chore(deps): Update all non-major dependencies

[renovate]

This PR contains the following updates:

Package	Change	Age	Confidence	Type	Update
@typescript-eslint/eslint-plugin (source)	8.54.0 → 8.55.0			devDependencies	minor
@typescript-eslint/parser (source)	8.54.0 → 8.55.0			devDependencies	minor
npm (source)	11.9.0 → 11.10.0			packageManager	minor
pino (source)	10.3.0 → 10.3.1			dependencies	patch
supabase/postgres	15.14.1.081 → 15.14.1.084				patch
turbo (source)	2.8.3 → 2.8.9			devDependencies	patch

---

Release Notes

typescript-eslint/typescript-eslint (@​typescript-eslint/eslint-plugin)

v8.55.0

Compare Source

🚀 Features

• utils: deprecate defaultOptions in favor of meta.defaultOptions (#​11992)

🩹 Fixes

• eslint-plugin: [no-useless-default-assignment] reduce param index to ts this handling (#​11949)
• eslint-plugin: [no-useless-default-assignment] report unnecessary defaults in ternary expressions (#​11984)
• eslint-plugin: [no-useless-default-assignment] require strictNullChecks (#​11966, #​12000)
• eslint-plugin: [no-unused-vars] remove trailing newline when removing entire import (#​11990)

❤️ Thank You

• Christian Rose @​chrros95
• Josh Goldberg
• Maria Solano @​MariaSolOs
• Minyeong Kim @​minyeong981
• SungHyun627 @​SungHyun627
• Yukihiro Hasegawa @​y-hsgw

See GitHub Releases for more information.

You can read about our versioning strategy and releases on our website.

typescript-eslint/typescript-eslint (@​typescript-eslint/parser)

v8.55.0

Compare Source

This was a version bump only for parser to align it with other projects, there were no code changes.

See GitHub Releases for more information.

You can read about our versioning strategy and releases on our website.

npm/cli (npm)

v11.10.0

Compare Source

Features

• cf56a1e #​8899 npm trust, per-command config (@​reggi)
• cf56a1e #​8899 npm trust (@​reggi)
• 66d6e11 #​8965 add min-release-age (#​8965) (@​wraithgar)

Dependencies

• aae84bf #​8973 pacote@21.3.1
• 8bcb675 #​8973 cidr-regex@5.0.2
• f87aaab #​8973 lru-cache@11.2.6
• acec871 #​8973 ssri@13.0.1
• 1e42a86 #​8973 glob@13.0.2
• e1c08a4 #​8973 is-cidr@6.0.3
• dfb0e34 #​8973 semver@7.7.4
• 0ee7776 #​8973 which@6.0.1

Chores

• eb81df8 #​8973 dev dependency updates (@​wraithgar)
• 995e757 #​8966 Clean up some todos, add tests for previously skipped blocks (@​owlstronaut)
• workspace: @npmcli/arborist@9.3.0
• workspace: @npmcli/config@10.7.0
• workspace: libnpmdiff@8.1.1
• workspace: libnpmexec@10.2.1
• workspace: libnpmfund@7.0.15
• workspace: libnpmpack@9.1.1

pinojs/pino (pino)

v10.3.1

Compare Source

What's Changed

• build(deps): bump actions/checkout from 6.0.1 to 6.0.2 by @​dependabot[bot] in #​2385
• build(deps-dev): bump eslint-plugin-n from 17.23.1 to 17.23.2 by @​dependabot[bot] in #​2386
• docs: clarify transport level filtering behavior by @​mcollina in #​2390
• fix(transport): sanitize invalid NODE_OPTIONS preloads for workers by @​mcollina in #​2391

Full Changelog: pinojs/pino@v10.3.0...v10.3.1

vercel/turborepo (turbo)

v2.8.9

Compare Source

v2.8.8: Turborepo v2.8.8

Compare Source

What's Changed

@​turbo/codemod

• fix: Enhance path validation in assertSafeGitArgument by @​odaysec in #​11788

Examples

• docs: Replace mysql refs with postgres by @​kyedavey in #​11827

Changelog

• fix: Use private blob store access in agents app by @​anthonyshew in #​11811
• fix: Pass non-empty body when initializing blob log files by @​anthonyshew in #​11812
• docs: Geistdocs update by @​haydenbleasel in #​11807
• fix: Allow overwriting existing blobs in run updates and log appends by @​anthonyshew in #​11813
• docs: Geistdocs update 2 by @​haydenbleasel in #​11814
• fix: Set 5-hour timeout on security audit sandbox by @​anthonyshew in #​11815
• fix: Resolve Windows TUI hang caused by portable-pty 0.9.0 ConPTY changes by @​anthonyshew in #​11816
• fix: Repair audit fixer log streaming and replace git push with patch upload by @​anthonyshew in #​11818
• chore: Small stuff for agent fixer by @​anthonyshew in #​11819
• chore: Bump tonic to 0.14 by @​anthonyshew in #​11820
• fix: Pin @​turbo/gen version to match the running turbo binary by @​anthonyshew in #​11822
• fix: Use secret_key_override in tests to eliminate env var race condition by @​anthonyshew in #​11824
• fix: Avoid panic in sandboxed environments by removing system-configuration dependency by @​anthonyshew in #​11828
• fix: Harden token protection with secrecy crate and close exposure gaps by @​anthonyshew in #​11831
• fix: Clean up orphaned Windows child processes on shutdown by @​anthonyshew in #​11829
• chore: Update lockfile for release by @​anthonyshew in #​11840
• fix: Sync lockfile with @​turbo/gen optionalDependencies by @​anthonyshew in #​11845

New Contributors

• @​haydenbleasel made their first contribution in #​11807
• @​kyedavey made their first contribution in #​11827

Full Changelog: vercel/turborepo@v2.8.7...v2.8.8

v2.8.7: Turborepo v2.8.7

Compare Source

What's Changed

Changelog

• fix: Keep stdin alive for persistent tasks in stream mode by @​anthonyshew in #​11793
• feat: Add internal agents app for repo automation by @​anthonyshew in #​11799
• chore: Add env vars by @​anthonyshew in #​11800
• fix: Handle subpath package imports in turbo boundaries by @​anthonyshew in #​11798
• feat: Add dashboard with run tracking and live logs for agent sandboxes by @​anthonyshew in #​11802
• fix: Normalize bare LF to CRLF in TUI output to prevent garbled logs by @​anthonyshew in #​11804

Full Changelog: vercel/turborepo@v2.8.6...v2.8.7

v2.8.6: Turborepo v2.8.6

Compare Source

What's Changed

Changelog

• chore: Add internal agents app for repo automation by @​anthonyshew in #​11781
• feat: Add internal agents app for repo automation by @​anthonyshew in #​11783
• chore: Manual audits by @​anthonyshew in #​11785
• chore: Fixing audit agent by @​anthonyshew in #​11786
• chore: Still iterating on sec audit fixer by @​anthonyshew in #​11787
• fix: Emit space for empty vt100 cells to fix TUI repaint on task switch by @​anthonyshew in #​11789

Full Changelog: vercel/turborepo@v2.8.5...v2.8.6

v2.8.5: Turborepo v2.8.5

Compare Source

What's Changed

@​turbo/codemod

• fix: Upgrade tsdown to fix valibot and diff vulnerabilities by @​anthonyshew in #​11766
• fix: Upgrade semver to fix ReDoS vulnerability by @​anthonyshew in #​11765

@​turbo/repository

• fix: Rename cli workspace package to avoid false audit match by @​anthonyshew in #​11767

Changelog

• fix: Add Vary: Accept header to docs markdown endpoint by @​molebox in #​11759
• chore: Agentic workflows app by @​anthonyshew in #​11773
• chore: Add internal agents app for repo automation by @​anthonyshew in #​11776
• chore: Update reproduction request message by @​anthonyshew in #​11778
• Revert "fix: Upgrade node-plop to 0.32.3" by @​anthonyshew in #​11780

Full Changelog: vercel/turborepo@v2.8.4...v2.8.5

v2.8.4: Turborepo v2.8.4

Compare Source

What's Changed

create-turbo

• fix: Upgrade semver to fix ReDoS vulnerability by @​anthonyshew in #​11683
• fix: Upgrade inquirer to remove lodash dependency by @​anthonyshew in #​11709
• fix: Upgrade tsdown in create-turbo to resolve valibot ReDoS vulnerability by @​anthonyshew in #​11702
• fix: Upgrade jest to v30 to resolve brace-expansion ReDoS vulnerability by @​anthonyshew in #​11706

eslint

• fix: Upgrade Next.js to 16.1.5 to fix DoS vulnerabilities by @​anthonyshew in #​11681
• fix: Upgrade eslint to v10 to resolve @​eslint/plugin-kit ReDoS vulnerability by @​anthonyshew in #​11705

Examples

• examples: Update NODE_VERSION to 24.13.1 in Dockerfile by @​i5d6 in #​11679

Changelog

• fix: Upgrade tar to 7.5.7 to address security vulnerabilities by @​anthonyshew in #​11680
• fix: Upgrade ts-json-schema-generator to fix glob command injection vulnerability by @​anthonyshew in #​11684
• fix: Upgrade fumadocs and shiki in docs to resolve mdast-util-to-hast vulnerability by @​anthonyshew in #​11704
• fix: Replace ts-node with tsx to resolve diff DoS vulnerability by @​anthonyshew in #​11708
• fix: Upgrade bytes to >=1.11.1 to fix RUSTSEC-2026-0007 by @​anthonyshew in #​11715
• chore: Update ratatui dependencies (paste blocked upstream) by @​anthonyshew in #​11717
• Revert "chore: Update ratatui dependencies (paste blocked upstream)" by @​anthonyshew in #​11722
• fix: Upgrade ratatui to 0.30.0 to drop unmaintained paste crate by @​anthonyshew in #​11723
• chore: Upgrade reqwest toward addressing RUSTSEC-2025-0134 by @​anthonyshew in #​11718
• fix(docs): Fix code syntax highlighting by using correct Shiki CSS variable names by @​anthonyshew in #​11726
• fix: Upgrade async-io to 2.x to drop unmaintained instant crate by @​anthonyshew in #​11719
• fix: Migrate from unmaintained serde_yaml to serde_yml by @​anthonyshew in #​11720
• fix: Upgrade test-case and merge to drop unmaintained proc-macro-error by @​anthonyshew in #​11721
• fix: Upgrade indicatif to 0.18.3 to drop unmaintained number_prefix by @​anthonyshew in #​11716
• refactor: Centralize configuration resolution funnel by @​anthonyshew in #​11727
• fix: Upgrade rustls chain to resolve RUSTSEC-2025-0134 by @​anthonyshew in #​11739
• fix: Upgrade test-case to resolve transitive proc-macro-error by @​anthonyshew in #​11737
• fix: Upgrade pest/pest_derive to resolve yanked version by @​anthonyshew in #​11734
• fix: Upgrade git2 to fix RUSTSEC-2026-0008 by @​anthonyshew in #​11729
• fix: Upgrade pprof to fix RUSTSEC-2024-0408 by @​anthonyshew in #​11730
• fix: Upgrade portable-pty to resolve RUSTSEC-2017-0008 by @​anthonyshew in #​11732
• fix: Upgrade oxc_resolver to resolve yanked papaya dependency by @​anthonyshew in #​11733
• fix: Upgrade futures/futures-util to resolve yanked futures-util 0.3.30 by @​anthonyshew in #​11735
• fix: Replace unic-segment with unicode-segmentation in globwatch by @​anthonyshew in #​11736
• fix: Replace serde_yml with serde_yaml_ng to fix RUSTSEC-2025-0067/0068 by @​anthonyshew in #​11755
• fix: Replace oxc_resolver with unrs_resolver to fix yanked papaya dependency by @​anthonyshew in #​11754
• fix: Upgrade node-plop to 0.32.3 by @​anthonyshew in #​11756
• docs: Capitalizaiton in update github-actions.mdx by @​anthonyshew in #​11762

Full Changelog: vercel/turborepo@v2.8.3...v2.8.4

---

Configuration

📅 Schedule: Branch creation - "before 3am on Monday" (UTC), Automerge - At any time (no schedule defined).

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

[github-actions]

🎉 This PR is included in version 1.14.10 🎉

The release is available on GitHub release

Your semantic-release bot 📦🚀