fix(deps): update all dependencies by renovate[bot] · Pull Request #429 · ProverCoderAI/docker-git

renovate · 2026-06-18T15:10:53Z

ℹ️ Note

This PR body was truncated due to platform limits.

This PR contains the following updates:

Package	Change	Type	Update
@biomejs/biome (source)	`^2.5.0` → `^2.5.2`	devDependencies	patch
@effect/platform (source)	`^0.96.1` → `^0.96.2`	dependencies	patch
@effect/platform (source)	`^0.96.1` → `^0.96.2`	devDependencies	patch
@fedify/fedify (source)	`^2.2.5` → `^2.3.1`	dependencies	minor
@fedify/vocab (source)	`^2.2.5` → `^2.3.1`	dependencies	minor
@types/node (source)	`^25.9.3` → `^26.1.0`	devDependencies	major
@typescript-eslint/eslint-plugin (source)	`^8.61.1` → `^8.62.1`	devDependencies	minor
@typescript-eslint/parser (source)	`^8.61.1` → `^8.62.1`	devDependencies	minor
@vitejs/plugin-react (source)	`^6.0.2` → `^6.0.3`	devDependencies	patch
actions/checkout	`v6` → `v7`	action	major
biome (source)	`^2.5.0` → `^2.5.2`	devDependencies	patch
effect (source)	`^3.21.3` → `^3.21.4`	dependencies	patch
effect (source)	`^3.21.3` → `^3.21.4`	devDependencies	patch
eslint (source)	`^10.5.0` → `^10.6.0`	devDependencies	minor
eslint-plugin-sonarjs (source)	`^4.0.3` → `^4.1.0`	devDependencies	minor
eslint-plugin-unicorn	`^67.0.0` → `^70.0.0`	devDependencies	major
globals	`^17.6.0` → `^17.7.0`	devDependencies	minor
jscpd (source)	`^5.0.10` → `^5.0.11`	devDependencies	patch
typescript-eslint (source)	`^8.61.1` → `^8.62.1`	devDependencies	minor
vite (source)	`^8.0.16` → `^8.1.3`	devDependencies	minor

cc @skulidropek

Release Notes

biomejs/biome (@biomejs/biome)

`v2.5.2`

Compare Source

Patch Changes

#10595 f458028 Thanks @pkallos! - Added the option ignoreBooleanCoercion to useNullishCoalescing. When enabled, Biome ignores || and ||= used inside a Boolean() call, where coalescing on falsy values is intentional.
#10798 4a32b63 Thanks @pkallos! - Added the option ignorePrimitives to useNullishCoalescing. When enabled, Biome ignores ||, ||=, and ternary expressions whose non-nullish operands are all primitives the option opts out of. Use true to ignore all primitives, or an object selecting string, number, boolean, or bigint.
#10545 f3d4c00 Thanks @Mokto! - Added the new nursery rule noSvelteUnnecessaryStateWrap, which reports unnecessary $state() wrapping of classes from svelte/reactivity that are already reactive.
```
<script>
import { SvelteMap } from "svelte/reactivity";
const map = $state(new SvelteMap()); // redundant
</script>
```
#10752 f62fb8b Thanks @ematipico! - Fixed #10739. Now the rule useValidAutocomplete correctly flags the autoComplete attribute.
#10796 f1b3ab2 Thanks @ematipico! - Fixed #10768. Improved the performance of the Biome Language Server by cancelling certain in-flight operations when there are fast updates.
#10719 aa649b5 Thanks @minseong0324! - Fixed noMisleadingReturnType false positive on returns that use a widening type assertion: "a" as string is no longer reported as misleading. The rule now also reports a literal-pinning assertion such as false as false, matching the existing as const behavior.
```
// No longer flagged (returns are `string`):
function getValue(b: boolean): string {
  if (b) return "a" as string;
  return "b" as string;
}

// Now also reported, like `as const` (returns `false`):
function isReady(): boolean {
  return false as false;
}
```
#10678 8f073a7 Thanks @PranavAchar01! - Fixed #7718: Biome now correctly parses CSS nesting selectors when & appears as a trailing sub-selector after a type selector, e.g. h1& { color: red; }.
#10756 5ec965a Thanks @denbezrukov! - Fixed CSS formatter output for selector lists with allowWrongLineComments and // comments after a selector comma. Biome now keeps the selector before the line comment inline instead of breaking it across descendant combinators.
```
-.powerPathNavigator
-  .helm
-  button.pressedButton, // pressed
+.powerPathNavigator .helm button.pressedButton, // pressed
 .powerPathNavigator .helm button:active:not(.disabledButton) {
 }
```
#10757 6232fcd Thanks @PranavAchar01! - Fixed #8269: the CSS parser now accepts Tailwind @variant and @utility names that start with a digit, such as the 2xl breakpoint.
```
@&#8203;utility container {
  @&#8203;variant 2xl {
    max-width: 1400px;
  }
}
```
#10777 575ced6 Thanks @WaterWhisperer! - Fixed an issue reported in #10708: the GitLab reporter now handles --verbose diagnostics filtering correctly.
#10281 0efe244 Thanks @Zelys-DFKH! - Fixed a bug where GritQL patterns rejected positional (unkeyed) arguments.
#10758 e36fd8a Thanks @henrybrewer00-dotcom! - Fixed #10697: The formatter no longer removes the parentheses around an await or yield expression used as the target of a TypeScript instantiation expression. For example, (await makeFactory)<Value> is no longer reformatted to await makeFactory<Value>, which would change the meaning of the code.

#10586 3617094 Thanks @IxxyDev! - Fixed #9568: noFloatingPromises no longer reports a false positive when calling an overloaded function and the selected overload does not return a promise.

function bestEffort(cb: () => Promise<number>): Promise<number>;
function bestEffort(cb: () => number): number;
function bestEffort(
  cb: () => number | Promise<number>,
): Promise<number> | number {
  return cb() as Promise<number> | number;
}

// This resolves to the second overload, which returns `number`, so it is no
// longer flagged as a floating promise.
bestEffort(() => 42);

#10766 7aff4c1 Thanks @JamBalaya56562! - Fixed #2862: noInteractiveElementToNoninteractiveRole no longer reports custom elements (a tag name containing a dash, e.g. <my-button role="img" />). Per the W3C HTML-ARIA specification, a custom element may be given any role or none.
#10680 771daa4 Thanks @WaterWhisperer! - Fixed #10635: Biome now recognizes chained
table tests such as test.concurrent.each() and it.concurrent.each() as test calls, fixing
noMisplacedAssertion false positives and improving formatting for those test declarations.
#10759 34570b5 Thanks @henrybrewer00-dotcom! - Fixed #10636: noStaticElementInteractions no longer reports a false positive for event handlers on Svelte special elements such as <svelte:window>, <svelte:document>, and <svelte:body>. These are not real DOM elements, so they are now ignored by the rule.
#10741 bd2364e Thanks @JamBalaya56562! - Fixed #6686: the rage command now respects the --config-path option and the BIOME_CONFIG_PATH environment variable when loading the Biome configuration. Previously it always used the default configuration resolution and reported the configuration as Not set when no biome.json existed in the working directory.
#10763 2c3e82d Thanks @Aqu1bp! - Fixed #10742: noSolidDestructuredProps now reports destructured props in Solid function components and JSX children.
#10606 a4cc4ab Thanks @Mokto! - Fixed false positives in noUnusedImports, noUnusedVariables, and useImportType for Svelte components that use both a <script module> and a <script> block. The two blocks compile to a single module and share a top-level scope, so a binding (import, function, or variable) declared in one block and used only in the other is no longer reported as unused.
#10767 36d5aa7 Thanks @otkrickey! - Fixed #10754: useVueValidVBind no longer reports the Vue 3.4+ same-name shorthand as missing a value. :foo and v-bind:foo are now accepted as equivalent to :foo="foo", while v-bind, v-bind:[dynamicArg], and :[dynamicArg] without a value continue to be reported.
#10775 a918af0 Thanks @WaterWhisperer! - Fixed an issue reported in #10708: biome rage didn't detect running Biome daemon pipes on Windows.
#10730 5a2e65b Thanks @dinocosta! - Fixed an issue where Biome was resolving the well-known Zed settings file from the wrong location on macOS and Windows.
#10807 d97fffe Thanks @ematipico! - Fixed an issue where .scss files were incorrectly analyzed when running biome check.
#10672 53c6efc Thanks @ematipico! - Fixed a bug where Biome incorrectly formatted snippets that have parsing errors.
#10719 aa649b5 Thanks @minseong0324! - Fixed useAwaitThenable false positive when awaiting a custom thenable that is not the global Promise. A value with a callable then member is now recognized as awaitable.
```
interface Thenable<T> {
  then(onfulfilled: (value: T) => void): void;
}
declare const t: Thenable<number>;
async function f() {
  await t;
}
```
#10734 4396496 Thanks @BangDori! - Fixed #10708: biome migrate now preserves trivia when migrating the deprecated recommended option to preset.
#10683 ae31a00 Thanks @Netail! - Fixed #10657 #10671 #10661 #10637 #10718: HTML rules now correctly handle dynamic attributes.
#10746 54e8239 Thanks @ematipico! - Fixed an issue where noUndeclaredClasses didn't correctly detect styles defined inside the Astro directive is:global.
#10770 dd1429c Thanks @ematipico! - Improved the Biome Language Server DX by orchestrating certain operations, so that they won't block the editor during typing. This improvement is more visible in large documents.
#10473 d9b5133 Thanks @Mokto! - Improved noUnusedImports, noUnusedVariables, noUnusedFunctionParameters, and useImportType for Svelte, Vue, and Astro files (with html.experimentalFullSupportEnabled). Bindings used only in the template — including component tags, attribute interpolations, directives, bind: shorthand, and snippet parameters — are no longer reported as unused, while genuinely unused ones still are.
#10796 f1b3ab2 Thanks @ematipico! - Fixed an issue where the Biome Language Server didn't enable project or type-aware lint rules, even when they were explicitly enabled.
#10746 54e8239 Thanks @ematipico! - Fixed an issue where noUndeclaredClasses didn't detect styles declared inside HTML documents.
#10774 bde945b Thanks @pattrickrice! - Fixed #10268 where a race condition resulted in internal errors such as: The file biome.json does not exist in the workspace.

`v2.5.1`

Compare Source

Patch Changes

#10722 f8a303d Thanks @denbezrukov! - Fixed CSS formatter output for comments between import media queries.

-@&#8203;import url("print.css") print,
-/* comment */
-screen;
+@&#8203;import url("print.css") print, /* comment */ screen;

#10738 9fdc560 Thanks @JamBalaya56562! - Fixed #9899: the json and json-pretty reporters now escape backslashes in a diagnostic's location.path. Previously, paths containing backslashes (such as Windows-style paths) were emitted unescaped, producing invalid JSON.
```
-    "path": "src\account\setup-passkey.tsx",
+    "path": "src\\account\\setup-passkey.tsx",
```
#10626 5f837df Thanks @tom-groves! - Fixed #10625: biome migrate no longer emits an invalid trailing comma when a renamed rule (such as noConsoleLog → noConsole) is the last member of its rule group. Previously this produced malformed output that aborted the migration of a strict-JSON biome.json with a parsing error.
#10535 c245f9d Thanks @Mokto! - Fixed a false positive in noUnusedVariables for Svelte files where variables referenced inside {@html expr} blocks were incorrectly reported as unused.
#10668 a0f197e Thanks @Netail! - The biome init command has been updated to include a more up-to-date URL to the first-party extensions page.
#10667 d8c3e87 Thanks @Netail! - Fixed #10664: useErrorCause now correctly detects a shorthand property.
#10696 ef2373f Thanks @ematipico! - Fixed #9566. Improved how the Biome Language Server loads multiple configuration files inside a workspace.
#10705 4ccb410 Thanks @ematipico! - Fixed #10652. Biome plugins are now properly filtered when using --only and --skip flags.
#10669 aa0a6eb Thanks @Netail! - Fixed #10651: useInlineScriptId now correctly trims trivia to detect if an id attribute has been set.
#10689 844b1be Thanks @ematipico! - Fixed #10658. The issue was caused by the "Go-to definition" editor feature, which was enabled by default. The feature is now disabled by default. To work, the feature triggers the scanner to build the module graph. This caused memory leak issues in cases where Biome starts in the home directory to modify files.

If you relied on this new feature, you must now turn on using the [editor settings] of the extension e.g. Zed and VSCode.
#10695 043fbb5 Thanks @ematipico! - Fixed #10674. Biome now throws an error when the field level is missing from a rule option.
#10712 5941df2 Thanks @Conaclos! - Improved the diagnostic and the documentation of useFlatMap.
#10615 23814f1 Thanks @qwertycxz! - Improved the DX the JSON schema when it's used by certain code editors like VSCode.
#10688 ec69489 Thanks @ematipico! - Fixed a bug where the Biome Daemon did not correctly shut down when the editor was closed during an in-progress operation, especially while scanning.
#10701 6c2e0d7 Thanks @ematipico! - Fixed #10694. The Biome Language Server no longer prints an error when the user hovers a variable imported from node_modules.
#10681 888515b Thanks @Conaclos! - Fixed useExportType that reported useless details in some diagnostics.
#10220 3694a13 Thanks @theBGuy! - Fixed useAnchorContent false positive for <a> elements used as render prop values (e.g. render={<a href="..." />}), a pattern where the receiving component renders its children inside the anchor element.
#10702 98823fb Thanks @ematipico! - Fixed #10612. The Biome parser now correctly parses processing instructions. The following SVG doesn't throw errors anymore:
```
<?xml version="1.0" encoding="UTF-8" ?>

<svg></svg>
```

Effect-TS/effect (@effect/platform)

`v0.96.2`

Compare Source

Patch Changes

#6273 7e00169 Thanks @tim-smart! - Remove the content-length header before sending FetchHttpClient requests.
Updated dependencies [8222963]:
- effect@3.21.4

fedify-dev/fedify (@fedify/fedify)

`v2.3.1`

Compare Source

Released on June 27, 2026.

@fedify/fedify

Fixed outbound activity delivery aborting when Linked Data Signatures
creation fails during JSON-LD canonicalization. Fedify now logs the
signing failure and continues delivery without the Linked Data Signature
for JSON-LD processing failures, while still surfacing key, configuration,
and programming errors from signing. [#824, #842 by Lee ByeongJun]
Fixed inbox verification crashing when a remote actor document contains a
malformed publicKey entry. Fedify now treats the malformed key as a
failed key lookup so HTTP Signatures verification fails normally instead of
returning a server error. [#825, #844 by Lee ByeongJun]

`v2.3.0`

Compare Source

Released on June 25, 2026.

@fedify/fedify

Added mapActorAlias() method to ActorCallbackSetters interface to
support fixed-path actor dispatchers. This is useful for exposing a
single, instance-level actor at a fixed path, such as /actor for a relay
or /bot for a bot, without leaking a sentinel identifier into the actor's
URI. [#752, #753]
Added optional MessageQueue.getDepth() support, using the new
MessageQueueDepth return type, for reporting queue backlog depth.
InProcessMessageQueue can now report queued messages, including ready
and delayed counts, and ParallelMessageQueue delegates depth reporting
to its wrapped queue when supported. [#735, #748]
Added OpenTelemetry metrics for ActivityPub delivery attempts, permanent
delivery failures, inbox listener processing duration, and HTTP Signature
verification failures. Applications can pass the new meterProvider
option to createFederation(), and Context.meterProvider exposes the
provider available to request, inbox, and outbox code.
[#316, #619, #755]
Added the activitypub.delivery.failed span event to queued outbox
delivery spans so retry and permanent-failure decisions include the
remote host, attempt number, and HTTP status code when available.
[#316, #619, #755]
Breaking change: Changed the activitypub.activity.sent span event to
record delivery metadata (activitypub.inbox.url and
activitypub.activity.id) instead of the full activitypub.activity.json
payload. FedifySpanExporter now stores outbound records from those
attributes, and TraceActivityRecord.activityJson is present only when the
span event includes full activity JSON. [#316, #619, #755]
Added two OpenTelemetry histograms for signature verification:
activitypub.signature.verification.duration measures end-to-end
verification time for HTTP Signatures, Linked Data Signatures, and
Object Integrity Proofs (including local key lookup and remote key
fetches), and activitypub.signature.key_fetch.duration measures
public key lookup duration separately so operators can isolate
non-fetch verification work. Both instruments carry
activitypub.signature.kind (http, linked_data, or
object_integrity) and bounded result attributes; the verification
histogram additionally carries spec-bounded
http_signatures.algorithm, ld_signatures.type, or
object_integrity_proofs.cryptosuite when known, plus
http_signatures.failure_reason on rejected HTTP rows.
[#316, #737, #769]
Added OpenTelemetry HTTP server metrics for inbound requests handled by
Federation.fetch(): fedify.http.server.request.count (Counter) and
fedify.http.server.request.duration (Histogram). Both instruments carry
http.request.method, fedify.endpoint, optional
http.response.status_code, and optional fedify.route.template
attributes so that operators can monitor aggregate request rate, latency,
and status-code error rate even when traces are sampled. Attributes
deliberately exclude raw URLs, query strings, and identifier values to
keep cardinality bounded. [#316, #736, #757]
Added OpenTelemetry metrics for ActivityPub collection requests handled
by Federation.fetch() and custom collection handlers:
- activitypub.collection.request (counter)
- activitypub.collection.dispatch.duration (histogram)
- activitypub.collection.page.items (histogram)
- activitypub.collection.total_items (histogram)
The metrics expose bounded collection dimensions:
activitypub.collection.kind, activitypub.collection.page,
activitypub.collection.result, fedify.collection.dispatcher, and
optional http.response.status_code. Built-in collections are classified
as inbox, outbox, following, followers, liked, featured, or
featured_tags; application-defined collection routes are collapsed into
custom. Collection IDs, cursors, custom route names, actor identifiers,
and full URLs are deliberately excluded so dashboards can aggregate
collection rate, latency, item counts, and totalItems values without
attacker-controlled cardinality. [#316, #741, #777]
Added OpenTelemetry queue task metrics covering Fedify's enqueue and
worker boundaries for inbox, outbox, and fanout work:
- fedify.queue.task.enqueued (counter)
- fedify.queue.task.started (counter)
- fedify.queue.task.completed (counter)
- fedify.queue.task.failed (counter)
- fedify.queue.task.duration (histogram)
- fedify.queue.task.in_flight (up/down counter, process local)
Instruments carry fedify.queue.role, best-effort
fedify.queue.backend (the queue implementation's constructor name),
and fedify.queue.native_retrial. The enqueue/started/completed/
failed/duration instruments additionally carry
activitypub.activity.type whenever Fedify knows the activity type
for the queued message; the in-flight up/down counter deliberately
omits per-message attributes so that increment and decrement
operations always pair up cleanly per attribute series. Enqueue
measurements additionally carry fedify.queue.task.attempt for
retries, and the completion-side instruments carry
fedify.queue.task.result (completed, failed, or aborted).
Together with MessageQueue.getDepth() reporting, these metrics let
operators distinguish a slow-draining queue from a queue that sees
less traffic. [#316, #740, #759]
Added OpenTelemetry metrics for ActivityPub fanout and activity
lifecycle events, complementing the per-recipient
activitypub.delivery.* counters and the per-task
fedify.queue.task.* metrics with an activity-level view of inbox
and outbox pressure:
- activitypub.fanout.recipients (histogram) records the number of
  recipient inboxes produced by a single fanout enqueue.
- activitypub.inbox.activity (counter) classifies an inbound
  activity via the new activitypub.processing.result attribute
  as queued, processed, retried, rejected, or abandoned.
- activitypub.outbox.activity (counter) classifies an outbound
  activity as queued, retried, or abandoned. Per-recipient
  sent/failed rows remain on activitypub.delivery.sent and
  activitypub.delivery.permanent_failure and are not duplicated.
The lifecycle counters cover only Fedify-managed events: queue
backends with nativeRetrial defer retry handling and therefore do
not record retried or abandoned. Recipient URLs, actor IDs,
and other high-cardinality identifiers are deliberately excluded
from the fanout histogram. [#316, #742, #770]
Added OpenTelemetry metrics for public key lookups, remote JSON-LD
document fetches, and lookupObject() calls so operators can
observe how often Fedify hits the cache, how long remote fetches
take, and how lookupObject() resolutions split between actors,
non-actor objects, and unresolved lookups:
- activitypub.key.lookup (counter) and
  activitypub.key.lookup.duration (histogram) cover every
  public key lookup performed by fetchKey() /
  fetchKeyDetailed(), including signature verification paths.
- activitypub.document.fetch (counter) and
  activitypub.document.fetch.duration (histogram) cover every
  Fedify-wrapped document or context loader invocation, including
  the authenticated loader.
- activitypub.document.cache (counter) records hit or miss
  for each kvCache()-backed cache lookup.
- activitypub.object.lookup (counter) records the
  parsed-result classification of every lookupObject() call as
  actor, object, or other.
Instruments share an activitypub.lookup.kind and (where
applicable) activitypub.lookup.result attribute drawn from small,
spec-bounded enumerations. activitypub.remote.host records the
URL host, including any non-default port; http.response.status_code
is recorded when an HTTP response was observed;
activitypub.cache.enabled is recorded on the key and document
fetch metrics whenever Fedify can confidently report the cache
layer's presence. Key IDs, actor
IDs, object IDs, JSON-LD context URLs, full URLs, and fediverse
handles are deliberately excluded so attacker-controlled remotes
cannot inflate metric cardinality. The existing
activitypub.signature.key_fetch.duration histogram (introduced in
Fedify 2.3 for signature-scoped key-fetch latency, sliced by
activitypub.signature.kind) remains in place; the new
activitypub.key.lookup.duration is the general-purpose
histogram that covers non-signature key fetches as well and adds
http.response.status_code and a richer
activitypub.lookup.result taxonomy. [#316, #738, #771]
Added OpenTelemetry metrics for the WebFinger and actor handle
discovery paths so operators can graph aggregate discovery rate,
latency, and outcome mix without sampling spans:
- webfinger.lookup (counter) and webfinger.lookup.duration
  (histogram) cover outgoing lookupWebFinger() calls.
- webfinger.handle (counter) and webfinger.handle.duration
  (histogram) cover incoming WebFinger requests handled by
  Federation.fetch().
- activitypub.actor.discovery (counter) and
  activitypub.actor.discovery.duration (histogram) cover
  getActorHandle() actor handle discovery.
Each family carries a bounded result attribute
(webfinger.lookup.result, webfinger.handle.result, or
activitypub.actor.discovery.result) so operators can slice
discovery failures by terminal outcome (found / not_found /
invalid / network_error / error for outgoing lookups;
resolved / invalid / not_found / tombstoned / error for incoming
requests; resolved / not_found / error for actor discovery).
webfinger.resource.scheme is bucketed to a small allow list
(acct, http, https, mailto, or other) so an
attacker-controlled query string cannot inflate metric
cardinality; activitypub.remote.host records the URL host,
including any non-default port. Full resource URIs, lookup URLs,
and handle strings are
deliberately excluded; they remain on the corresponding spans
(webfinger.lookup, webfinger.handle,
activitypub.get_actor_handle) for trace-level investigation.

lookupWebFinger() and getActorHandle() follow the opt-in
lookupObject() pattern: omitting the new meterProvider option
emits no measurement. Applications that pass a meterProvider
to createFederation() get the inbound webfinger.handle family
and the federation-bound Context.lookupWebFinger() family wired
up automatically. Direct getActorHandle() calls remain opt-in:
pass meterProvider through GetActorHandleOptions to enable
the discovery metrics, and the option is forwarded into the
nested WebFinger lookups so one discovery emits both the
discovery measurement and the underlying webfinger.lookup
measurements (one for the actor ID host, plus a second for the
alias host when cross-origin verification runs).
[#316, #739, #772]
Added an outbound delivery circuit breaker for queued outbox delivery.
Fedify now tracks consecutive network and HTTP 5xx delivery failures
per remote host (including any non-default port), stores the state in
the configured KvStore, and requeues messages held by an open circuit
instead of repeatedly sending to an unreachable server. The circuit
breaker is enabled by default for queued outbox delivery and can be
disabled with
circuitBreaker: false; applications can customize the failure policy,
recovery delay, held activity TTL, release interval, and state/drop
callbacks. HTTP 429 responses do not count as circuit failures and
Retry-After is respected when present. State changes are exposed
through activitypub.circuit_breaker.state_change metrics and
activitypub.circuit_breaker.state_change span events, and expired
held activities call the outbox permanent failure handler with
reason: "circuit-breaker-ttl". [#620, #778]
Added benchmarkMode to createFederation() and
FederationBuilder.build() for cooperative federation benchmarking.
When enabled, Fedify exposes GET /.well-known/fedify/bench/stats
for in-process OpenTelemetry metric snapshots and
POST /.well-known/fedify/bench/trigger for driving sendActivity()
to server-configured benchmark sink recipients. Benchmark mode also
defaults allowPrivateAddress to true when built-in loaders are used,
defaults signatureTimeWindow to false, reports queue depth through
the new fedify.queue.depth gauge, and adds explicit low-latency
buckets to the signature verification duration histogram.
[#744, #782, #787]
Replaced Fedify's internal federation routing with
@fedify/uri-template for stricter RFC 6570 URI Template expansion and
matching. The deprecated Router export from @fedify/fedify remains
available for compatibility. [#418, #758 by ChanHaeng Lee]
Significantly sped up TypeScript type-checking by simplifying the internal
path parameter types of the setObjectDispatcher(),
setCollectionDispatcher(), and setOrderedCollectionDispatcher() methods.
These methods previously expanded path into thousands of RFC 6570
template-literal variants, which dominated type-checking time; a full
codebase type check now completes in roughly 13 seconds instead of around
99 seconds. The public dispatcher method signatures and runtime path
validation are unchanged. This is a partial fix for #613 that targets
the dispatcher overload hot path; other contributors to check-all cost
may remain. [#613, #800 by ChanHaeng Lee]

@fedify/cli

Added the --skip-install option to fedify init, following the
corresponding @fedify/init update, which skips automatic dependency
installation after scaffolding. [[#720], [#776] by fru1tworld]
Switched Node.js and Bun projects generated by fedify init from Biome
plus ESLint to Oxfmt plus Oxlint. New projects now get .oxfmtrc.json,
.oxlintrc.json, Oxc editor recommendations, and package scripts for
format, format:check, and lint; the Oxlint config loads Fedify's
rules through @fedify/lint/oxlint. [[#703], [#818]]
Added the fedify bench command for benchmarking Fedify federation
workloads. It acts as a synthetic remote actor that drives
ActivityPub-specific load (signed inbox deliveries and WebFinger lookups)
against a cooperative benchmarkMode target and reports latency,
throughput, success rate, and errors, reading server-side metrics from the
target's stats endpoint. Benchmarks are described by a YAML or JSON
scenario suite validated against a published JSON Schema, with an expect
block per scenario that gates a run for CI. The command refuses public
non-benchmarkMode targets without an explicit unsafe override, supports
discovery-aware --dry-run planning, and ships with a local benchmark
fixture used by the scenario tests. [#744, [#783], [#784], [#791]]
Added actor, object, fanout, failure, and mixed scenario runners
to fedify bench. Read scenarios can now benchmark actor and object
document fetches, including authenticated GET requests; fanout scenarios
drive the benchmark trigger endpoint and wait for queue task drain; failure
scenari

✂ Note

PR body was truncated to here.

Configuration

📅 Schedule: (UTC)

Branch creation
- At any time (no schedule defined)
Automerge
- At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

If you want to rebase/retry this PR, check this box

This PR was generated by Mend Renovate. View the repository job log.

renovate Bot assigned skulidropek Jun 18, 2026

renovate Bot requested a review from skulidropek June 18, 2026 15:10

renovate Bot force-pushed the renovate/all branch from 8f1cb0f to bb51ab6 Compare June 18, 2026 22:06

renovate Bot changed the title ~~chore(deps): update all dependencies to v7~~ fix(deps): update all dependencies Jun 18, 2026

renovate Bot force-pushed the renovate/all branch 10 times, most recently from 7937dec to 76a7492 Compare June 25, 2026 00:56

renovate Bot force-pushed the renovate/all branch 6 times, most recently from bac3570 to 197dcfb Compare July 2, 2026 06:14

fix(deps): update all dependencies

e08373a

renovate Bot force-pushed the renovate/all branch from 197dcfb to e08373a Compare July 2, 2026 07:14

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

fix(deps): update all dependencies#429

fix(deps): update all dependencies#429
renovate[bot] wants to merge 1 commit into
mainfrom
renovate/all

renovate Bot commented Jun 18, 2026 •

edited

Loading

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

Uh oh!

Conversation

renovate Bot commented Jun 18, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Release Notes

Patch Changes

Patch Changes

Patch Changes

Configuration

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

renovate Bot commented Jun 18, 2026 •

edited

Loading