Skip to content

chore(deps): update taskfile - #123

Merged
arpad-csepi merged 1 commit into
mainfrom
renovate/taskfile
Sep 15, 2026
Merged

arpad-csepi merged 1 commit into
mainfrom
renovate/taskfile

Conversation

@agntcy-automation

@agntcy-automation agntcy-automation Bot commented Sep 9, 2026

Copy link
Copy Markdown
Contributor

ℹ️ Note

This PR body was truncated due to platform limits.

This PR contains the following updates:

Package Update Change Pending
astral-sh/uv patch 0.12.70.12.10 0.12.14 (+3)
renovatebot/renovate minor 44.48.344.69.7 44.90.3 (+55)

Release Notes

astral-sh/uv (astral-sh/uv)

v0.12.10

Compare Source

Released on 2026-09-04.

Enhancements
  • Attempt to revoke short-lived PyPI trusted-publishing tokens after uv publish completes, including when publishing fails (#​21423)
Preview features
  • Omit exclude-newer-package settings for packages outside the resolution from uv.lock with the missing-exclude-newer-package-lock preview feature (#​21455)
  • Show terminal dependency cycles in uv tree --invert output (#​21404)
Performance
  • Speed up locking large workspaces with conflicts by excluding unrelated extras and dependency groups from conflict simplification (#​21399)
  • Speed up uv publish by hashing each artifact in a single blocking task and reusing the buffer across reads (#​21389)
Bug fixes
  • Prevent --locked from failing when exclude-newer-package settings differ only for packages outside the resolution (#​21454)
  • Allow uv lock --check to reuse a lockfile when an absolute exclude-newer cutoff is moved later (#​19571)
  • Allow uv lock --check to reuse a lockfile when a package-specific exclude-newer cutoff is disabled (#​21450)
  • Require an explicit --name when uv init would infer a project name reserved for a Python interpreter (#​21395)
  • Write package-specific exclude-newer cutoffs to uv.lock in a deterministic order (#​21453)

v0.12.9

Compare Source

Released on 2026-09-01.

Python
Enhancements
  • Add --no-locked and --no-frozen to disable lock modes enabled by UV_LOCKED and UV_FROZEN for a single invocation (#​21408)
  • Report the exact command-line lock-mode flag in warnings and errors (#​21402)
Performance
  • Speed up cold wheel installs by extracting each streaming ZIP archive in a single blocking task and reusing buffers across files (#​21372)
Bug fixes
  • Update async_http_range_reader to 0.11.1 to address a potential memory-safety issue when reading metadata ranges from untrusted wheels (#​21401)
  • Remove sensitive headers when redirects cross authentication realms, including same-host redirects that change URL schemes (#​21382)
  • Redact secrets in signed URLs from retry diagnostics, including nested request errors (#​21381)
  • Give --locked, --frozen, --check, and --check-exists precedence over conflicting UV_LOCKED and UV_FROZEN values (#​21396)
  • Prevent concurrent uv processes from redundantly extracting the same local or source-built wheel (#​21400)

v0.12.8

Compare Source

Released on 2026-08-31.

Enhancements
  • Warn about invalid tool directories and continue upgrading valid tools with uv tool upgrade --all (#​21368)
Preview features
  • Deduplicate identical files within and across cached wheels with the content-addressed-cache preview feature (#​21327)
  • Reduce allocations while extracting content-addressed wheels by reusing the hashing buffer across files (#​21340)
  • Speed up content-addressed cache cleanup on macOS by reading hard-link counts in bulk (#​21344)
Performance
  • Prevent concurrent uv processes from downloading and extracting the same remote wheel more than once (#​21379)
  • Speed up dependency graph construction from large lockfiles by indexing packages during traversal (#​21373)
  • Extend indexed lockfile traversal to exports, dependency trees, audits, and freshness checks (#​21377)
  • Speed up warm resolutions by reducing repeated marker interner work (#​21300)
Bug fixes
  • Do not trust hashes from direct URLs discovered only in wheel metadata when installing with --require-hashes (#​21348)
  • Use a compatible Azure Storage API version for anonymous and authenticated requests, allowing credential retries when public access is disabled (#​21366)
  • Redact Azure shared access signature (sig) query parameters from displayed URLs (#​21360)
  • Treat projects below one-level workspace member globs as standalone instead of aborting workspace discovery (#​21341)
Other changes
  • Update astral-tokio-tar to 0.7.0 and use effective sizes when tracking extracted hard links (#​21346)
renovatebot/renovate (renovatebot/renovate)

v44.69.7

Compare Source

Bug Fixes
  • deps: update ghcr.io/renovatebot/base-image docker tag to v13.95.11 (main) (#​45763) (b0d1e5e)

v44.69.6

Compare Source

Build System

v44.69.5

Compare Source

Bug Fixes
  • deps: update ghcr.io/renovatebot/base-image docker tag to v13.95.10 (main) (#​45757) (6111d05)
Build System

v44.69.4

Compare Source

Bug Fixes
  • manager/npm: pass --no-frozen-lockfile to pnpm lock file updates (#​44676) (6f0b6a5)

v44.69.3

Compare Source

Build System

v44.69.2

Compare Source

Bug Fixes

v44.69.1

Compare Source

Tests
Build System

v44.69.0

Compare Source

Features
  • datasource/helm: support aws s3 as helm charts repository (#​45584) (c6578a4)

v44.68.3

Compare Source

Bug Fixes
  • deps: update ghcr.io/renovatebot/base-image docker tag to v13.95.9 (main) (#​45753) (5538ed1)

v44.68.2

Compare Source

Bug Fixes
  • datasource/aws-machine-image: return all AMI releases for minimumReleaseAge filtering (#​43749) (325dc64)

v44.68.1

Compare Source

Bug Fixes
  • datasource: isolate release lookups by registry configuration (#​45738) (3e15fc2)

v44.68.0

Compare Source

Features
  • datasource/apk: default to apk versioning rather than loose (#​45694) (b1cce8a)
Bug Fixes
  • deno: only collect workspace members when workspaces are declared (#​45394) (8a926e8)
  • manager/dockerfile: don't relabel the syntax dep as final (#​45690) (569dff1)

v44.67.2

Compare Source

Bug Fixes

v44.67.1

Compare Source

Build System

v44.67.0

Compare Source

Features
Documentation
Miscellaneous Chores

v44.66.1

Compare Source

Miscellaneous Chores
Build System

v44.66.0

Compare Source

Features
Build System

v44.65.5

Compare Source

Build System

v44.65.4

Compare Source

Build System

v44.65.3

Compare Source

Bug Fixes
  • deps: update ghcr.io/renovatebot/base-image docker tag to v13.95.8 (main) (#​45726) (295d2e3)
Miscellaneous Chores

v44.65.2

Compare Source

Build System

v44.65.1

Compare Source

Bug Fixes
  • deps: update ghcr.io/renovatebot/base-image docker tag to v13.95.7 (main) (#​45717) (074020e)
Miscellaneous Chores
Build System

v44.65.0

Compare Source

Features
  • onboarding: note that vulnerabilityAlerts can be rate limited (#​45686) (a806d2f)
Continuous Integration

v44.64.3

Compare Source

Build System

v44.64.2

Compare Source

Build System

v44.64.1

Compare Source

Bug Fixes

v44.64.0

Compare Source

Features

v44.63.0

Compare Source

Features

v44.62.2

Compare Source

Bug Fixes
  • config/validation: allow only capturing currentDigest in Custom Managers (#​45671) (8abbd14), closes #​45665
  • datasource: use release-level registryUrl in postprocessRelease (#​45096) (7f71c26)
  • manager/mix: run mix commands from the lock file's directory (#​44971) (69bc2dd)
  • manager/pep621: support array form of tool.uv.sources (#​44970) (9d10700)
  • presets: fix javaLTSVersions not preserving partial semver for mise Java versions (#​44899) (5f5e58b)
  • versioning/nuget: bare exact version bypasses ignoreUnstable (#​45087) (4db8635)
Tests

v44.62.1

Compare Source

Bug Fixes
  • bump-versions: collect bumpVersions from all upgrades, not just upgrades[0] (#​44809) (e10ef79)

v44.62.0

Compare Source

Features
Tests

v44.61.6

Compare Source

Build System

v44.61.5

Compare Source

Miscellaneous Chores
Build System

v44.61.4

Compare Source

Bug Fixes

v44.61.3

Compare Source

Bug Fixes
  • lookup: preserve current compatibility (#​45171) (19e4cdc)
  • manager/gitlabci: support ~latest component refs (#​45234) (80ed949)
  • manager/npm: massage out lockstep siblings pinning the replaced version (#​45085) (fa7abab)
  • skip empty post upgrade task (#​45227) (0bfd189)
  • workers/repository: ensure internal checks are applied when a rebase is requested (4530b9e)
Documentation
  • add warning to checkedBranches (c2a4f49)
Code Refactoring
  • workers/repository: add a separate check for "don't make this branch as pending" (bb8c9cb)
  • workers/repository: extract a type for the Dependency Dashboard checks (f1c39b2)
Tests
  • datasource: replace file snapshots with explicit assertions (#​45655) (f4ab79f)

v44.61.2

Compare Source

Bug Fixes
  • gerrit: resolve relative submodule URLs for nested project paths (#​44667) (40fce9a)
  • manager/flux: strip templates from resource files (#​43198) (029663d)
  • manager: Handle variables with default values in registry aliases (#​36293) (b22f580)
Documentation
Miscellaneous Chores
Code Refactoring

v44.61.1

Compare Source

Bug Fixes
Documentation

v44.61.0

Compare Source

Features
  • datasource/orb: use REST API instead of graphql-unstable (#​45205) (2fc1b5c)
Performance Improvements
  • package-rules: avoid re-cloning invariant packageRules array on every rule match (#​44781) (0e90c69)
Code Refactoring

v44.60.1

Compare Source

Bug Fixes
  • config: enforce allowedEnv when applying env vars (6b2b607)
  • config: enforce allowedHeaders when applying headers (223e6ef)
  • config: report top-level "security" violations for env (61cbc87)
  • config: report top-level "security" violations for hostRules[].headers (ae34610)
  • util/host-rules: apply the admin's headers over a repository's (4732da7)
  • util/host-rules: enforce allowedHeaders within add() (c98f4f7)
  • util/host-rules: merge headers across matching rules (3d56c38)
  • workers/global: enforce allowedHeaders for the admin's own hostRules (432bb00)
  • workers/repository: validate resolved presets (2382888)
Code Refactoring
  • config: add requiresCheckAtTrustBoundary option flag (711d46b)
Tests
  • config: add a reminder to add check for trust boundaries (c1a00f1)
  • config: cover existing allowedEnv behaviour (6e0bbee)
  • config: cover existing allowedHeaders behaviour (d088346)
  • util/host-rules: cover existing header merging behaviour (9a91b69)
  • workers/repository: don't mock more than we need to (cf491cc)
  • workers/repository: set explicit allowedEnv (f189d93)

v44.60.0

Compare Source

Features
Bug Fixes
  • datasource/go: don't cache null on non-404/410 goproxy errors (#​45638) (dac1985)
Tests

v44.59.3

Compare Source

Miscellaneous Chores
  • deps: update dependency protobufjs@​8.0.1 to v8.8.0 (main) (#​45642) (4e436e5)
Build System

v44.59.2

Compare Source

Bug Fixes
  • changelog: preserve docker compatibility for changelog release lookup (#​45170) (02b1384)
  • manager/npm: run npm install twice during lock file maintenance (#​45542) (dad0b03)
  • prune: skip branch pruning when branchPrefix is empty (#​43891) (614b15d)
Miscellaneous Chores
  • deps: update docker/dockerfile docker tag to v1.27.0 (main) (#​45634) (d4aaf9e)

v44.59.1

Compare Source

Bug Fixes

v44.59.0

Compare Source

Features
Bug Fixes

v44.58.0

Compare Source

Features
Bug Fixes
  • deps: update ghcr.io/renovatebot/base-image docker tag to v13.95.6 (main) (#​45633) (d5b78f9)

v44.57.4

Compare Source

Bug Fixes
Miscellaneous Chores

v44.57.3

Compare Source

Bug Fixes
  • cache: re-add cacache.verify() to garbage collect orphaned content from put() overwrites (#​44987) (13ab659)
  • honour dashboard rebase for edited branch with no open PR (#​44567) (7c5bb7d)

v44.57.2

Compare Source

Bug Fixes
  • deps: update ghcr.io/renovatebot/base-image docker tag to v13.95.5 (main) (#​45625) (196f16a)

v44.57.1

Compare Source

Bug Fixes
Tests

v44.57.0

Compare Source

Features
Documentation

v44.56.4

Compare Source

Bug Fixes
  • deps: update ghcr.io/renovatebot/base-image docker tag to v13.95.4 (main) (#​45620) (957d745)

v44.56.3

Compare Source

Bug Fixes
  • deps: update ghcr.io/renovatebot/base-image docker tag to v13.95.3 (main) (#​45619) (dff2419)
Miscellaneous Chores

v44.56.2

Compare Source

Bug Fixes
  • deps: update ghcr.io/renovatebot/base-image docker tag to v13.95.2 (main) (#​45614) (f96de99)

v44.56.1

Compare Source

Bug Fixes
  • deps: update ghcr.io/renovatebot/base-image docker tag to v13.95.1 (main) (#​45609) (eadeb32)

v44.56.0

Compare Source

Features
  • deps: update ghcr.io/renovatebot/base-image docker tag to v13.95.0 (main) (#​45604) (c6e4e90)

v44.55.0

Compare Source

Features
  • deps: update ghcr.io/renovatebot/base-image docker tag to v13.94.0 (main) (#​45600) (d4ac9fc)
  • manager/npm: add support for bun in the packageManager field (#​45572) (24c56f9)
Bug Fixes
  • datasource/jsr: accept scopes shorter than the JSR registration minimum (#​45547) (78f4d9a)
Documentation
  • mend-hosted: updates to environment variables and arbitrary scripts (#​45496) (8b89b34)
Miscellaneous Chores
  • deps: update docker/setup-qemu-action action to v4.3.0 (main) (#​45594) (d481d33)
Code Refactoring
Continuous Integration

v44.54.0

Compare Source

Features
Bug Fixes
  • deps: update ghcr.io/renovatebot/base-image docker tag to v13.93.3 (main) (#​45587) (a5801df)
  • util/markdown: preserve at signs in URLs (#​45555) (cfb2a76)

v44.53.0

[Compare Source](https://redirect.github.com/renovatebo

Note

PR body was truncated to here.

@agntcy-automation
agntcy-automation Bot requested a review from a team as a code owner September 9, 2026 06:36
@agntcy-automation agntcy-automation Bot added dependencies Pull requests that update a dependency file build labels Sep 9, 2026
@codecov-commenter

Copy link
Copy Markdown

Codecov Report

✅ All modified and coverable lines are covered by tests.

📢 Thoughts on this report? Let us know!

@agntcy-automation
agntcy-automation Bot force-pushed the renovate/taskfile branch 14 times, most recently from a214f80 to 7e6e0e6 Compare September 14, 2026 18:23
@arpad-csepi
arpad-csepi merged commit 414b2c3 into main Sep 15, 2026
17 checks passed
@arpad-csepi
arpad-csepi deleted the renovate/taskfile branch September 15, 2026 07:44
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

build dependencies Pull requests that update a dependency file

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants