Skip to content

- Update all non-major dependencies with digest and pinDigest#48

Open
blumilk-renovate[bot] wants to merge 1 commit into
mainfrom
renovate/all-minor-patch-digest-pindigest
Open

- Update all non-major dependencies with digest and pinDigest#48
blumilk-renovate[bot] wants to merge 1 commit into
mainfrom
renovate/all-minor-patch-digest-pindigest

Conversation

@blumilk-renovate

@blumilk-renovate blumilk-renovate Bot commented Jul 1, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

This PR contains the following updates:

Package Change Age Confidence Type Update Pending
@tailwindcss/typography ^0.5.19 -> ^0.5.20 age confidence devDependencies patch
@tailwindcss/typography ^0.5.19 -> ^0.5.20 age confidence dependencies patch
@tailwindcss/vite (source) ^4.2.2 -> ^4.2.4 age confidence devDependencies patch
@typescript-eslint/eslint-plugin (source) ^8.58.1 -> ^8.58.2 age confidence devDependencies patch
actions/checkout v5.0.1 -> v5.1.0 age confidence action minor
actions/setup-node v6.3.0 -> v6.5.0 age confidence action minor
alpinejs (source) ^3.15.11 -> ^3.15.12 age confidence devDependencies patch
alpinejs (source) ^3.15.11 -> ^3.15.12 age confidence dependencies patch
andreiio/blade-remix-icon ^3.9 -> ^3.9.1 age confidence require patch
axios (source) ^1.13.6 -> ^1.18.1 age confidence dependencies minor
axllent/mailpit (source) v1.29.6 -> v1.29.7 age confidence patch
blade-ui-kit/blade-icons ^1.9 -> ^1.9.1 age confidence require patch
blumilksoftware/blt ^1.0 -> ^1.1.0 age confidence require-dev minor
composer 2.9.5 -> 2.9.8 age confidence stage patch
eslint (source) ^9.39.4 -> ^9.39.5 age confidence devDependencies patch
ghcr.io/php/pie 1.3.10-bin -> 1.3.13-bin age confidence stage patch
guzzlehttp/guzzle (source) ^7.10.0 -> ^7.10.6 age confidence require patch
hasnayeen/blade-eva-icons ^2.1 -> ^2.2.0 age confidence require minor
larastan/larastan ^3.9.4 -> ^3.9.6 age confidence require-dev patch
laravel/breeze ^2.4.1 -> ^2.4.2 age confidence require-dev patch
laravel/framework (source) ^12.56.0 -> ^12.64.0 age confidence require minor
laravel/sanctum ^4.3.1 -> ^4.3.3 age confidence require patch
lodash (source) ^4.17.23 -> ^4.18.1 age confidence dependencies patch
mallardduck/blade-lucide-icons ^1.26 -> ^1.26.29 age confidence require patch 1.26.30
nginx/nginx 1.29.8 -> 1.31.3 age confidence minor
node (source) 24.14.1 -> 24.18.0 age confidence minor
node 24.14.1-trixie-slim -> 24.18.0-trixie-slim age confidence stage minor
nunomaduro/collision ^8.9.3 -> ^8.9.5 age confidence require-dev patch
php 8.5.5 -> 8.5.8 age confidence patch
php 8.5.5-fpm-trixie -> 8.5.8-fpm-trixie age confidence final patch
phpunit/phpunit (source) ^11.5.55 -> ^11.5.56 age confidence require-dev patch
redis 8.6.2-trixie -> 8.6.4-trixie age confidence patch 8.6.5-trixie
registry.blumilk.pl/internal-public/secops-tools-bin v1.2.0 -> v1.3.0 age confidence stage minor
shivammathur/setup-php 2.37.0 -> 2.37.2 age confidence action patch
tailwindcss (source) ^4.2.2 -> ^4.2.4 age confidence devDependencies patch
vite (source) ^7.3.2 -> ^7.3.6 age confidence devDependencies patch
xdebug/xdebug 3.5.1 -> 3.5.3 age confidence patch

Release Notes

tailwindlabs/tailwindcss-typography (@​tailwindcss/typography)

v0.5.20

Compare Source

Fixed
  • Support installing with stable versions of Tailwind CSS v4 (#​424)
tailwindlabs/tailwindcss (@​tailwindcss/vite)

v4.2.4

Compare Source

Fixed
  • Ensure imports in @import and @plugin still resolve correctly when using Vite aliases in @tailwindcss/vite (#​19947)

v4.2.3

Compare Source

Fixed
  • Canonicalization: improve canonicalization for tracking-* utilities by preferring non-negative utilities (e.g. -tracking-tighter → tracking-wider) (#​19827)
  • Fix crash due to invalid characters in candidate (exceeding valid unicode code point range) (#​19829)
  • Ensure query params in imports are considered unique resources when using @tailwindcss/webpack (#​19723)
  • Canonicalization: collapse arbitrary values into shorthand utilities (e.g. px-[1.2rem] py-[1.2rem] → p-[1.2rem]) (#​19837)
  • Canonicalization: collapse border-{t,b}-* into border-y-*, border-{l,r}-* into border-x-*, and border-{t,r,b,l}-* into border-* (#​19842)
  • Canonicalization: collapse scroll-m{t,b}-* into scroll-my-*, scroll-m{l,r}-* into scroll-mx-*, and scroll-m{t,r,b,l}-* into scroll-m-* (#​19842)
  • Canonicalization: collapse scroll-p{t,b}-* into scroll-py-*, scroll-p{l,r}-* into scroll-px-*, and scroll-p{t,r,b,l}-* into scroll-p-* (#​19842)
  • Canonicalization: collapse overflow-{x,y}-* into overflow-* (#​19842)
  • Canonicalization: collapse overscroll-{x,y}-* into overscroll-* (#​19842)
  • Read from --placeholder-color instead of --background-color for placeholder-* utilities (#​19843)
  • Upgrade: ensure files are not emptied out when killing the upgrade process while it's running (#​19846)
  • Upgrade: use config.content when migrating from Tailwind CSS v3 to Tailwind CSS v4 (#​19846)
  • Upgrade: never migrate files that are ignored by git (#​19846)
  • Add .env and .env.* to default ignored content files (#​19846)
  • Canonicalization: migrate overflow-ellipsis into text-ellipsis (#​19849)
  • Canonicalization: migrate start-full → inset-s-full, start-auto → inset-s-auto, start-px → inset-s-px, and start-<number> → inset-s-<number> as well as negative versions (#​19849)
  • Canonicalization: migrate end-full → inset-e-full, end-auto → inset-e-auto, end-px → inset-e-px, and end-<number> → inset-e-<number> as well as negative versions (#​19849)
  • Canonicalization: move the - sign inside the arbitrary value -left-[9rem] → left-[-9rem] (#​19858)
  • Canonicalization: move the - sign outside the arbitrary value ml-[calc(-1*var(--width))] → -ml-(--width) (#​19858)
  • Improve performance when scanning JSONL / NDJSON files (#​19862)
  • Support NODE_PATH environment variable in standalone CLI (#​19617)
typescript-eslint/typescript-eslint (@​typescript-eslint/eslint-plugin)

v8.58.2

Compare Source

🩹 Fixes
  • eslint-plugin: [no-unnecessary-condition] use assignability checks in checkTypePredicates (#​12147)
  • remove tsbuildinfo cache file from published packages (#​12187)
❤️ Thank You

See GitHub Releases for more information.

You can read about our versioning strategy and releases on our website.

actions/checkout (actions/checkout)

v5.1.0

Compare Source

What's Changed

https://github.blog/changelog/2026-06-18-safer-pull_request_target-defaults-for-github-actions-checkout/ for more details about this breaking change

Full Changelog: actions/checkout@v5.0.1...v5.1.0

actions/setup-node (actions/setup-node)

v6.5.0

Compare Source

What's Changed

Full Changelog: actions/setup-node@v6.4.0...v6.5.0

v6.4.0

Compare Source

What's Changed

Dependency updates:

New Contributors

Full Changelog: actions/setup-node@v6...v6.4.0

alpinejs/alpine (alpinejs)

v3.15.12

Compare Source

What's Changed
New Contributors

Full Changelog: alpinejs/alpine@v3.15.11...v3.15.12

axios/axios (axios)

v1.18.1

Compare Source

v1.18.1 — June 21, 2026

This release focuses on Node HTTP adapter fixes, safer AxiosError serialisation, runtime/type correctness fixes, documentation updates, and dependency maintenance.

🐛 Bug Fixes

  • AxiosError Serialisation: Made AxiosError#cause non-enumerable to prevent circular JSON serialisation failures when errors include nested causes. (#​10913)
  • Node HTTP Adapter: Guarded socket.setKeepAlive for proxy agent streams, accepted path-only URLs when socketPath is configured, deferred environment proxy handling to Node, and explicitly passed maxBodyLength through to follow-redirects. (#​10917, #​10930, #​10942, #​10993)
  • Runtime and Type Correctness: Fixed several runtime crashes, type definition mismatches, and incorrect error handling paths. (#​10959, #​11021)
  • AxiosURLSearchParams: Switched the encoder callback to an arrow function so encoder.call(this) receives the AxiosURLSearchParams instance correctly. (#​11019)

🔧 Maintenance & Chores

🌟 New Contributors

We are thrilled to welcome our new contributors. Thank you for helping improve axios:

Full Changelog

v1.18.0

Compare Source

This release hardens redirect and URL handling, improves the validateStatus configuration semantics, and includes updates to documentation, dependencies, and release metadata.

v1.17.0

Compare Source

This release adds Node HTTP zstd decompression, hardens config and release workflows, and fixes authentication, header, proxy, and type-handling regressions.

v1.16.1

Compare Source

This release ships a defence-in-depth fix for prototype pollution in formDataToJSON, hardens proxy and CI workflows, restores Webpack 4 compatibility for the fetch adapter, and includes several small bug fixes and maintenance improvements.

v1.16.0

Compare Source

This release adds support for the QUERY HTTP method and a new ECONNREFUSED error constant, lands a substantial wave of HTTP, fetch, and XHR adapter bug fixes around redirects, aborts, headers, and timeouts, and welcomes 23 new contributors.

v1.15.2

Compare Source

This release delivers prototype-pollution hardening for the Node HTTP adapter, adds an opt-in allowedSocketPaths allowlist to mitigate SSRF via Unix domain sockets, fixes a keep-alive socket memory leak, and ships supply-chain hardening across CI and security docs.

v1.15.1

Compare Source

This release ships a coordinated set of security hardening fixes across headers, body/redirect limits, multipart handling, and XSRF/prototype-pollution vectors, alongside a broad sweep of bug fixes, test migrations, and threat-model documentation updates.

axllent/mailpit (axllent/mailpit)

v1.29.7

Compare Source

Chore
  • Bump vue-router from 4.6.4 to 5.0.4
  • Bump axios version to 1.15.0
  • Update Go dependencies
  • Update node dependencies
blumilksoftware/blt (blumilksoftware/blt)

v1.1.0

Compare Source

What's Changed

New Contributors

Full Changelog: blumilksoftware/blt@v1.0.0...v1.1.0

eslint/eslint (eslint)

v9.39.5

Compare Source

Bug Fixes

Documentation

Chores

  • 458205f chore: update @eslint/eslintrc and @eslint/js for v9.39.5 (#​21077) (Francesco Trotta)
  • 202117b chore: package.json update for @​eslint/js release (Jenkins)
  • d9eb6ed test: disable warning for vm.constants.USE_MAIN_CONTEXT_DEFAULT_LOADER (#​21074) (Francesco Trotta)
  • 7b431a7 chore: override re2 dependency for @metascraper/helpers (#​21068) (Milos Djermanovic)
  • daf7791 chore: pin fflate@​0.8.2 (#​20895) (Milos Djermanovic)
  • daee8ba ci: use pnpm in eslint-flat-config-utils type integration test (#​20829) (Milos Djermanovic)
  • 116d4be ci: unpin Node.js 25.x in CI (#​20619) (Copilot)
guzzle/guzzle (guzzlehttp/guzzle)

v7.10.6

Compare Source

Fixed
  • CurlMultiHandler now rejects the promise when CurlFactory::finish() throws, preserving sibling transfers
  • SetCookie now normalizes unparseable Expires values to null instead of false
  • Fix stream handler decoded gzip/deflate truncation by dropping invalid Content-Length

v7.10.5

Compare Source

Fixed
  • Defer cURL multi cancellation cleanup until after progress callbacks return
  • Classify additional stream handler connection failures as ConnectException

v7.10.4

Compare Source

Fixed
  • Fix IPv6 literal matching in no-proxy rules
  • Handle cURL multi completion messages without handles after cancelled transfers
  • Fix magic client request methods such as options() to uppercase inferred HTTP methods

v7.10.3

Compare Source

Fixed
  • Fail clearly when an HTTP response header line is invalid
  • Remove middleware by name when the name is also a callable string
  • Treat empty request protocol versions as HTTP/1.1

v7.10.2

Compare Source

Fixed
  • Normalize HTTP version request options before applying them to PSR-7 requests
  • Use string values for headers generated by request preparation and response decoding

v7.10.1

Compare Source

Fixed
  • Fail clearly when cURL options cannot be applied
  • Fail clearly when the certificate option is malformed
  • Fail clearly when JSON decode depth is invalid
  • Fail clearly when session cookie data is malformed
  • Fail clearly when the stream progress option is not callable
  • Prevent response creation failures from exposing stale cURL responses
Hasnayeen/blade-eva-icons (hasnayeen/blade-eva-icons)

v2.2.0

Compare Source

What's Changed

New Contributors

Full Changelog: Hasnayeen/blade-eva-icons@v2.1.0...v2.2.0

laravel/breeze (laravel/breeze)

v2.4.2

Compare Source

laravel/framework (laravel/framework)

v12.64.0

Compare Source

v12.63.0

Compare Source

v12.62.0

Compare Source

v12.61.1

Compare Source

v12.61.0

Compare Source

v12.60.2

Compare Source

v12.60.1

Compare Source

v12.60.0

Compare Source

v12.59.0

Compare Source

laravel/sanctum (laravel/sanctum)

v4.3.3

Compare Source

v4.3.2

Compare Source

  • [4.x] Update config/sanctum.php to follow skeleton laravel/pint format by @​crynobone in #​597
mallardduck/blade-lucide-icons (mallardduck/blade-lucide-icons)

v1.26.29

Compare Source

Added
  • Added 2 new icon(s): circle-euro-sign, server-plus
Changed
  • Modified 2 icon(s)
Updates
  • Update Lucide to v1.25.0

v1.26.28

Compare Source

Added
  • Added 1 new icon(s): paper-bag
Updates
  • Update Lucide to v1.24.0

v1.26.27

Compare Source

Added
  • Added 7 new icon(s)
Changed
  • Modified 2 icon(s)
Updates
  • Update Lucide to v1.23.0

v1.26.26

Compare Source

Added
  • Added 1 new icon(s): bone-fracture
Updates
  • Update Lucide to v1.22.0

v1.26.25

Compare Source

Added
  • Added 9 new icon(s)
Changed
  • Modified 4 icon(s)
Updates
  • Update Lucide to v1.21.0

v1.26.24

Compare Source

Added
  • Added 12 new icon(s)
Changed
  • Modified 1 icon(s)
Updates
  • Update Lucide to v1.20.0

v1.26.23

Compare Source

Added
  • Added 2 new icon(s): play-off, webcam-off
Updates
  • Update Lucide to v1.19.0

v1.26.22

Compare Source

Added
  • Added 2 new icon(s): globe-check, parasol
Changed
  • Modified 1 icon(s)
Updates
  • Update Lucide to v1.18.0

v1.26.21

Compare Source

Added
  • Added 8 new icon(s)
Changed
  • Modified 5 icon(s)
Updates
  • Update Lucide to v1.17.0

[v1.26.20](https://redirect.github.com/mallardduck/blade-lucide-icons/blob/H

Configuration

📅 Schedule: Branch creation - On day 1 of the month, every 3 months ( * * 1 */3 * ) in timezone Europe/Warsaw, Automerge - At any time (no schedule defined).

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

  • If you want to rebase/retry this PR, check this box

This PR has been generated by Renovate Bot.

@blumilk-renovate
blumilk-renovate Bot requested a review from a team as a code owner July 1, 2026 10:54
@blumilk-renovate blumilk-renovate Bot added dependencies renovate bot dependencies update docker github-actions javascript php renovate renovate bot update labels Jul 1, 2026
@blumilk-renovate
blumilk-renovate Bot requested a review from Blusia July 1, 2026 10:54
@blumilk-renovate

blumilk-renovate Bot commented Jul 1, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor Author

⚠️ Artifact update problem

Renovate failed to update artifacts related to this branch. You probably do not want to merge this PR as-is.

♻ Renovate will retry this branch, including artifacts, only when one of the following happens:

  • any of the package files in this branch needs updating, or
  • the branch becomes conflicted, or
  • you click the rebase/retry checkbox if found above, or
  • you rename this PR's title to start with "rebase!" to trigger it manually

The artifact failure details are included below:

File name: composer.lock
Command failed: composer update andreiio/blade-remix-icon:3.9.1 blade-ui-kit/blade-icons:1.9.1 blumilksoftware/blt:1.1.0 guzzlehttp/guzzle:7.10.6 hasnayeen/blade-eva-icons:2.2.0 larastan/larastan:3.9.6 laravel/breeze:2.4.2 laravel/framework:12.64.0 laravel/sanctum:4.3.3 mallardduck/blade-lucide-icons:1.26.29 nunomaduro/collision:8.9.5 phpunit/phpunit:11.5.56 --with-dependencies --ignore-platform-req='ext-*' --ignore-platform-req='lib-*' --no-ansi --no-interaction --no-scripts --no-autoloader --no-plugins --minimal-changes
Loading composer repositories with package information
Updating dependencies
Your requirements could not be resolved to an installable set of packages.

  Problem 1
    - Root composer.json requires guzzlehttp/guzzle ^7.10.6, found guzzlehttp/guzzle[7.10.6, ..., 7.15.1] but these were not loaded, because they are affected by security advisories ("PKSA-fy2t-3c5f-827y", "PKSA-qxvb-2bpp-dnk6", "PKSA-bbs6-q5q9-f3t4", "PKSA-bcdd-5xc7-gwfb", "PKSA-pwsk-hy21-4gby", "PKSA-93qv-9n9h-6k6p", "PKSA-k22t-f949-t9g6"). Go to https://packagist.org/security-advisories/ to find advisory details. To ignore the advisories, add their IDs to the "policy.advisories.ignore-id" config or add the package to "policy.advisories.ignore". To turn the feature off entirely, you can set "policy.advisories.block" to false.
  Problem 2
    - Root composer.json requires laravel/framework ^12.64.0 -> satisfiable by laravel/framework[v12.64.0].
    - laravel/framework v12.64.0 requires guzzlehttp/guzzle ^7.8.2 -> found guzzlehttp/guzzle[7.8.2, ..., 7.15.1] but these were not loaded, because they are affected by security advisories ("PKSA-fy2t-3c5f-827y", "PKSA-qxvb-2bpp-dnk6", "PKSA-bbs6-q5q9-f3t4", "PKSA-bcdd-5xc7-gwfb", "PKSA-pwsk-hy21-4gby", "PKSA-93qv-9n9h-6k6p", "PKSA-k22t-f949-t9g6"). Go to https://packagist.org/security-advisories/ to find advisory details. To ignore the advisories, add their IDs to the "policy.advisories.ignore-id" config or add the package to "policy.advisories.ignore". To turn the feature off entirely, you can set "policy.advisories.block" to false.
  Problem 3
    - Root composer.json requires larastan/larastan ^3.9.6 -> satisfiable by larastan/larastan[v3.9.6].
    - illuminate/http[v11.34.0, ..., v11.51.0, v12.0.0, ..., v12.64.0, v13.0.0, ..., v13.21.1] require guzzlehttp/guzzle ^7.8.2 -> found guzzlehttp/guzzle[7.8.2, ..., 7.15.1] but these were not loaded, because they are affected by security advisories ("PKSA-fy2t-3c5f-827y", "PKSA-qxvb-2bpp-dnk6", "PKSA-bbs6-q5q9-f3t4", "PKSA-bcdd-5xc7-gwfb", "PKSA-pwsk-hy21-4gby", "PKSA-93qv-9n9h-6k6p", "PKSA-k22t-f949-t9g6"). Go to https://packagist.org/security-advisories/ to find advisory details. To ignore the advisories, add their IDs to the "policy.advisories.ignore-id" config or add the package to "policy.advisories.ignore". To turn the feature off entirely, you can set "policy.advisories.block" to false.
    - laravel/framework v12.64.0 require guzzlehttp/guzzle ^7.8.2 -> found guzzlehttp/guzzle[7.8.2, ..., 7.15.1] but these were not loaded, because they are affected by security advisories ("PKSA-fy2t-3c5f-827y", "PKSA-qxvb-2bpp-dnk6", "PKSA-bbs6-q5q9-f3t4", "PKSA-bcdd-5xc7-gwfb", "PKSA-pwsk-hy21-4gby", "PKSA-93qv-9n9h-6k6p", "PKSA-k22t-f949-t9g6"). Go to https://packagist.org/security-advisories/ to find advisory details. To ignore the advisories, add their IDs to the "policy.advisories.ignore-id" config or add the package to "policy.advisories.ignore". To turn the feature off entirely, you can set "policy.advisories.block" to false.
    - larastan/larastan v3.9.6 requires illuminate/http ^11.44.2 || ^12.4.1 || ^13 -> satisfiable by laravel/framework[v12.64.0], illuminate/http[v11.44.2, ..., v11.51.0, v12.4.1, ..., v12.64.0, v13.0.0, ..., v13.21.1].

Use the option --with-all-dependencies (-W) to allow upgrades, downgrades and removals for packages currently locked to specific versions.
File name: package-lock.json
npm warn Unknown env config "store". This will error in a future major version of npm. See `npm help npmrc` for supported config options.
npm error code EALLOWREMOTE
npm error Fetching packages of type "remote" have been disabled
npm error Refusing to fetch "https://registry.npmjs.org/@tailwindcss/oxide-wasm32-wasi/-/oxide-wasm32-wasi-4.3.3.tgz"
npm error A complete log of this run can be found in: /tmp/renovate/cache/others/npm/_logs/2026-07-22T10_56_46_727Z-debug-0.log

@blumilk-renovate
blumilk-renovate Bot force-pushed the renovate/all-minor-patch-digest-pindigest branch 2 times, most recently from 6a68362 to 4242f6f Compare July 5, 2026 10:55
@blumilk-renovate
blumilk-renovate Bot force-pushed the renovate/all-minor-patch-digest-pindigest branch 5 times, most recently from b23761a to 7300f90 Compare July 17, 2026 10:11
@blumilk-renovate
blumilk-renovate Bot force-pushed the renovate/all-minor-patch-digest-pindigest branch 3 times, most recently from b9046ae to f500634 Compare July 21, 2026 10:56
@blumilk-renovate
blumilk-renovate Bot force-pushed the renovate/all-minor-patch-digest-pindigest branch from f500634 to 7a464e7 Compare July 22, 2026 10:56
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@Blusia Blusia Awaiting requested review from Blusia

At least 1 approving review is required to merge this pull request.

Assignees

No one assigned

Labels

dependencies renovate bot dependencies update docker github-actions javascript php renovate renovate bot update

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

0 participants