Skip to content

Update patch-and-minor - #2296

Open
renovate[bot] wants to merge 1 commit into
mainfrom
renovate/patch-and-minor
Open

Update patch-and-minor#2296
renovate[bot] wants to merge 1 commit into
mainfrom
renovate/patch-and-minor

Conversation

@renovate

@renovate renovate Bot commented Nov 1, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

Note

This PR body was truncated due to platform limits.

This PR contains the following updates:

Package Change Age Confidence Type Update Pending
@​codemirror/autocomplete 6.20.3 → 6.20.4 age confidence dependencies patch
@​codemirror/view 6.43.14 → 6.43.15 age confidence dependencies patch
@cyclonedx/cdxgen 12.8.6 → 12.9.0 age confidence devDependencies minor 12.9.1
@tauri-apps/cli 2.12.3 → 2.12.4 age confidence devDependencies patch
@unocss/cli (source) 66.11.0 → 66.12.0 age confidence devDependencies minor
@unocss/preset-wind4 (source) 66.11.0 → 66.12.0 age confidence devDependencies minor
@vitest/coverage-v8 (source) 5.0.4 → 5.1.0 age confidence devDependencies minor
aes-gcm 0.10 → 0.11 age confidence dependencies minor
aes-gcm 0.11.0 → 0.11.1 age confidence dependencies patch
arboard 3.6.1 → 3.7.0 age confidence dependencies minor
base64 0.22 → 0.23 age confidence dependencies minor
eslint (source) 10.12.0 → 10.14.0 age confidence devDependencies minor
flate2 1.1.9 → 1.1.11 age confidence dependencies patch
futures-util (source) 0.3.32 → 0.3.34 age confidence dependencies patch
globals 17.13.0 → 17.14.0 age confidence devDependencies minor
hmac 0.12 → 0.13 age confidence dependencies minor
insta (source) 1.48.0 → 1.49.0 age confidence dev-dependencies minor
libc 0.2.186 → 0.2.191 age confidence dependencies patch
minisign 0.9 → 0.10 age confidence dependencies minor
nanoid@3 3.3.18 → 3.3.20 age confidence pnpm-workspace.overrides patch
pbkdf2 (source) 0.12 → 0.13 age confidence dependencies minor
plist 1.10.0 → 1.10.3 age confidence dependencies patch
plist 1.10.0 → 1.10.3 age confidence dev-dependencies patch
pnpm (source) 10.12.1 → 10.34.9 age confidence packageManager minor
rand (source) 0.9 → 0.10 age confidence dependencies minor
rand (source) 0.10.1 → 0.10.3 age confidence dependencies patch
regex 1.12.3 → 1.13.1 age confidence dependencies minor
reqwest 0.13.4 → 0.13.5 age confidence dependencies patch
rust (source, changelog) 1.96.0 → 1.99.1 age confidence toolchain minor
serde (source) 1.0.228 → 1.0.229 age confidence dependencies patch
serde_json 1.0.150 → 1.0.154 age confidence dependencies patch
sha2 0.10 → 0.11 age confidence dependencies minor
style-dictionary (source) 5.6.1 → 5.7.1 age confidence devDependencies minor 5.8.0
tar 7.5.21 → 7.5.22 age confidence pnpm-workspace.overrides patch
tauri (source) 2.12.4 → 2.12.5 age confidence dependencies patch
tauri-build (source) 2.7.3 → 2.7.4 age confidence build-dependencies patch
tauri-plugin-dialog 2.7.1 → 2.8.4 age confidence dependencies minor
tauri-plugin-global-shortcut 2.3.2 → 2.4.1 age confidence dependencies minor
tauri-plugin-notification 2.3.3 → 2.8.0 age confidence dependencies minor
tauri-plugin-opener 2.5.4 → 2.7.2 age confidence dependencies minor
tauri-plugin-single-instance 2.4.2 → 2.5.5 age confidence dependencies minor
tauri-plugin-window-state 2.4.1 → 2.5.0 age confidence dependencies minor
toml 1.1.2+spec-1.1.0 → 1.2.0 age confidence dependencies minor
uniffi (source) 0.28 → 0.32 age confidence dependencies minor
unocss (source) 66.11.0 → 66.12.0 age confidence devDependencies minor
uuid 1.23.2 → 1.29.0 age confidence dependencies minor
vite (source) 8.1.6 → 8.3.5 age confidence pnpm-workspace.overrides minor 8.3.6
vite (source) 8.3.4 → 8.3.5 age confidence devDependencies minor 8.3.6
vitest (source) 5.0.4 → 5.1.0 age confidence devDependencies minor
windows-sys 0.59 → 0.61 age confidence dependencies minor
winreg 0.52 → 0.56 age confidence dependencies minor
ws 8.21.1 → 8.22.1 age confidence pnpm-workspace.overrides minor

Release Notes

cdxgen/cdxgen (@​cyclonedx/cdxgen)

v12.9.0

Compare Source

This release backports the PHP version work from the 13.x branch (#​4547) to the 12.x LTS line. When a PHP security release lands, the first thing everyone asks is which PHP they are running, and until now a cdxgen SBOM could not tell them. Composer SBOMs now keep the PHP facts their lock file carries, --include-formulation records the PHP and Composer of the machine that generated the BOM, and container and OS scans read the version of PHP that was built from source. Two new audit rules use that version to flag builds affected by CVE-2026-109618 and CVE-2026-109619, the unauthenticated remote code execution bugs fixed in PHP 8.2.35, 8.3.36, 8.4.27 and 8.5.12. (#​4539, #​4540)

Composer projects

A composer.lock knows more than cdxgen used to keep. Its platform, platform-dev and platform-overrides entries now become properties on the project's component, such as cdx:composer:platform:php = ^8.1 and cdx:composer:platformOverride:php = 8.1.27. When the composer.json in the scanned directory has no name, they go in the document's metadata.properties instead. Each locked package also keeps its own php, hhvm, ext-* and lib-* requirements as cdx:composer:require:* properties, so psr/log now carries cdx:composer:require:php = >=8.0.0. These are constraints, not the PHP that runs, so none of them becomes a component and the dependency graph is unchanged.

Formulation

With --include-formulation, the toolchain list now includes php and composer as platform components with generic purls and CPEs, for example pkg:generic/php@8.5.11 with cpe:2.3:a:php:php:8.5.11:*:*:*:*:*:*:*, and pkg:generic/composer@2.10.3 with cpe:2.3:a:getcomposer:composer:2.10.3:*:*:*:*:*:*:*. cdxgen runs php -n -v, which loads no php.ini, and composer --version --no-plugins --no-scripts --no-interaction. The PHP path that Composer prints is never recorded. A distro build such as Ubuntu's 8.1.2-1ubuntu2.14 keeps the version it reports but gets no CPE, because distros backport fixes under the old upstream number. Like the other toolchains, these components have no bom-ref, and they describe the build machine rather than the runtime of whatever the BOM describes. Set PHP_CMD or COMPOSER_CMD to choose which commands are run.

Container images and OS scans

Images built on the official php images, FrankenPHP and other /usr/local builds compile PHP from source, so no package database records it. Container and rootfs scans now read the version compiled into php, php-fpm, php-cgi, phpdbg, libphp*.so and frankenphp, or from the installed php_version.h. They tag those file components with cdx:php:buildVersion, cdx:php:buildVersionSource and cdx:php:sapi, and add one pkg:generic/php@<version> platform component with a CPE for each version found. -t os and obom do the same for a short, fixed list of directories, looking at no more than 64 files and executing nothing. PHP installed by a package manager (deb, rpm, apk, Homebrew, Nix, Guix or Chocolatey) is still identified by its package, and gets neither the generic component nor the properties.

Audit rules

PHP-RCE-001 (critical) flags a source-built PHP-FPM, php-cgi, libphp or FrankenPHP older than 8.2.35, 8.3.36, 8.4.27 or 8.5.12, or an 8.6.0 pre-release before RC4. PHP-RCE-002 (medium) flags the same builds of the CLI and phpdbg, which aren't reachable from the network themselves but share the vulnerable code with the web SAPIs built alongside them. Turn them on with --bom-audit --bom-audit-categories php-security. Builds from the php-src CVE backport branches keep their old version number, so the rules can't tell them apart from vulnerable builds; the finding text says so. Distro PHP is left to your vulnerability database.

Other changes

oci:image:appLanguage now names the language of an image's command. The check compared array positions instead of language names, so a command containing 0 , such as a port number, was labelled 0, and no image was ever labelled php, node or any other language.

One behaviour differs from 13.x: when --project-name replaces the main component in a multi-type scan, the Composer project component it displaces is dropped, and its platform properties go with it. The per-package cdx:composer:require:* properties are unaffected.

Checking your copy
cdxgen -t php --include-formulation -o bom.json .
jq -c '.formulation[].components[] | select(.name == "php" or .name == "composer") | {name, version, purl, cpe}' bom.json

With PHP 8.5.11 and Composer 2.10.3 from Homebrew on macOS, this prints:

{"name":"php","version":"8.5.11","purl":"pkg:generic/php@8.5.11","cpe":"cpe:2.3:a:php:php:8.5.11:*:*:*:*:*:*:*"}
{"name":"composer","version":"2.10.3","purl":"pkg:generic/composer@2.10.3","cpe":"cpe:2.3:a:getcomposer:composer:2.10.3:*:*:*:*:*:*:*"}

What's Changed

Full Changelog: cdxgen/cdxgen@v12.8.9...v12.9.0

v12.8.9

Compare Source

This release finishes what 12.8.8 set out to do: the October 2026 Node.js security fixes are now in every cdxgen standalone binary and container image.

12.8.8 updated our Node.js version pins but missed .nvmrc, the one file the binary build reads. Its binaries went out with Node.js 24.18.0, and its container images failed to build. If you upgraded to 12.8.8 for the Node.js fixes, please upgrade again.

The issue is described in GHSA-5266-jm88-3grm. The bundled runtimes contained the Node.js Brotli decoder bug (CVE-2026-111497). cdxgen can feed that decoder untrusted data in two ways: when it scans a repository whose Podfile.lock points at an attacker-controlled host, and when someone posts to cdxgen --server. If you install cdxgen from npm, it runs on your own Node.js; upgrade Node.js to 22.23.4, 24.22.1 or 26.12.1.

What changed
  • Every standalone binary (cdxgen, cbom, obom, hbom, cdx-*, aibom, saasbom, tracebom, on every platform) bundles Node.js 24.22.1. CI now fails if .nvmrc, .versions/node_24 and the ppc64 image's Node.js version disagree. (#​4541)
  • cdxgen-secure is built on the cdxgen image from the same release. Previously every cdxgen-secure tag was built on a cdxgen:master image from August, so it ran that month's master code on Node.js 24.18.0 regardless of its tag. (#​4545)
  • cdxgen-ppc64 installs the official Node.js 24.22.1 build. AlmaLinux's own nodejs package hasn't picked up the fixes yet. (#​4543)
  • cdxgen-bun is built with Bun 1.4.4, whose bundled Brotli includes the same decoder fix.
  • The container builds install timezonedb from a checksum-pinned tarball. pecl.php.net's release lookup started failing, which is what broke the 12.8.8 images. (#​4543)
  • undici is updated to 7.30.1, along with fast-uri 3.1.8, brace-expansion 5.0.12 and qs 6.16.1. (#​4541)
Checking your copy

Run cdxgen --version; it should print Runtime: Node.js, Version: 24.22.1. Every *-postbuild.cdx.json attached to this release lists pkg:generic/nodejs/node@24.22.1.

v12.8.8

Compare Source

This LTS release updates bundled runtimes and container images for upstream security fixes.

  • Node.js bumped to 22.23.4, 24.22.1 and 26.12.1 (October 2026 security releases), including the CI and Alpine node images.
  • PHP container images rebased on PHP 8.3.36, 8.4.27 and 8.5.12 (CVE-2026-109618, CVE-2026-109619), along with the PHP containers used by the binary builds.

v12.8.7

Compare Source

This LTS release hardens server mode, tracked as GHSA-259h-c659-9x53. The git host allowlist checked a different host than the one git connected to for some URLs, and a request could turn on deep or installDeps even in secure mode or with --no-install-deps, which let a cloned project's build scripts run. Both are fixed, along with related gaps in redirects, host-wide project types, serverUrl handling and symlinked paths. Upgrading is recommended for anyone running cdxgen --server.

Thanks to @​varandaa for the report.

tauri-apps/tauri (@​tauri-apps/cli)

v2.12.4: @​tauri-apps/cli v2.12.4

Compare Source

[2.12.4]

Bug Fixes
  • 136a28eaa (#​16305 by @​Chaosnico9000) Skip the --target validation when rustup target list fails, e.g. when rustup is on PATH but has no toolchain installed, instead of rejecting every target as missing.
  • 52081e04a (#​16333 by @​amrbashir) Rename the misspelled choowHowToInstall NSIS language string to chooseHowToInstall. A custom language file in bundle.windows.nsis.customLanguageFiles that only defines the old name keeps working for now, but users should migrate to the new name.
Dependencies
  • Upgraded to tauri-cli@2.12.4
  • 4a6f51251 (#​16317 by @​lazerg) Updated zip to v9 to fix RUSTSEC-2026-0367, RUSTSEC-2026-0368 and RUSTSEC-2026-0369.
unocss/unocss (@​unocss/cli)

v66.12.0

Compare Source

   🚀 Features
   🐞 Bug Fixes
   🏎 Performance
    View changes on GitHub
vitest-dev/vitest (@​vitest/coverage-v8)

v5.1.0

Compare Source

   🚀 Features
   🐞 Bug Fixes

[!IMPORTANT]
✂ PR body was truncated to here.

Configuration

📅 Schedule: (in timezone Asia/Shanghai)

  • Branch creation
    • "before 6am on monday"
  • Automerge
    • At any time (no schedule defined)

🚦 Automerge: Enabled.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

  • If you want to rebase/retry this PR, check this box

This PR was generated by Mend Renovate. View the repository job log.

@renovate renovate Bot added dependencies Pull requests that update a dependency file javascript rust Pull requests that update rust code labels Nov 1, 2026
@renovate

renovate Bot commented Nov 1, 2026

Copy link
Copy Markdown
Contributor Author

⚠️ Artifact update problem

Renovate failed to update an artifact related to this branch. You probably do not want to merge this PR as-is.

♻ Renovate will retry this branch, including artifacts, only when one of the following happens:

  • any of the package files in this branch needs updating, or
  • the branch becomes conflicted, or
  • you click the rebase/retry checkbox if found above, or
  • you rename this PR's title to start with "rebase!" to trigger it manually

The artifact failure details are included below:

File name: apps/desktop/src-tauri/Cargo.lock
error: package ID specification `aes-gcm@0.11.0` did not match any packages
help: there are similar package ID specifications:

  aes-gcm@0.11.1

@coderabbitai

coderabbitai Bot commented Nov 1, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

Important

Review skipped

Bot user detected.

To trigger a single review, invoke the @coderabbitai review command.

Run configuration

  • Source mode: Auto
  • Repository: Unavailable
  • Branch: Unavailable
  • File: No configuration file from this repository applied
  • Commit: Unavailable
  • Layers: Repository UI
  • Review profile: ASSERTIVE
  • Plan: Advanced
  • Run ID: 68f615bc-8890-4fce-a36b-8cd46068f532

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

  • Trigger review
  • Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

Share

@codeant-ai

codeant-ai Bot commented Nov 1, 2026

Copy link
Copy Markdown

Skipping PR review because a bot author is detected.

If you want to trigger CodeAnt AI, comment @codeant-ai review to trigger a manual review.

@codecov

codecov Bot commented Nov 1, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

Codecov Report

✅ All modified and coverable lines are covered by tests.

📢 Thoughts on this report? Let us know!

@renovate
renovate Bot force-pushed the renovate/patch-and-minor branch 10 times, most recently from 966a0f9 to 47431de Compare November 6, 2026 04:09
@renovate
renovate Bot force-pushed the renovate/patch-and-minor branch from 47431de to 84dbc63 Compare November 6, 2026 04:45
@sonarqubecloud

sonarqubecloud Bot commented Nov 6, 2026

Copy link
Copy Markdown
Contributor

Quality Gate Passed Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

This branch has not been deployed

No deployments
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

dependencies Pull requests that update a dependency file javascript rust Pull requests that update rust code

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

0 participants