- Update all non-major dependencies with digest and pinDigest

[blumilk-renovate]

This PR contains the following updates:

Package	Change	Age	Confidence	Type	Update	Pending
@alpinejs/focus (source)	^3.15.11 -> ^3.15.12			dependencies	patch
@alpinejs/persist (source)	^3.15.11 -> ^3.15.12			dependencies	patch
@tailwindcss/postcss (source)	^4.1.18 -> ^4.3.3			dependencies	minor
@tailwindcss/typography	^0.5.19 -> ^0.5.20			dependencies	patch
@typescript-eslint/eslint-plugin (source)	^8.59.0 -> ^8.59.4			devDependencies	patch
@typescript-eslint/parser (source)	^8.59.0 -> ^8.59.4			devDependencies	patch
actions/cache	v5.0.5 -> v5.1.0			action	minor
actions/checkout	v6.0.2 -> v6.0.3			action	patch
actions/setup-node	v6.4.0 -> v6.5.0			action	minor
alpine	3.22.4 -> 3.22.5			stage	patch
alpinejs (source)	^3.15.11 -> ^3.15.12			dependencies	patch
axllent/mailpit (source)	v1.27.11 -> v1.30.5				minor
composer	2.9.7 -> 2.9.8			stage	patch
composer/composer	2.9.7-bin -> 2.9.8-bin			stage	patch
docker/build-push-action	v7.1.0 -> v7.3.0			action	minor
docker/login-action	v4.1.0 -> v4.4.0			action	minor	v4.5.0
docker/metadata-action	v6.0.0 -> v6.2.0			action	minor
docker/setup-buildx-action	v4.0.0 -> v4.2.0			action	minor
filament/filament (source)	^3.3.50 -> ^3.3.54			require	patch
filament/spatie-laravel-translatable-plugin (source)	^3.3.50 -> ^3.3.54			require	patch
guzzlehttp/guzzle (source)	^7.10.0 -> ^7.10.6			require	patch
larastan/larastan	^3.9.6 -> ^3.10.0			require-dev	patch
laravel/framework (source)	^12.58.0 -> ^12.64.0			require	minor
laravel/sanctum	^4.3.1 -> ^4.3.3			require	patch
laravel/tinker	^2.10.2 -> ^2.11.1			require	patch
nesbot/carbon (source)	^3.11.4 -> ^3.13.1			require	patch
node (source)	22.20.0 -> 22.23.1				minor
node	22.22.2-bullseye-slim -> 22.22.3-bullseye-slim			stage	patch
nunomaduro/collision	^8.8.3 -> ^8.9.5			require-dev	patch
php	8.4.20 -> 8.4.23				patch
php	8.4.20-fpm-bookworm -> 8.4.23-fpm-bookworm			final	patch
phpunit/phpunit (source)	^12.5.23 -> ^12.5.31			require-dev	patch
postcss (source)	^8.5.12 -> ^8.5.21			devDependencies	patch	8.5.22
sentry/sentry-laravel (source)	^4.25.0 -> ^4.25.1			require	patch
shivammathur/setup-php	2.37.0 -> 2.37.2			action	patch
tailwindcss (source)	^4.1.18 -> ^4.3.3			dependencies	minor
vite (source)	^6.3.7 -> ^6.4.3			devDependencies	patch
xdebug/xdebug	3.4.7 -> 3.5.3				minor

---

Release Notes

tailwindlabs/tailwindcss (@​tailwindcss/postcss)

v4.3.3

Compare Source

Fixed

• Support --watch --poll[=ms] in @tailwindcss/cli when filesystem events are unreliable or unavailable (#​20297)
• Canonicalization: match arbitrary hex colors against theme colors case-insensitively (e.g. bg-[#fff] and bg-[#FFF] → bg-white) (#​20298)
• Prevent Preflight from overriding Firefox's native iframe:focus-visible outline styles (#​20292)
• Ensure theme('colors.foo') in JS plugins resolves correctly when both --color-foo and --color-foo-bar exist (#​20299)
• Ensure fractional opacity modifiers work with named shadow sizes like shadow-sm/12.5, text-shadow-sm/12.5, drop-shadow-sm/12.5, and inset-shadow-sm/12.5 (#​20302)
• Parse selectors like [data-foo]div as two selectors instead of one (#​20303)
• Ensure @tailwindcss/postcss rebuilds when a preprocessor like Sass changes the input CSS without changing the input file on disk (#​20310)
• Ensure CSS nesting is handled even when Lightning CSS isn't run, such as in @tailwindcss/browser and Tailwind Play (#​20124)
• Prevent achromatic theme colors from shifting hue when mixed in polar color spaces like oklch (#​20314)
• Ensure --spacing(0) is optimized to 0px instead of 0 so it remains a <length> when used in calc(…) (#​20319)
• Load @parcel/watcher only when needed in @tailwindcss/cli --watch mode, so one-off builds and --watch --poll work when @parcel/watcher can't be loaded (#​20325)
• Use explicit platform fonts instead of system-ui and ui-sans-serif so CJK text respects the page's lang attribute on Windows (#​20318)
• Prevent @tailwindcss/upgrade from rewriting ignored files when run from a subdirectory (#​20329)
• Ensure earlier @source rules pointing to nested files are scanned when later @source rules point to files in parent folders (#​20335)
• Prevent @tailwindcss/vite from triggering full page reloads when scanned files are processed by Vite but haven't been loaded as modules yet (#​20336)

v4.3.2

Compare Source

Fixed

• Support bare spacing values for auto-rows-* and auto-cols-* utilities (e.g. auto-rows-12 and auto-cols-16) (#​20229)
• Prevent @tailwindcss/cli in --watch mode from crashing on Windows when @source points to a directory that doesn't exist (#​20242)
• Prevent @tailwindcss/vite from crashing in Deno v2.8.x when context.parentURL is not a valid URL (#​20245)
• Ensure @tailwindcss/cli in --watch mode rebuilds when the input CSS file changes in an ignored directory (#​20246)
• Allow @variant rules used in addBase(…) to use custom variants defined later (#​20247)
• Prevent @tailwindcss/vite from crashing during HMR when scanned files or directories are deleted (#​20259)
• Generate font-size instead of color declarations for text-[--spacing(…)] (#​20260)
• Prevent @source patterns from scanning unrelated sibling files and folders (#​20263)
• Extract class candidates adjacent to Template Toolkit delimiters like %]…[% in .tt, .tt2, and .tx files (#​20269)
• Extract class candidates from conditional Maud syntax like p.text-black[condition] (#​20269)
• Prevent @position-try rules from triggering unknown at-rule warnings when optimizing CSS (#​20277)
• Support class suggestions for named opacity modifiers from --opacity theme values (#​20287)
• Prevent type errors in @tailwindcss/postcss when used with newer PostCSS patch releases (#​20289)

v4.3.1

Compare Source

Added

• Add --silent option to suppress output in @tailwindcss/cli (#​20100)

Fixed

• Remove deprecation warnings by using Module#registerHooks instead of Module#register on Node 26+ (#​20028)
• Canonicalization: don't crash when plugin utilities throw for unsupported values (#​20052)
• Allow @apply to be used with CSS mixins (#​19427)
• Ensure not-* correctly negates @container queries, including style(…) queries (#​20059)
• Ensure drop-shadow-* color utilities work with custom shadow values containing calc(…) (#​20080)
• Fix 'Sourcemap is likely to be incorrect' warnings when using @tailwindcss/vite (#​20103)
• Ensure @tailwindcss/webpack can be installed in Rspack projects without requiring webpack as a peer dependency (#​20027)
• Canonicalization: don't suggest invalid calc(…) expressions (e.g. px-[calc(1rem+0px)] → px-[calc(1rem+0)]) (#​20127)
• Canonicalization: avoid suggesting large spacing-scale values for arbitrary lengths (e.g. left-[99999px] → left-[99999px], not left-24999.75) (#​20130)
• Ensure @tailwindcss/cli in --watch mode recovers when a tracked dependency is deleted and restored (#​20137)
• Ensure standalone @tailwindcss/cli binaries are ignored when scanning for class candidates (#​20139)
• Ensure class candidates are extracted from Twig addClass(…) and removeClass(…) calls (#​20198)
• Don't crash in the Ruby or Vue preprocessors when scanning files containing invalid UTF-8 bytes (#​19588)
• Allow @variant to be used inside addBase (#​19480)
• Ensure @source globs with symlinks are preserved (#​20203)
• Ensure later @source rules can re-include files excluded by earlier @source not rules (#​20203)
• Upgrade: don't migrate empty class rules to invalid @utility rules (#​20205)
• Ensure transitions between inset-shadow-none and other inset shadows work correctly (#​20208)
• Ensure explicitly referenced @source directories are scanned even when ignored by git (#​20214)
• Ensure @source globs ending in **/* preserve dynamic path segments to avoid scanning too many files (#​20217)
• Canonicalization: don't fold calc(…) divisions when the result would require high precision (e.g. w-[calc(100%/3.5)] → w-[calc(100%/3.5)], not w-[28.571428571428573%]) (#​20221)
• Serve ESM type declarations to ESM importers of @tailwindcss/postcss (#​20228)

Changed

• Generate 0 instead of calc(var(--spacing) * 0) for spacing utilities like m-0 and left-0 (#​20196)
• Generate var(--spacing) instead of calc(var(--spacing) * 1) for spacing utilities like m-1 and left-1 (#​20196)

v4.3.0

Compare Source

Added

• Add @container-size utility (#​18901)
• Add scrollbar-{auto,thin,none} utilities for scrollbar-width, and scrollbar-thumb-* / scrollbar-track-* color utilities for scrollbar-color (#​19981, #​20019)
• Add scrollbar-gutter-* utilities (#​20018)
• Add zoom-* utilities (#​20020)
• Add tab-* utilities (#​20022)
• Allow using @variant with stacked variants (e.g. @variant hover:focus { … }) (#​19996)
• Allow using @variant with compound variants (e.g. @variant hover, focus { … }) (#​19996)
• Support --default(…) in --value(…) and --modifier(…) for functional @utility definitions (#​19989)

Fixed

• Ensure @plugin resolves package JavaScript entries instead of browser CSS entries when using @tailwindcss/vite (#​19949)
• Fix relative @import and @plugin paths resolving from the wrong directory when using @tailwindcss/vite (#​19965)
• Ensure CSS files containing @variant are processed by @tailwindcss/vite (#​19966)
• Resolve imports relative to base when result.opts.from is not provided when using @tailwindcss/postcss (#​19980)
• Canonicalization: preserve significant _ whitespace in arbitrary values (#​19986)
• Canonicalization: add parentheses when removing whitespace from arbitrary values would hurt readability (e.g. w-[calc(100%---spacing(60))] → w-[calc(100%-(--spacing(60)))]) (#​19986)
• Canonicalization: preserve the original unit in arbitrary values instead of normalizing to base units (e.g. -mt-[20in] → mt-[-20in], not mt-[-1920px]) (#​19988)
• Canonicalization: migrate arbitrary :has() variants from [&:has(…)] to has-[…] (#​19991)
• Upgrade: don’t migrate inline style attributes (e.g. style="flex-grow: 1" → style="flex-grow: 1", not style="grow: 1") (#​19918)
• Allow multiple @utility definitions with the same name but different value types (#​19777)
• Export missing PluginWithConfig type from tailwindcss/plugin to fix errors when inferring plugin config types (#​19707)
• Ensure start and end legacy utilities without values do not generate CSS (#​20003)
• Ensure --value(…) is required in functional @utility definitions (#​20005)
• Canonicalization: preserve required whitespace around operators in negated arbitrary values (e.g. -left-[(var(--a)+var(--b))]) (#​20011)

tailwindlabs/tailwindcss-typography (@​tailwindcss/typography)

v0.5.20

Compare Source

Fixed

• Support installing with stable versions of Tailwind CSS v4 (#​424)

typescript-eslint/typescript-eslint (@​typescript-eslint/eslint-plugin)

v8.59.4

Compare Source

🩹 Fixes

• eslint-plugin: [no-floating-promises] stack overflow when using recursive types (#​12294)

❤️ Thank You

• Evyatar Daud @​StyleShit

See GitHub Releases for more information.

You can read about our versioning strategy and releases on our website.

v8.59.3

Compare Source

This was a version bump only for eslint-plugin to align it with other projects, there were no code changes.

See GitHub Releases for more information.

You can read about our versioning strategy and releases on our website.

typescript-eslint/typescript-eslint (@​typescript-eslint/parser)

v8.59.4

Compare Source

This was a version bump only for parser to align it with other projects, there were no code changes.

See GitHub Releases for more information.

You can read about our versioning strategy and releases on our website.

v8.59.3

Compare Source

This was a version bump only for parser to align it with other projects, there were no code changes.

See GitHub Releases for more information.

You can read about our versioning strategy and releases on our website.

actions/cache (actions/cache)

v5.1.0

Compare Source

What's Changed

• Bump @​actions/cache to v5.1.0 - handle read-only cache access by @​jasongin in #​1775

Full Changelog: actions/cache@v5...v5.1.0

actions/checkout (actions/checkout)

v6.0.3

Compare Source

• Fix checkout init for SHA-256 repositories by @​yaananth in #​2439
• fix: expand merge commit SHA regex and add SHA-256 test cases by @​yaananth in #​2414

actions/setup-node (actions/setup-node)

v6.5.0

Compare Source

What's Changed

• Update @​actions/cache to 5.1.0 and add security overrides for undici and fast-xml-parser by @​HarithaVattikuti in #​1579

Full Changelog: actions/setup-node@v6.4.0...v6.5.0

axllent/mailpit (axllent/mailpit)

v1.30.5

Compare Source

Security

• Prevent SMTP DATA line exceeding MaxSize (GHSA-r553-m4fv-5v97)

Chore

• Update Go dependencies
• Update node dependencies

v1.30.4

Compare Source

Security

• Reject oversized image dimensions in thumbnail handler before full decode (GHSA-75mr-qw9x-3r39)
• Enforce command line length limits in SMTP and POP3 handlers (GHSA-w878-pj84-3j5v)

Chore

• Update Github Actions
• Refactor browser storage settings for consistency (#​715)
• Update Go dependencies
• Update node dependencies
• Update caniemail test database
• Update Github Action requirements

Fix

• Exclude supported clients in HTML check results (#​716)

v1.30.3

Compare Source

Feature

• Add link check rate limiting and caching mechanism

Chore

• Update Go dependencies
• Update node dependencies

Fix

• Correctly parse after/before datetimes with timestamp in search query (#​704)
• Update Swagger response definitions for MessageHeadersResponse (#​703)
• Refactor Web UI configuration definitions in Swagger documentation
• Handle MaxBytesError in SendMessageHandler and return JSON error response

v1.30.2

Compare Source

Security

• Fix incomplete SSRF protection in IsInternalIP() detection for IPv6 transition mechanisms (GHSA-w4mc-hhc6-xp28)

Feature

• Add wait support to readyz (#​697)

Chore

• Compress websocket messages once per broadcast to improve performance (#​695)
• Toggle websocket compression using HTTP compression setting
• Update Github Actions dependencies
• Update Go dependencies
• Update node dependencies

Fix

• Adjust header setting order in error response functions (#​699)

Test

• Add readyz tests

v1.30.1

Compare Source

Security

• Extend request body size cap to all JSON API endpoints (GHSA-28pq-6qxg-wg5r)
• Pin Github Actions workflow versions using full commit SHA
• Do not use npm cache to prevent cache poisoning
• Disable GitHub Actions credential persistence for checkout steps

Chore

• Enhance schema application logging (#​688)
• Change log level to Info for database vacuuming message (#​688)
• Update Github Action workflows
• Update Go dependencies
• Update node dependencies
• Update caniemail test database

v1.30.0

Compare Source

Security

• Set a default 50MB p/m limit to prevent DoS via unlimited SMTP DATA and /api/v1/send body sizes (GHSA-fpxj-m5q8-fphw)
• Include CGNAT (Carrier-Grade NAT) in internal IP checks (GHSA-j3fj-qppj-fmmc)
• Block internal IP access by default in HTML check (GHSA-j3fj-qppj-fmmc)
• Fix for path traversal & arbitrary file write in mailpit dump --http via attacker-controlled message IDs (GHSA-qx5x-85p8-vg4j)
• Fix concurrent map read & write in proxy CSS rewriter (GHSA-w4vj-r5pg-3722)

Feature

• New loading indicator, reduce flash during message transitions (#​682)

Chore

• Remove gorilla/mux dependency and replace with stdlib routing
• Remove logrus dependency and implement slog-based logging
• Remove go-telnet dependency and implement TCP/Unix socket handling for SMTP
• Replace lithammer/shortuuid with custom shortuuid implementation and update tests
• Improve iframe height adjustment with optional chaining
• Bump axios version to v1.16.0
• Refactor Prometheus metrics implementation and remove unused dependencies
• Refactor MarkRead and MarkUnread functions to only broadcast changes of modified messages
• Optimize tag retrieval by batching message IDs in List and Search functions
• Enhance SetMessageTags function to improve tag handling and batch deletions
• Optimize MarkRead and MarkUnread functions to reduce database calls and improve performance
• Refactor pruneMessages function to eliminate duplicate ID checks using a map
• Refactor addMessageTag function to remove mutex and ensure safe concurrent inserts
• Refactor Hub to use atomic clientCount for safe concurrent client tracking
• Ensure websocket connection is closed on client unregistration
• Simplify writePump by using WriteMessage and remove unnecessary newline handling
• Add message dump max-message-size flag and refactor message handling
• Add message ingest max-message-size flag and refactor message handling
• Update Go dependencies
• Update node dependencies
• Update caniemail test database

Fix

• Validate SMTP XCLIENT args before processing

Build

• Update CI actions to use npm ci
• Tag Docker edge build with next patch versions

v1.29.7

Compare Source

Chore

• Bump vue-router from 4.6.4 to 5.0.4
• Bump axios version to 1.15.0
• Update Go dependencies
• Update node dependencies

v1.29.6

Compare Source

Chore

• Bump docker/login-action from 3 to 4 (#​670)
• Bump actions/stale from 10.1.1 to 10.2.0 (#​669)
• Bump docker/setup-buildx-action from 3 to 4 (#​668)
• Bump docker/setup-qemu-action from 3 to 4 (#​666)
• Bump docker/build-push-action from 6 to 7 (#​665)
• Update Go dependencies
• Update node dependencies

Fix

• Version check logic in version command and self updater (#​673)

v1.29.5

Compare Source

Security

• Add sandbox attribute to message iframe for extra later of security (already protected via CSP headers)

Feature

• Add option to disable auto-VACUUMing of the SQLite database (#​661)

Chore

• Update Go dependencies
• Update node dependencies

v1.29.4

Compare Source

Feature

• Add filter functionality to message headers tab

Chore

• Update Go dependencies
• Update node dependencies

Fix

• Refactor webhook delay & rate limit logic to ignore endpoint response times & prevent hardcoded 1000 message limit when set to 0 (#​656)

v1.29.3

Compare Source

Security

• Enhance CORS origin handling to respect host:port distinctions
• Limit proxy requests to 50MB to prevent OOM attacks
• Enhance HTML sanitization in message view
• Enhance HTML sanitization in screenshot generation
• Escape ContentID in HTML replacement to prevent regex injection

Chore

• Use last release + git hash in Docker edge versions
• Bump minimatch from 10.2.2 to 10.2.4
• Refactor code with go fix
• Switch to math/rand/v2
• Refactor API send authentication logic
• Refactor events websocket middleware
• Set timeout for HTTP client in webhook Send function
• Use local hostname for EHLO/HELO in SMTP communication
• Simplify HTML decoding function in screenshot generation using DOMParser
• Set margin & padding to HTML screenshot to prevent transparent top/left border
• Replace localStorage retrieval with a dedicated function for default release addresses
• Limit subject length to 100 characters in browser notifications
• Improve transaction handling in pruneMessages and fix loop continuation in InitDB
• Update Content-Disposition header to use inline display and escape filename
• Refactor timezone handling in searchQueryBuilder
• Update Go dependencies
• Update node dependencies

Fix

• Update SQL query to use tenant when using is:tagged filter

v1.29.2

Compare Source

Security

• Prevent Server-Side Request Forgery (SSRF) via Link Check API (GHSA-mpf7-p9x7-96r3)

Chore

• Upgrade eslint JavaScript linting
• Update Go dependencies
• Update node dependencies
• Update caniemail test database

Fix

• Update install instructions when setting INSTALL_PATH
• Include 8BITMIME in SMTPD EHLO response (#​648)

v1.29.1

Compare Source

Chore

• Add CORS error logging and update error messages for failed CORS requests
• Bump axios from 1.13.4 to 1.13.5
• Update Go dependencies
• Update node dependencies

Fix

• Enable "Mark all read" button (Inbox) when new message is received

v1.29.0

Compare Source

Feature

• Include message attachment checksums (MD5, SHA1 & SHA254) in API message summary
• Option to display/hide attachment information in message view in web UI including checksums, content type & disposition

Chore

• Add support for multi-origin CORS settings and apply to events websocket (#​630)
• Add support for webhook delay (#​627)
• Update Go dependencies
• Update node dependencies

Test

• Add CORS tests
• Add message summary attachment checksum tests

v1.28.4

Compare Source

Chore

• Increase allowed SMTP email address length to 1024 chars & return clearer SMTP responses for failures (#​620)
• Update Go dependencies
• Update node dependencies

Fix

• Ensure SMTP HELO/EHLO command is issued before MAIL FROM as per RFC 5321 (#​621)
• Prevent nested MAIL command during an active SMTP transaction (#​623)
• Avoid error on image type assertion in thumbnail generation

v1.28.3

Compare Source

Security

• Ensure SMTP TO & FROM addresses are RFC 5322 compliant and prevent header injection (GHSA-54wq-72mp-cq7c)
• Prevent Server-Side Request Forgery (SSRF) via HTML Check API (GHSA-6jxm-fv7w-rw5j)

Chore

• Fix formatting and update reporting instructions in SECURITY.md (#​614)
• Allow @ character in message tags & set max length to 100 characters per tag
• Update Go dependencies
• Update node dependencies

Fix

• Correctly render default addresses in release modal after settings change (#​594)
• Correctly detect macOS group in install.sh (#​619)
• Auto-tagging using SMTP username using plain auth (#​617)
• Validate maximum lengths of email addresses - RFC5321 (section 4.5.3.1)

Test

• Update tag tests with length limits and @ character
• Add SMTP tests for address compliancy (RFC 5322) and header injection
• Add maximum email length validation tests - RFC5321 (section 4.5.3.1)

v1.28.2

Compare Source

Security

• Prevent Cross-Site WebSocket Hijacking (CSWSH) allowing unauthenticated access to message data CVE-2026-22689

Feature

• Allow default mail addresses to be set when releasing message (#​594)

Chore

• Remove webkit warnings about missing template / render functions
• Avoid empty URL query parameter when returning to inbox from message view

v1.28.1

Compare Source

Security

• Restrict screenshot proxy to only support asset links contained in messages CVE-2026-21859

Chore

• Bump actions/checkout from 5 to 6 (#​610)
• Bump actions/cache from 4 to 5 (#​607)
• Bump actions/stale from 10.0.0 to 10.1.1 (#​604)
• Bump actions/setup-node from 5 to 6 (#​598)
• Bump esbuild from 0.25.12 to 0.27.2 (#​611)
• Update Go dependencies
• Update node dependencies

Test

• Add inline message tests
• Increase swagger test timeout

v1.28.0

Compare Source

Feature

• Optionally propagate SMTP errors (#​588)

Chore

• Update Go dependencies
• Update node dependencies
• Update caniemail test database

docker/build-push-action (docker/build-push-action)

v7.3.0

Compare Source

• Preserve names in esbuild bundle by @​crazy-max in #​1567
• Bump @​docker/actions-toolkit from 0.90.0 to 0.92.0 in #​1545 #​1572
• Bump @​sigstore/core from 3.1.0 to 3.2.1 in #​1568
• Bump js-yaml from 4.1.1 to 4.3.0 in #​1566
• Bump tmp from 0.2.5 to 0.2.7 in #​1547
• Bump undici from 6.24.1 to 6.27.0 in #​1564
• Bump vite from 7.3.2 to 7.3.6 in #​1563

Full Changelog: docker/build-push-action@v7.2.0...v7.3.0

v7.2.0

Compare Source

• Bump @​actions/core from 3.0.0 to 3.0.1 in #​1525
• Bump @​docker/actions-toolkit from 0.87.0 to 0.90.0 in #​1517
• Bump brace-expansion from 2.0.2 to 5.0.6 in [#​1534](https://redirect.github.com/do

---

Configuration

📅 Schedule: Branch creation - On day 1 of the month, every 3 months ( * * 1 */3 * ) in timezone Europe/Warsaw, Automerge - At any time (no schedule defined).

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

---

• If you want to rebase/retry this PR, check this box

---

This PR has been generated by Renovate Bot.

[blumilk-renovate]

⚠️ Artifact update problem

Renovate failed to update artifacts related to this branch. You probably do not want to merge this PR as-is.

♻ Renovate will retry this branch, including artifacts, only when one of the following happens:

• any of the package files in this branch needs updating, or
• the branch becomes conflicted, or
• you click the rebase/retry checkbox if found above, or
• you rename this PR's title to start with "rebase!" to trigger it manually

The artifact failure details are included below:

File name: composer.lock

Command failed: composer update filament/filament:3.3.54 filament/spatie-laravel-translatable-plugin:3.3.54 guzzlehttp/guzzle:7.10.6 larastan/larastan:3.10.0 laravel/framework:12.64.0 laravel/sanctum:4.3.3 laravel/tinker:2.11.1 nesbot/carbon:3.13.1 nunomaduro/collision:8.9.5 phpunit/phpunit:12.5.31 sentry/sentry-laravel:4.25.1 --with-dependencies --ignore-platform-req='ext-*' --ignore-platform-req='lib-*' --no-ansi --no-interaction --no-scripts --no-autoloader --no-plugins --minimal-changes
Loading composer repositories with package information
Dependency mockery/mockery is also a root requirement. Package has not been listed as an update argument, so keeping locked at old version. Use --with-all-dependencies (-W) to include root dependencies.
Updating dependencies
Your requirements could not be resolved to an installable set of packages.

  Problem 1
    - Root composer.json requires guzzlehttp/guzzle ^7.10.6, found guzzlehttp/guzzle[7.10.6, ..., 7.15.1] but these were not loaded, because they are affected by security advisories ("PKSA-fy2t-3c5f-827y", "PKSA-qxvb-2bpp-dnk6", "PKSA-bbs6-q5q9-f3t4", "PKSA-bcdd-5xc7-gwfb", "PKSA-pwsk-hy21-4gby", "PKSA-93qv-9n9h-6k6p", "PKSA-k22t-f949-t9g6"). Go to https://packagist.org/security-advisories/ to find advisory details. To ignore the advisories, add their IDs to the "policy.advisories.ignore-id" config or add the package to "policy.advisories.ignore". To turn the feature off entirely, you can set "policy.advisories.block" to false.
  Problem 2
    - josiasmontag/laravel-recaptchav3 is locked to version 1.0.5 and an update of this package was not requested.
    - josiasmontag/laravel-recaptchav3 1.0.5 requires guzzlehttp/guzzle ^6.2|^7.0 -> found guzzlehttp/guzzle[6.2.0, ..., 6.5.8, 7.0.0, ..., 7.15.1] but these were not loaded, because they are affected by security advisories ("PKSA-fy2t-3c5f-827y", "PKSA-qxvb-2bpp-dnk6", "PKSA-bbs6-q5q9-f3t4", "PKSA-bcdd-5xc7-gwfb", "PKSA-pwsk-hy21-4gby", "PKSA-93qv-9n9h-6k6p", "PKSA-k22t-f949-t9g6", "PKSA-yfw5-9gnj-n2c7", "PKSA-k1b4-kshy-xgbh", "PKSA-2z36-j4q9-rsfy", "PKSA-fvw5-9t6n-nwvr", "PKSA-6d8m-6kgw-18zr", "PKSA-stmn-hvzq-wph6"). Go to https://packagist.org/security-advisories/ to find advisory details. To ignore the advisories, add their IDs to the "policy.advisories.ignore-id" config or add the package to "policy.advisories.ignore". To turn the feature off entirely, you can set "policy.advisories.block" to false.
  Problem 3
    - Root composer.json requires laravel/framework ^12.64.0 -> satisfiable by laravel/framework[v12.64.0].
    - laravel/framework v12.64.0 requires guzzlehttp/guzzle ^7.8.2 -> found guzzlehttp/guzzle[7.8.2, ..., 7.15.1] but these were not loaded, because they are affected by security advisories ("PKSA-fy2t-3c5f-827y", "PKSA-qxvb-2bpp-dnk6", "PKSA-bbs6-q5q9-f3t4", "PKSA-bcdd-5xc7-gwfb", "PKSA-pwsk-hy21-4gby", "PKSA-93qv-9n9h-6k6p", "PKSA-k22t-f949-t9g6"). Go to https://packagist.org/security-advisories/ to find advisory details. To ignore the advisories, add their IDs to the "policy.advisories.ignore-id" config or add the package to "policy.advisories.ignore". To turn the feature off entirely, you can set "policy.advisories.block" to false.
  Problem 4
    - Root composer.json requires larastan/larastan ^3.10.0 -> satisfiable by larastan/larastan[v3.10.0].
    - illuminate/http[v11.34.0, ..., v11.51.0, v12.0.0, ..., v12.64.0, v13.0.0, ..., v13.21.1] require guzzlehttp/guzzle ^7.8.2 -> found guzzlehttp/guzzle[7.8.2, ..., 7.15.1] but these were not loaded, because they are affected by security advisories ("PKSA-fy2t-3c5f-827y", "PKSA-qxvb-2bpp-dnk6", "PKSA-bbs6-q5q9-f3t4", "PKSA-bcdd-5xc7-gwfb", "PKSA-pwsk-hy21-4gby", "PKSA-93qv-9n9h-6k6p", "PKSA-k22t-f949-t9g6"). Go to https://packagist.org/security-advisories/ to find advisory details. To ignore the advisories, add their IDs to the "policy.advisories.ignore-id" config or add the package to "policy.advisories.ignore". To turn the feature off entirely, you can set "policy.advisories.block" to false.
    - laravel/framework v12.64.0 require guzzlehttp/guzzle ^7.8.2 -> found guzzlehttp/guzzle[7.8.2, ..., 7.15.1] but these were not loaded, because they are affected by security advisories ("PKSA-fy2t-3c5f-827y", "PKSA-qxvb-2bpp-dnk6", "PKSA-bbs6-q5q9-f3t4", "PKSA-bcdd-5xc7-gwfb", "PKSA-pwsk-hy21-4gby", "PKSA-93qv-9n9h-6k6p", "PKSA-k22t-f949-t9g6"). Go to https://packagist.org/security-advisories/ to find advisory details. To ignore the advisories, add their IDs to the "policy.advisories.ignore-id" config or add the package to "policy.advisories.ignore". To turn the feature off entirely, you can set "policy.advisories.block" to false.
    - larastan/larastan v3.10.0 requires illuminate/http ^11.44.2 || ^12.4.1 || ^13 -> satisfiable by laravel/framework[v12.64.0], illuminate/http[v11.44.2, ..., v11.51.0, v12.4.1, ..., v12.64.0, v13.0.0, ..., v13.21.1].

Use the option --with-all-dependencies (-W) to allow upgrades, downgrades and removals for packages currently locked to specific versions.

File name: package-lock.json

npm warn Unknown env config "store". This will error in a future major version of npm. See `npm help npmrc` for supported config options.
npm error code EALLOWREMOTE
npm error Fetching packages of type "remote" have been disabled
npm error Refusing to fetch "https://registry.npmjs.org/@tailwindcss/oxide-wasm32-wasi/-/oxide-wasm32-wasi-4.3.3.tgz"
npm error A complete log of this run can be found in: /tmp/renovate/cache/others/npm/_logs/2026-07-24T10_47_19_475Z-debug-0.log