Bot) #​62051
• [90cf11cfb5] - deps: update nghttp3 to 1.15.0 (Node.js GitHub Bot) #​61512
• [e1f315a554] - deps: update ngtcp2 to 1.20.0 (Node.js GitHub Bot) #​61511
• [9a3f690c9d] - deps: update ngtcp2 to 1.19.0 (Node.js GitHub Bot) #​61156
• [fe88f31764] - deps: add ngtcp2 test binaries (James M Snell) #​59946
• [6d60fce138] - diagnostics_channel: grow native channel storage (Stephen Belanger) #​64497
• [30ae8ab091] - doc: document --permission-audit audit mode behavior (Adrián Estrada) #​64791
• [8cefc6efa8] - doc: fix guaranteed typo (lilianakatrina684-a11y) #​62374
• [2e78e4b120] - doc: add throwIfNoEntry version history to fs.stat (kovan) #​62204
• [c7a04401cb] - doc: fix grammar and punctuation in dgram documentation (Kamal Rawal) #​64957
• [331e5e8f62] - doc: fix grammar and editorial issues in addons documentation (Kamal Rawal) #​64952
• [232287fcc6] - doc: formalize fn/name as part of TestOptions API (Christopher Hiller) #​64946
• [7f9efeb445] - doc: remove references to ca/crl as per-context QuicSession options (René) #​64769
• [b54aa83cc6] - doc: fix typo in maintaining-dependencies.md (greenhead) #​64896
• [f4e427803c] - doc: add RafaelGSS as last security release stewards (Rafael Gonzaga) #​64843
• [f2cd6df3f3] - doc: fix typos in documentation (greenhead) #​64900
• [d5627162bd] - doc: improve TestContext hook descriptions (Kamal Rawal) #​64899
• [72ee03bd2e] - doc: document stream.isDestroyed() (YspritanHyzygy) #​64789
• [995141eb81] - doc: add contributing detail for git Signed-off-by trailer (Mike McCready) #​64862
• [dc30379310] - doc: fix duplicated word in test snapshot docs (Kamal Rawal) #​64837
• [205d4d0472] - doc: remove obsolete cctest node.gyp instructions (Soul Lee) #​64814
• [108b883d0b] - doc: report proper return type on url.format (Brian Muenzenmeyer) #​64806
• [b03bd3a8ed] - doc: clarify tlsSocket.authorized on resumption (soreavis) #​64584
• [093098ad7f] - doc: stabilize --disable-warning (Jean Michelet) #​64742
• [2de1d76d80] - doc: add MDN links for explicit resource management in fs (lluisemper) #​59557
• [2e0f36a891] - doc: mention constructor check in deepStrictEqual (Sumit Kumar Das) #​62010
• [1c9d354d09] - doc: update technical priorities (Jacob Smith) #​64505
• [30c99bf08f] - doc: deprecation add more codemod (Augustin Mauroy) #​63175
• [8a971a09eb] - doc: run license-builder (Node.js GitHub Bot) #​63918
• [707f6eacfc] - doc: clarify rules for adding new built-in modules (Antoine du Hamel) #​64648
• [928208cffc] - doc: mention DEPENDENCY custom field for H1 reports (Rafael Gonzaga) #​64634
• [ee593cadf5] - doc: fix dnsPromises.lookup verbatim default (Shivam S) #​64658
• [9c228b32d1] - doc: fix typo in releases guide (Jihwan) #​64621
• [4a158cf1ab] - doc: add MikeMcC399 as collaborator (Mike McCready) #​64656
• [8125809853] - doc: use promote wording in release guide (Md Muhtasim Munif Fahim) #​64371
• [2a2effadf6] - doc: fix import.meta example for vm.SourceTextModule (Muhammad Zeeshan) #​64112
• [c879f912bf] - doc: mention crypto.hash() for better perf (Steven) #​63420
• [634afda904] - doc: update sea example by fixing wrong code example (Maxence Robinet) #​64025
• [bced1433a3] - doc: fix socket.readyState state descriptions (YuSheng Chen) #​64468
• [4b2c18938f] - doc: replace large tables in crypto.md and webcrypto.md with lists (Filip Skokan) #​64582
• [5207231996] - doc: note --env-file is not applied to --run (Paul Bouchon) #​64442
• [329a2884fd] - doc: fix typo in embedding.md (greenhead) #​64425
• [fab3f56aa1] - doc: fix typos in contributing docs (Donghoon Kang) #​64520
• [cbc2bed4e8] - doc: document TLS alpnProtocol and servername fields (Tim Perry) #​64362
• [dada3ae60e] - doc: fix spelling in devcontainer guide (한만욱) #​64459
• [71343b28aa] - doc: clarify PEM format for signing keys (Harjoth Khara) #​64404
• [0544ec1c78] - doc: fix typo in tls.md (Daijiro Wachi) #​64458
• [8fe58078e7] - doc: document net Socket server property (Efe Karasakal) #​64364
• [d54fd03fa4] - doc: update a Dispatcher undici doc link (Filip Skokan) #​64358
• [1bdebecd41] - doc: fix typos in documentation (Jungwon Sohn) #​64466
• [86bca58641] - doc: clarify fixes and refs trailer guidance (Trivikram Kamat) #​64421
• [b5b84c9394] - doc: add scope overview tables for TestsStream events (Moshe Atlow) #​64386
• [004238d77c] - doc: clarify proxy threat model (Matteo Collina) #​64366
• [6851b8d55f] - doc: add note about restricted CI to pull-requests.md (Stewart X Addison) #​64321
• [662e33714a] - doc: various updates to releases.md (Stewart X Addison) #​64198
• [949bc3cfd3] - doc: remove obsolete --napi-modules doc entry (Chengzhong Wu) #​64220
• [830d16067f] - doc: clarify QUIC stream state wording (EduardF1) #​63660
• [79b6704630] - doc: fix typo in node-config-schema.json (Hamid Reza Ghavami) #​64188
• [9f5bf554db] - doc: fix broken link (Antoine du Hamel) #​65078
• [42b27ed428] - doc: remove unsupported syntax from stream_iter.md (Antoine du Hamel) #​64649
• [f1a9df7f22] - doc: clarify fromReadable() duck-typed contract (Trivikram Kamat) #​63682
• [c7a3d450ac] - doc: improve quic documentation (James M Snell) #​63157
• [cc425bc659] - doc: fix promise nomenclature in stream_iter.md (Antoine du Hamel) #​63406
• [859a02da96] - doc: minor structural stream/iter edits (René) #​63089
• [630b15eb20] - doc: fix doubled word typo in stream_iter.md (Daijiro Wachi) #​62916
• [50791fa8fa] - doc,test: widen fsPromises.appendFile()'s data type, add missing tests (Jimmy Leung) #​64279
• [9e39360a09] - esm: improve ERR_REQUIRE_ASYNC_MODULE (Joyee Cheung) #​64260
• [d2b02e443a] - esm: print required top-level await locations without evaluating (Joyee Cheung) #​64154
• [e8c153f3f4] - events: avoid retaining removed event names (Matteo Collina) #​64475
• [73e1701bad] - events: optimize once() and removeListener() (Matteo Collina) #​64373
• [12f7fc0558] - fs: key glob matcher cache by platform (Archkon) #​64571
• [e5af022302] - fs: add pattern cache for matchGlobPattern() (bq) #​63915
• [63321eeb11] - fs: fix cp symlink and EEXIST handling on Windows (Kirill Saied) #​64353
• [0ad55e5618] - http: fix writableFinished and 'finish' after write errors (Tim Perry) #​64847
• [ee54d9d4d2] - http: avoid aborting IncomingMessage signal on normal close (Archkon) #​64392
• [14cb8b0a06] - http: guard invalid timeout values in checkConnections (Efe Karasakal) #​64506
• [f24177ccc6] - http: propagate highWaterMark to ClientRequest OutgoingMessage (trivenay) #​64653
• [55e2c2da8c] - http: fix perf_hooks detail.req.url port and proxied path (Stefano Baghino) #​64311
• [b57350fe27] - http: remove unused n arg from IncomingMessage._read (Efe Karasakal) #​64370
• [af3a17e0b3] - http2: avoid copying the options in respond() (Matteo Collina) #​64265
• [f11ac0da37] - http2: avoid per-write closures in kWriteGeneric (Matteo Collina) #​64265
• [157bd07b6e] - http2: reduce per-request allocations (Matteo Collina) #​64265
• [b075b33429] - http2: don't throw when destroying socket proxy (Matteo Collina) #​64427
• [445bcce079] - inspector: add --cond to node inspect probe mode (Joyee Cheung) #​64328
• [06b54fe7d3] - lib: fix AbortSignal.any() observed-composite leak (Paul Bouchon) #​64481
• [d8fac094d1] - lib: fix typo in comment in _http_client.js (agape1225) #​64729
• [9ce72fd6fb] - lib: use assignFunctionName util where it makes sense (Antoine du Hamel) #​64515
• [c40d1473e6] - lib,permission: fix addon permission drop (Martin Wagner) #​64007
• [d4cafce076] - (SEMVER-MINOR) lib,permission: add permission.drop (Rafael Gonzaga) #​62672
• [6b09d30a76] - lib,tools: add node-core/func-name-matching lint rule (Livia Medeiros) #​57901
• [d7d4f0e2ac] - loader: enforce path normalization before lookup (Maël Nison) #​63917
• [b3cfb55267] - (SEMVER-MINOR) loader: implement package maps (Maël Nison) #​62239
• [cf425ad935] - meta: bump actions/stale from 10.3.0 to 11.0.0 (dependabot[bot]) #​64935
• [26fa9cc32b] - meta: bump github/codeql-action/analyze from 4.36.2 to 4.37.3 (dependabot[bot]) #​64934
• [c90fa82cd7] - meta: bump github/codeql-action/autobuild from 4.36.2 to 4.37.3 (dependabot[bot]) #​64933
• [314893253a] - meta: bump actions/setup-python from 6.3.0 to 7.0.0 (dependabot[bot]) #​64932
• [6ab711278f] - meta: bump github/codeql-action/init from 4.36.2 to 4.37.3 (dependabot[bot]) #​64931
• [9138f5892a] - meta: bump Mozilla-Actions/sccache-action from 0.0.10 to 0.0.11 (dependabot[bot]) #​64930
• [3ef3f934d4] - meta: bump github/codeql-action/upload-sarif from 4.36.2 to 4.37.3 (dependabot[bot]) #​64927
• [a0a33127ae] - meta: bump step-security/harden-runner from 2.19.4 to 2.20.0 (dependabot[bot]) #​64926
• [4ad2afbf33] - meta: bump ossf/scorecard-action from 2.4.3 to 2.4.4 (dependabot[bot]) #​64925
• [d9b2ee4083] - meta: add @​nodejs/url as codeowner for node_url_pattern.* (Efe Karasakal) #​64737
• [2b43b78e82] - meta: lower stale to 3 months (Aviv Keller) #​64569
• [0ffe8352ae] - meta: move one or more collaborators to emeritus (Node.js GitHub Bot) #​64315
• [afd922cd8a] - meta: bump actions/checkout from 6.0.2 to 7.0.0 (dependabot[bot]) #​64245
• [[b6149a2976](https://redirect.github.com/n

✂ Note

PR body was truncated to here.

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • At any time (no schedule defined)
• Automerge
  • Between 12:00 AM and 03:59 AM (* 0-3 * * *)

🚦 Automerge: Enabled.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

[codacy-production]

Up to standards ✅

🟢 Issues 0 issues

Results:
0 new issues

View in Codacy

_{NEW Get contextual insights on your PRs based on Codacy's metrics, along with PR and Jira context, without leaving GitHub. Enable AI reviewer
TIP This summary will be updated as you push new changes.}

[github-actions]

❌ Error planning Terraform CDK Stack 'cdktf'

Error: The process '/usr/local/bin/npx' failed with exit code 1

npm warn deprecated inflight@1.0.6: This module is not supported, and leaks memory. Do not use it. Check out lru-cache if you want a good and tested way to coalesce async requests by a key value, which is much more comprehensive and powerful.
npm warn deprecated prebuild-install@7.1.3: No longer maintained. Please contact the author of the relevant native addon; alternatives are available.
npm warn deprecated lodash.isequal@4.5.0: This package is deprecated. Use require('node:util').isDeepStrictEqual instead.
npm warn deprecated glob@7.2.3: Old versions of glob are not supported, and contain widely publicized security vulnerabilities, which have been fixed in the current version. Please update. Support for old versions may be purchased (at exorbitant rates) by contacting i@izs.me
npm warn deprecated glob@7.2.3: Old versions of glob are not supported, and contain widely publicized security vulnerabilities, which have been fixed in the current version. Please update. Support for old versions may be purchased (at exorbitant rates) by contacting i@izs.me
npm warn deprecated glob@7.2.3: Old versions of glob are not supported, and contain widely publicized security vulnerabilities, which have been fixed in the current version. Please update. Support for old versions may be purchased (at exorbitant rates) by contacting i@izs.me
npm warn deprecated uuid@8.3.2: uuid@10 and below is no longer supported.  For ESM codebases, update to uuid@latest.  For CommonJS codebases, use uuid@11 (but be aware this version will likely be deprecated in 2028).
npm warn deprecated glob@10.4.5: Old versions of glob are not supported, and contain widely publicized security vulnerabilities, which have been fixed in the current version. Please update. Support for old versions may be purchased (at exorbitant rates) by contacting i@izs.me
npm warn deprecated uuid@9.0.1: uuid@10 and below is no longer supported.  For ESM codebases, update to uuid@latest.  For CommonJS codebases, use uuid@11 (but be aware this version will likely be deprecated in 2028).
[2026-08-27T00:18:08.071] [ERROR] default - /home/runner/work/infrastructure/infrastructure/cdktf/node_modules/ts-node/dist/configuration.js:91
    const { fileExists = ts.sys.fileExists, readFile = ts.sys.readFile, skipProject = index_1.DEFAULTS.skipProject, project = index_1.DEFAULTS.project, tsTrace = index_1.DEFAULTS.tsTrace, } = rawApiOptions;
                                ^

TypeError: Cannot read properties of undefined (reading 'fileExists')
    at readConfig (/home/runner/work/infrastructure/infrastructure/cdktf/node_modules/ts-node/dist/configuration.js:91:33)
    at findAndReadConfig (/home/runner/work/infrastructure/infrastructure/cdktf/node_modules/ts-node/dist/configuration.js:50:84)
    at phase3 (/home/runner/work/infrastructure/infrastructure/cdktf/node_modules/ts-node/dist/bin.js:254:67)
    at bootstrap (/home/runner/work/infrastructure/infrastructure/cdktf/node_modules/ts-node/dist/bin.js:47:30)
    at main (/home/runner/work/infrastructure/infrastructure/cdktf/node_modules/ts-node/dist/bin.js:33:12)
    at Object.<anonymous> (/home/runner/work/infrastructure/infrastructure/cdktf/node_modules/ts-node/dist/bin.js:579:5)
    at Module._compile (node:internal/modules/cjs/loader:1781:14)
    at Object..js (node:internal/modules/cjs/loader:1913:10)
    at Module.load (node:internal/modules/cjs/loader:1505:32)
    at Function._load (node:internal/modules/cjs/loader:1309:12)

Node.js v22.23.2

ERROR: cdktf encountered an error while synthesizing

Synth command: npx ts-node main.ts
Error:         non-zero exit code 1

Command output on stderr:

    /home/runner/work/infrastructure/infrastructure/cdktf/node_modules/ts-node/dist/configuration.js:91
        const { fileExists = ts.sys.fileExists, readFile = ts.sys.readFile, skipProject = index_1.DEFAULTS.skipProject, project = index_1.DEFAULTS.project, tsTrace = index_1.DEFAULTS.tsTrace, } = rawApiOptions;
                                    ^

    TypeError: Cannot read properties of undefined (reading 'fileExists')
        at readConfig (/home/runner/work/infrastructure/infrastructure/cdktf/node_modules/ts-node/dist/configuration.js:91:33)
        at findAndReadConfig (/home/runner/work/infrastructure/infrastructure/cdktf/node_modules/ts-node/dist/configuration.js:50:84)
        at phase3 (/home/runner/work/infrastructure/infrastructure/cdktf/node_modules/ts-node/dist/bin.js:254:67)
        at bootstrap (/home/runner/work/infrastructure/infrastructure/cdktf/node_modules/ts-node/dist/bin.js:47:30)
        at main (/home/runner/work/infrastructure/infrastructure/cdktf/node_modules/ts-node/dist/bin.js:33:12)
        at Object.<anonymous> (/home/runner/work/infrastructure/infrastructure/cdktf/node_modules/ts-node/dist/bin.js:579:5)
        at Module._compile (node:internal/modules/cjs/loader:1781:14)
        at Object..js (node:internal/modules/cjs/loader:1913:10)
        at Module.load (node:internal/modules/cjs/loader:1505:32)
        at Function._load (node:internal/modules/cjs/loader:1309:12)

    Node.js v22.23.2




⠇  Synthesizing

[github-actions]

❌ Error applying Terraform CDK Stack 'cdktf'

Error: The process '/usr/local/bin/npx' failed with exit code 1

npm warn deprecated inflight@1.0.6: This module is not supported, and leaks memory. Do not use it. Check out lru-cache if you want a good and tested way to coalesce async requests by a key value, which is much more comprehensive and powerful.
npm warn deprecated prebuild-install@7.1.3: No longer maintained. Please contact the author of the relevant native addon; alternatives are available.
npm warn deprecated lodash.isequal@4.5.0: This package is deprecated. Use require('node:util').isDeepStrictEqual instead.
npm warn deprecated glob@7.2.3: Old versions of glob are not supported, and contain widely publicized security vulnerabilities, which have been fixed in the current version. Please update. Support for old versions may be purchased (at exorbitant rates) by contacting i@izs.me
npm warn deprecated glob@7.2.3: Old versions of glob are not supported, and contain widely publicized security vulnerabilities, which have been fixed in the current version. Please update. Support for old versions may be purchased (at exorbitant rates) by contacting i@izs.me
npm warn deprecated glob@7.2.3: Old versions of glob are not supported, and contain widely publicized security vulnerabilities, which have been fixed in the current version. Please update. Support for old versions may be purchased (at exorbitant rates) by contacting i@izs.me
npm warn deprecated uuid@8.3.2: uuid@10 and below is no longer supported.  For ESM codebases, update to uuid@latest.  For CommonJS codebases, use uuid@11 (but be aware this version will likely be deprecated in 2028).
npm warn deprecated uuid@9.0.1: uuid@10 and below is no longer supported.  For ESM codebases, update to uuid@latest.  For CommonJS codebases, use uuid@11 (but be aware this version will likely be deprecated in 2028).
npm warn deprecated glob@10.4.5: Old versions of glob are not supported, and contain widely publicized security vulnerabilities, which have been fixed in the current version. Please update. Support for old versions may be purchased (at exorbitant rates) by contacting i@izs.me
[2026-08-27T00:19:10.401] [ERROR] default - /home/runner/work/infrastructure/infrastructure/cdktf/node_modules/ts-node/dist/configuration.js:91
    const { fileExists = ts.sys.fileExists, readFile = ts.sys.readFile, skipProject = index_1.DEFAULTS.skipProject, project = index_1.DEFAULTS.project, tsTrace = index_1.DEFAULTS.tsTrace, } = rawApiOptions;
                                ^

TypeError: Cannot read properties of undefined (reading 'fileExists')
    at readConfig (/home/runner/work/infrastructure/infrastructure/cdktf/node_modules/ts-node/dist/configuration.js:91:33)
    at findAndReadConfig (/home/runner/work/infrastructure/infrastructure/cdktf/node_modules/ts-node/dist/configuration.js:50:84)
    at phase3 (/home/runner/work/infrastructure/infrastructure/cdktf/node_modules/ts-node/dist/bin.js:254:67)
    at bootstrap (/home/runner/work/infrastructure/infrastructure/cdktf/node_modules/ts-node/dist/bin.js:47:30)
    at main (/home/runner/work/infrastructure/infrastructure/cdktf/node_modules/ts-node/dist/bin.js:33:12)
    at Object.<anonymous> (/home/runner/work/infrastructure/infrastructure/cdktf/node_modules/ts-node/dist/bin.js:579:5)
    at Module._compile (node:internal/modules/cjs/loader:1781:14)
    at Object..js (node:internal/modules/cjs/loader:1913:10)
    at Module.load (node:internal/modules/cjs/loader:1505:32)
    at Function._load (node:internal/modules/cjs/loader:1309:12)

Node.js v22.23.2

ERROR: cdktf encountered an error while synthesizing

Synth command: npx ts-node main.ts
Error:         non-zero exit code 1

Command output on stderr:

    /home/runner/work/infrastructure/infrastructure/cdktf/node_modules/ts-node/dist/configuration.js:91
        const { fileExists = ts.sys.fileExists, readFile = ts.sys.readFile, skipProject = index_1.DEFAULTS.skipProject, project = index_1.DEFAULTS.project, tsTrace = index_1.DEFAULTS.tsTrace, } = rawApiOptions;
                                    ^

    TypeError: Cannot read properties of undefined (reading 'fileExists')
        at readConfig (/home/runner/work/infrastructure/infrastructure/cdktf/node_modules/ts-node/dist/configuration.js:91:33)
        at findAndReadConfig (/home/runner/work/infrastructure/infrastructure/cdktf/node_modules/ts-node/dist/configuration.js:50:84)
        at phase3 (/home/runner/work/infrastructure/infrastructure/cdktf/node_modules/ts-node/dist/bin.js:254:67)
        at bootstrap (/home/runner/work/infrastructure/infrastructure/cdktf/node_modules/ts-node/dist/bin.js:47:30)
        at main (/home/runner/work/infrastructure/infrastructure/cdktf/node_modules/ts-node/dist/bin.js:33:12)
        at Object.<anonymous> (/home/runner/work/infrastructure/infrastructure/cdktf/node_modules/ts-node/dist/bin.js:579:5)
        at Module._compile (node:internal/modules/cjs/loader:1781:14)
        at Object..js (node:internal/modules/cjs/loader:1913:10)
        at Module.load (node:internal/modules/cjs/loader:1505:32)
        at Function._load (node:internal/modules/cjs/loader:1309:12)

    Node.js v22.23.2




⠇  Synthesizing