ReviewOS
Reload

also looking at this

stacks/ts-svg

chore(deps): update all non-major dependencies

#1
Open renovate[bot] wants to merge renovate/all-minor-patch into main
5 files +95 -225
renovate[bot] 8 days ago

This PR contains the following updates:

PackageChangeAgeAdoptionPassingConfidenceTypeUpdate
@stacksjs/ts-css (source)^0.3.8 → ^0.3.21ageadoptionpassingconfidencedependenciespatch
@stacksjs/ts-png^0.1.2 → ^0.1.10ageadoptionpassingconfidencedependenciespatch
actions/cachev5.0.3 → v5.1.0ageadoptionpassingconfidenceactionminor
actions/checkoutv6.0.2 → v6.1.0ageadoptionpassingconfidenceactionminor
better-dx^0.2.15 → ^0.2.38ageadoptionpassingconfidencedevDependenciespatch
oven-sh/setup-bunv2.1.2 → v2.2.0ageadoptionpassingconfidenceactionminor
shivammathur/setup-php2.37.1 → 2.40.0ageadoptionpassingconfidenceactionminor
stacksjs/action-releaserv1.2.9 → v1.2.11ageadoptionpassingconfidenceactionpatch
svgo (source)^4.0.1 → ^4.1.0ageadoptionpassingconfidencedevDependenciesminor

Release Notes

stacksjs/ts-css (@​stacksjs/ts-css)

v0.3.21

Compare Source

Compare changes

🐛 Bug Fixes
  • engine: honour colorVariables on the common-colour fast path (a2e35a8) (by Chris Breuer <chrisbreuer93@>​gmail.com>)
🔧 Chores
  • release v0.3.21 (c286fde) (by Chris Breuer <chrisbreuer93@>​gmail.com>)
Contributors
  • Chris Breuer <chrisbreuer93@>​gmail.com>

v0.3.20

Compare Source

Compare changes

🐛 Bug Fixes

  • engine: read an icon class named by any markup attribute, not only class (617955b) (by Chris Breuer <chrisbreuer93@>​gmail.com>)

🔧 Chores

  • release v0.3.20 (6920a97) (by Chris Breuer <chrisbreuer93@>​gmail.com>)

Contributors

  • Chris Breuer <chrisbreuer93@>​gmail.com>

v0.3.19

Compare Source

Compare changes

🐛 Bug Fixes
  • engine: expand a shortcut used behind a variant (d2a6366) (by Chris <chrisbreuer93@>​gmail.com>)
🔧 Chores
  • release v0.3.19 (195a0d5) (by Chris <chrisbreuer93@>​gmail.com>)
Contributors
  • Chris <chrisbreuer93@>​gmail.com>

v0.3.18

Compare Source

Compare changes

🐛 Bug Fixes
Contributors

v0.3.17

Compare Source

Compare changes

🐛 Bug Fixes
🔧 Chores
Contributors

v0.3.16

Compare Source

Compare changes

🐛 Bug Fixes
📝 Documentation
🔧 Chores
Contributors

v0.3.15

Compare Source

Compare changes

🐛 Bug Fixes
📝 Documentation
🔧 Chores
Contributors

v0.3.14

Compare Source

v0.3.13

Compare Source

Compare changes

✨ Features
  • engine: colorVariables re-tints a palette through CSS variables (de69552) (by Chris <chrisbreuer93@>​gmail.com>)
🔧 Chores
  • release v0.3.13 (1c04f48) (by Chris <chrisbreuer93@>​gmail.com>)
Contributors
  • Chris <chrisbreuer93@>​gmail.com>

v0.3.12

Compare Source

Compare changes

🐛 Bug Fixes
🔧 Chores
Contributors

v0.3.11

Compare Source

Compare changes

✨ Features

🐛 Bug Fixes

♻️ Code Refactoring

📝 Documentation

🔧 Chores

Contributors

v0.3.10

Compare Source

Compare changes

🐛 Bug Fixes

  • engine: emit an icon's box at zero specificity (05a8293) (by Chris <chrisbreuer93@>​gmail.com>)

🔧 Chores

  • release v0.3.10 (ece0eff) (by Chris <chrisbreuer93@>​gmail.com>)

Contributors

  • Chris <chrisbreuer93@>​gmail.com>

v0.3.9

Compare Source

Compare changes

🐛 Bug Fixes

  • engine: keep the opacity on oklch shadow colors (72dbc3e) (by Chris <chrisbreuer93@>​gmail.com>)

🧹 Chores

  • release v0.3.9 (62e9970) (by Chris <chrisbreuer93@>​gmail.com>)

Contributors

  • Chris <chrisbreuer93@>​gmail.com>
stacksjs/ts-png (@&#8203;stacksjs/ts-png)

v0.1.8

Compare Source

v0.1.7

Compare Source

actions/cache

v5.1.0

Compare Source

What's Changed

Full Changelog: https://github.com/actions/cache/compare/v5...v5.1.0

v5.0.5

Compare Source

What's Changed

Full Changelog: https://github.com/actions/cache/compare/v5...v5.0.5

v5.0.4

Compare Source

What's Changed

New Contributors

Full Changelog: https://github.com/actions/cache/compare/v5...v5.0.4

actions/checkout

v6.1.0

Compare Source

What's Changed

https://github.blog/changelog/2026-06-18-safer-pull_request_target-defaults-for-github-actions-checkout/ for more details about this breaking change

Full Changelog: https://github.com/actions/checkout/compare/v6.0.3...v6.1.0

v6.0.3

Compare Source

stacksjs/better-dx (better-dx)

v0.2.38

Compare Source

v0.2.37

Compare Source

v0.2.36

Compare Source

v0.2.35

Compare Source

v0.2.34

Compare Source

v0.2.33

Compare Source

v0.2.32

Compare Source

v0.2.31

Compare Source

v0.2.30

Compare Source

v0.2.29

Compare Source

v0.2.28

Compare Source

v0.2.27

Compare Source

v0.2.26

Compare Source

v0.2.25

Compare Source

v0.2.24

Compare Source

v0.2.23

Compare Source

v0.2.22

Compare Source

v0.2.21

Compare Source

v0.2.20

Compare Source

v0.2.19

Compare Source

v0.2.18

Compare Source

v0.2.17

Compare Source

v0.2.16

Compare Source

oven-sh/setup-bun

v2.2.0

Compare Source

oven-sh/setup-bun is the github action for setting up Bun.

What's Changed

New Contributors

Full Changelog: https://github.com/oven-sh/setup-bun/compare/v2...v2.2.0

v2.1.3

Compare Source

oven-sh/setup-bun is the github action for setting up Bun.

What's Changed

New Contributors

Full Changelog: https://github.com/oven-sh/setup-bun/compare/v2...v2.1.3

shivammathur/setup-php

v2.40.0

Compare Source

Changelog
  • Added support for PHP 8.7 nightly builds. This installs PHP builds from the master branch of php/php-src.
- name: Setup PHP 8.7
  uses: shivammathur/setup-php@v2
  with:
    php-version: '8.7'

  • Added support for Ubuntu 26.04 (ubuntu-26.04). (#​1083)

  • Added support for pinning tools to SHA-256 and SHA-512 checksums. (#​1098, #​1099)

- name: Setup PHP with tools pinned to checksums
  uses: shivammathur/setup-php@v2
  with:
    php-version: '8.5'
    tools: >
      composer:2.9.8@sha256:59b2c50e10cafa0d8efc19ede9a326d782f096c674a26baf98cf042ce23de890,
      phpunit:12.5.0@sha512:76430b433bd57f96e5fbbabaefc0c82e3a5b19b1a366bd836614344c441a7a87575d77faa07e0e58ecec52061af67584b036adc4311f0764bd4414bc62be4684

  • Fixed support for Couchbase, Oracle, and IBM extensions on Ubuntu 26.04. (#​1123)

  • Added support for cpx. (#​1104)

- name: Setup PHP with cpx
  uses: shivammathur/setup-php@v2
  with:
    php-version: '8.5'
    tools: cpx
  • Added support for Laravel Cloud CLI. (#​1106)
- name: Setup PHP with Laravel Cloud CLI
  uses: shivammathur/setup-php@v2
  with:
    php-version: '8.5'
    tools: laravel-cloud
  • Added configurable verbose logging using the verbose environment variable. Set it to true or v to show command output, or vv or vvv to also enable tracing. Also, deprecated the verbose and more-verbose tags in favor of this environment variable. (#​1077, #​1118, #​1119)
- name: Setup PHP with verbose logging
  uses: shivammathur/setup-php@v2
  with:
    php-version: '8.5'
  env:
    verbose: true
  • Improved support for PHP version files, including version aliases, partial versions, and comments. For example, a .php-version file containing 8.x can now be used to set up the latest stable PHP 8 version. (#​1121)
- name: Checkout
  uses: actions/checkout@v7

- name: Setup PHP from a version file
  uses: shivammathur/setup-php@v2
  with:
    php-version-file: '.php-version'

  • Improved PHP installation on macOS using cached builds from shivammathur/php-darwin. This should improve the setup-php runtime from around a minute to 5-10s.

  • Improved Homebrew extension installation, timeout handling, and retries. (#​1120)

  • Improved PHP installation on Windows using release manifests and cached builds from shivammathur/php-builder-windows.

  • Improved caching and validation of versioned extensions on Linux, macOS, and Windows. (#​1108)

  • Added opt-in support for cached PHP builds on Blacksmith and Depot runners using use_builds_cache environment variable. This is currently experimental and uses the builds cache that we maintain for GitHub hosted runners. (#​1056, #​1129)

- name: Setup PHP with cached builds
  uses: shivammathur/setup-php@v2
  with:
    php-version: '8.5'
  env:
    use_builds_cache: true

  • Switched to Homebrew extension packages for Lua and GEOS extensions on supported macOS PHP versions.

  • Deprecated support for Intel macOS and macOS 14 arm64 runners. It is recommended to upgrade to arm64 based macOS runners (macos-15 or newer). (#​1112)

  • Updated Node.js dependencies and internal GitHub Actions workflows.

For the complete list of changes, please refer to the Full Changelog

Thanks @​kmaeda-rakus, @​jrfnl, @​WendellAdriel, @​damiantw, @​ibrahimlawal-paystack, @​Perlence, and @​Sainan for the contributions.

<h4>Follow for updates</h4> setup-php reddit setup-php twitter setup-php status

v2.37.2

Compare Source

Changelog

  • Fixed macOS setup by marking shivammathur/php and shivammathur/extensions as trusted taps.

  • Switched to Visual Studio 18 (vs18) builds for PHP 8.6 on Windows.

  • Improved looking up environment variables.

  • Tightened security in internal GitHub action workflows.

  • Updated Node.js dependencies.

For the complete list of changes, please refer to the Full Changelog

<h4>Follow for updates</h4> setup-php reddit setup-php twitter setup-php status

stacksjs/action-releaser

v1.2.11

Compare Source

Compare changes

🐛 Bug Fixes

  • release: publish GitHub action directly (0cf36bd) (by Chris <chrisbreuer93@>​gmail.com>)

🧹 Chores

  • release v1.2.11 (fe1e8d5) (by Chris <chrisbreuer93@>​gmail.com>)

Contributors

  • Chris <chrisbreuer93@>​gmail.com>

v1.2.10

Compare Source

svg/svgo (svgo)

v4.1.0

Compare Source

This minor release upgrades the SAX parser and introduces stricter XML validation. It also includes important security hardening for removeScripts, dependency updates, and improvements to the test and regression infrastructure.

Support SVGO

If SVGO is valuable to you or your organization, please consider supporting the project on OpenCollective. Your sponsorship helps fund ongoing maintenance and security work.

Stricter XML validation

SVGO now uses sax 1.6.1, upgraded from 1.5.0 (#​2257).

The new parser version validates numeric character references against the ranges permitted by XML. Invalid references are now rejected in both text and attributes, including:

  • disallowed control characters such as &#&#8203;1;, &#xB;, and &#x1F;;
  • UTF-16 surrogate code points such as &#xD800;;
  • invalid XML code points such as &#xFFFF;.

Valid boundary values—including U+0020, U+D7FF, U+E000, U+FFFD, and characters through U+10FFFF—remain supported.

Parser failures are consistently exposed as SvgoParserError errors with an Invalid character entity reason.

This is an intentional behavior change: malformed SVGs that were previously accepted may now produce a parser error, while valid XML documents are unaffected.

Security

The removeScripts plugin has been hardened against several script-execution bypasses:

  • Filters executable data: URLs containing HTML, XHTML, or SVG documents while preserving inert data such as PNG images, and filters legacy vbscript: URLs (#​2263).
  • Sanitizes content inside SVG <foreignObject> elements by removing HTML event-handler attributes, srcdoc, and executable URLs from action, data, formaction, href, and src, while preserving non-executable HTML and visual content (#​2264).
  • Recognizes namespace-prefixed SVG <a> elements and removes ASCII tabs and newlines before checking URL schemes, preventing values such as java&#&#8203;9;script: from bypassing detection while preserving elements in unrelated custom namespaces (#​2268).

These changes address:

Dependencies
  • Upgraded css-select to v6 and css-what to v7, and updated SVGO's custom selector adapter for css-select v6 (#​2244).
Project maintenance

@​TrySound is back as an active SVGO maintainer.

Many thanks to @​KTibow, @​SethFalco, and @​XhmikosR for maintaining and improving SVGO over the past several years.

Full Changelog: https://github.com/svg/svgo/compare/v4.0.2...v4.1.0

v4.0.2

Compare Source

What's Changed

Security
Bug Fixes
Performance
Other Changes

Configuration

📅 Schedule: (UTC)

  • Branch creation
    • At any time (no schedule defined)
  • Automerge
    • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

  • If you want to rebase/retry this PR, check this box

This PR was generated by Mend Renovate. View the repository job log.

5 changed files on the files tab, with 0 review threads.

Sign in to comment on this pull request.