build: update all non-major dependencies

[angular-robot]

ℹ️ Note

This PR body was truncated due to platform limits.

This PR contains the following updates:

Package	Change	Age	Adoption	Passing	Confidence
@google/genai	2.22.0 → 2.24.0
@microsoft/api-extractor (source)	7.59.1 → 7.59.2
@types/node (source)	24.13.5 → 24.13.6
firebase-tools	15.30.1 → 15.30.2
jsdom	30.0.1 → 30.1.1
pnpm (source)	11.27.0 → 11.27.1
prettier (source)	3.9.7 → 3.9.9
renovate (source)	44.94.0 → 44.109.1
tsx (source)	4.23.13 → 4.23.15
yargs (source)	18.1.0 → 18.2.0

---

• If you want to rebase/retry this PR, check this box

---

Release Notes

googleapis/js-genai (@​google/genai)

v2.24.0

Compare Source

Features

• add sample_audio to Voice in GAOS SDK (d001d18)
• add Voices API resource to GAOS SDK (f97113f)
• expose SpeechMetadata, VoiceConfig.voice, and SpeechAnnotation in public GenAI SDKs (19b7858)
• support field.value_field syntax for map add_union_value annotations. (51d701a)
• update discovery doc (42f9716)
• wire voice into sdk (08b568e)

Bug Fixes

• sanitize path parameter descriptions in GAOS OpenAPI generation (1567962)

v2.23.0

Compare Source

Features

• add credential APIs resource to gaos. (0e6410b)
• Add RetrievalCallStep and RetrievalResultStep to interactions schema and SDKs. (d03d569)
• implement environments files upload and download across Python and TypeScript SDKs (3a4c512)
• support custom fetch in HttpOptions (01897b3)
• wire credential APIs resource to sdk. (280da75)

microsoft/rushstack (@​microsoft/api-extractor)

v7.59.2

Tue, 22 Sep 2026 17:35:41 GMT

Patches

• Update the @microsoft/tsdoc dependency to ~0.17.0 and the @microsoft/tsdoc-config dependency to ~0.18.2.

firebase/firebase-tools (firebase-tools)

v15.30.2

Compare Source

• Improved formatting and user experience for Cloud Functions parameter and secret prompts.
• Updated the Firebase SQL Connect local toolkit to v3.4.20.
• Fixed an issue where 2nd Gen Firebase Authentication triggers (onUserCreated and onUserDeleted) did not work in the local Functions and Auth Emulators.

jsdom/jsdom (jsdom)

v30.1.1

Compare Source

• Fixed spurious window blur and focusout events and incorrect event.relatedTarget values when focusing an element after removing the previously focused element, which regressed in v30.1.0. (@​asamuzaK)
• Fixed focus and blur behavior across frames, and focusing the document's viewport through document.documentElement.focus(). (@​asamuzaK)
• Fixed focus targets removed or disabled by blur listeners becoming active, and text selections made by focus and blur listeners being overwritten. (@​asamuzaK)
• Fixed element.focus() incorrectly focusing disabled form controls and <input type="hidden"> elements with tabindex="". (@​scttcper)
• Fixed invalid style.setProperty() calls changing existing !important priorities, serialized styles, or mutation records. (@​FedgeNo)
• Fixed !important handling when updating CSS longhands after shorthands, using variables or CSS-wide keywords, and assigning style properties directly. (@​FedgeNo)
• Fixed <noscript> parsing with includeNodeLocations: true or inside frames to honor the runScripts option.
• Fixed the storageQuota option being ignored by frames.
• Fixed encoding detection of HTML and XML byte input to honor XML encoding declarations and detect UTF-16 without a byte order mark.
• Fixed exceptions caused by truncated charset parameters in <meta> elements, and encoding detection incorrectly using incomplete <meta> tags. (@​FedgeNo)
• Fixed XML serialization errors for namespaces named constructor, toString, __proto__, or "null", and incorrect reuse of namespace prefixes declared on sibling elements.
• Fixed element.innerHTML and element.outerHTML in XML documents to reject invalid characters in attribute values and avoid stack overflows on large strings.
• Fixed selector matching for :lang(), :nth-child(... of ...) after mutations, and :has() with duplicate IDs or nested logical pseudo-classes. (@​asamuzaK)

v30.1.0

Compare Source

jsdom is feeling the AGI!

This release is dedicated to @​scttcper, who unleashed @​codex upon jsdom and found tons of performance improvements. Along the way, he found and fixed many correctness issues as well.

We really appreciate his thoughtful PRs, which did a great job following the project's contribution guidelines, and were clearly human-curated, with their PR descriptions edited to be brief and respectful of the maintainers' time.

Thanks to @​scttcper, as well as all the other contributors of this release (most of whom were AI-assisted).

• Added named access to elements on document, such as document.myForm for <form name="myForm">. (@​vojtisprime11)
• Added QuotaExceededError, including its use for storage quota errors and oversized crypto.getRandomValues() requests.
• Added support for the relaxed DOM naming rules when creating elements, attributes, and document types.
• Improved performance of DOM construction, tree mutations, range operations, and live collection access, especially on large documents. (@​scttcper, @​erezrokah)
• Improved performance of getComputedStyle(), style changes, and CSS serialization. (@​scttcper, @​jhult)
• Improved performance of event dispatch, form control and label lookups, and updates to <select> elements and radio button groups. (@​scttcper)
• Reduced memory use when creating and working with DOM nodes, attributes, event listeners, and mutation observers. (@​scttcper)
• Changed window.close() to preserve access to the document and its DOM through retained references.
• Fixed element.querySelectorAll() returning no matches when the first part of the selector matches the element itself, which regressed in v30.0.0. (@​asamuzaK)
• Fixed case sensitivity in CSS attribute selectors, including selectors matching data-state="", title="", and other case-sensitive values. (@​asamuzaK)
• Fixed document.querySelector() failing to find a matching element when an earlier element has the same ID but does not match the rest of the selector. (@​vojtisprime11)
• Fixed :focus matching in shadow trees. (@​asamuzaK)
• Fixed DOM insertion and replacement, including valid document.replaceChildren() calls, invalid document element and doctype placements, and mutations during element.replaceWith().
• Fixed the ordering of script execution, custom element callbacks, iframe loading, and mutation observer notifications during DOM insertion, including in shadow trees.
• Fixed queued events and navigation continuing after window.close() or iframe removal, and prevented new scripts, resource loads, timers, and animation frames from starting in destroyed documents. (@​scttcper)
• Fixed parent documents waiting indefinitely for loading to finish when a child iframe removes itself during loading.
• Fixed request cancellation across redirects, during pending requestInterceptor() callbacks, and when reusing an XMLHttpRequest after aborting it.
• Fixed resource loading and JSDOM.fromURL() potentially hanging when response handling throws and response stream cleanup does not finish.
• Fixed successful cached resource loads being treated as aborted.
• Fixed getComputedStyle() and document.styleSheets using the wrong stylesheet order after inserting or updating <style> elements.
• Fixed getComputedStyle() ignoring nested @import and @media rules in imported stylesheets, and returning stale results after imports finish loading.
• Fixed style invalidation, stylesheet removal, and frame source updates in shadow trees.
• Fixed repeated getComputedStyle() calls changing case-sensitive background URLs, and inconsistent resolution of border shorthands containing system colors. (@​scttcper)
• Fixed computed border widths, including borderless elements incorrectly reporting 16px, which regressed in v30.0.0. (@​Alberto-BaseNet)
• Fixed getComputedStyle() to resolve 'font-weight' keywords to numeric values. (@​tianrking)
• Fixed getComputedStyle() to convert lengths to pixels inside CSS math functions containing percentages, and to resolve percentages in 'font-size' math functions. (@​soroushm)
• Fixed serialization of min() and max() containing nested calc(), which regressed in v30.0.0. (@​asamuzaK)
• Fixed CSS values mixing lengths or percentages with math functions, such as 'grid-template-columns' values containing both 100px and calc(). (@​rome-xi)
• Fixed parsing of 'background' and 'border' shorthands with adjacent components, such as url(a.png)no-repeat, including a crash when parsing inline styles. Also fixed handling of invalid shorthand assignments and escaped or unusual characters in CSS declarations. (@​asamuzaK)
• Fixed parsing of unitless zero values in 'flex' shorthands, such as 35 1 0, and rejection of negative 'flex-basis' lengths and percentages. (@​asamuzaK)
• Fixed shorthand style assignments producing extra mutation records and custom element callbacks for intermediate values. (@​scttcper)
• Fixed Range and Selection handling of CDATA sections, including boundary offsets and range cloning, extraction, deletion, insertion, and stringification. (@​scttcper)
• Fixed text.normalize() incorrectly removing the text node or merging its siblings. (@​scttcper)
• Fixed cloning and importing CDATA sections and processing instructions whose contents have been modified, and serialization of CDATA sections adopted into HTML documents.
• Fixed stale named-property collections on window, and incorrect named access from empty or namespaced id="" and name="" values. (@​scttcper)
• Fixed elements in documents created with DOMParser or document.implementation.createHTMLDocument() appearing as named properties on window and being retained in memory. (@​Iaotle)
• Fixed memory leaks from mutation observers retaining observed nodes, abort signals retaining removed event listeners, and storage event tracking retaining closed windows. (@​scttcper)
• Fixed storage events being sent to windows created after the storage change, and ensured surviving recipients still receive events when the source document is destroyed.
• Fixed attribute lookups after namespace prefix changes, and namespaced attributes incorrectly affecting ID lookups and element behavior. (@​scttcper)
• Fixed input.list in detached element trees. (@​scttcper)
• Fixed attr.ownerDocument after setting an attribute node on an element in another document or adopting its element. (@​Kjubikstronk)
• Fixed fresh element.getElementsByTagName() calls using the previous document's case-sensitivity rules after adoption between HTML and XML documents. (@​Kjubikstronk)
• Fixed element.tagName returning stale casing after adoption between HTML and XML documents.
• Fixed radio button grouping and checkedness updates for controls with different form owners, controls outside their form, unnamed controls, and canceled clicks.
• Fixed <select> selection updates when moving options, and unintended selection resets when moving a whole <select> or changing unrelated descendants.
• Fixed cloning <input> elements to preserve input.indeterminate.
• Fixed focus state after removing a focused element or its ancestor, including inside shadow trees.
• Fixed script execution when inserting children into a connected, empty <script>. (@​Kjubikstronk)
• Fixed incorrect script execution after changes to src="", and handling of type="", for="", and event="".
• Fixed document.currentScript during nested script execution and scripts in shadow trees.
• Fixed event dispatch, window.event, and default passive listener handling for non-node event targets, and event dispatch when user code modifies window.constructor.
• Fixed volumechange and ratechange events to fire asynchronously. (@​christianaurichzm)
• Fixed DOM APIs accepting user-created proxies around DOM objects where genuine DOM objects are required.
• Fixed XPath iterator invalidation after DOM mutations and errors for invalid result types.
• Fixed NodeIterator traversal when its filter removes nodes.
• Fixed fileReader.readAsText() to honor the blob's MIME type charset when no supported explicit encoding is supplied.
• Fixed fractional seconds in time input parsing and serialization. (@​Jaybhade)
• Fixed large input.valueAsNumber assignments for time and local date/time inputs.
• Fixed hard wrapping of <textarea> values to use the numeric textarea.cols value.
• Fixed document.readyState to be "complete" for documents created with document.implementation.createDocument() and document.implementation.createHTMLDocument().
• Fixed element.translate for empty translate="" values and elements without a parent.
• Fixed XML parsing of lone surrogates to replace them with the Unicode replacement character.
• Fixed node.lookupNamespaceURI() for the xml and xmlns prefixes. (@​vojtisprime11)
• Fixed <base> elements to ignore data: and javascript: URLs. (@​vojtisprime11)
• Fixed svgElement.viewportElement inside <symbol> elements.
• Fixed the default blobEvent.timecode to be NaN.
• Fixed the object shape and property descriptors of CSS.

pnpm/pnpm (pnpm)

v11.27.1: pnpm 11.27.1

Compare Source

Patch Changes

• pn, pnpx, and pnx now run the pnpm installed alongside them. They used to look pnpm up on PATH. That failed when the directory holding them was not on PATH, and it silently handed the call to an unrelated pnpm when one came first there #​14803.

• The @zkochan/cmd-shim package is now available as @pnpm/bins.cmd-shim.

• pnpm cache list-registries now prints the registry URL, matching pnpm cache view. It printed https%3A+registry.npmjs.org before and prints https://registry.npmjs.org/ now #​15046.

• pnpm deploy no longer installs the dependencies of the workspace root project into the deploy directory #​6437.

• Install warnings no longer carry the text of a package's deprecation notice. The warning names the deprecated package and version, and the pnpm:deprecation event no longer carries the notice either. pnpm view still shows it on request.

  A deprecation warning now names the newest version of the package that is not deprecated, and says when reaching it means widening the range you declared:

  WARN  deprecated foo@1.0.0. 2.3.1 is not deprecated, outside the range you declared.
  

  pnpm works this out from the metadata it already fetched, so it costs no extra request. An install that reuses the lockfile without fetching metadata names no version.

  pnpm strips control characters from the package name and version in a deprecation warning, and from the notice pnpm outdated --long prints.

  The text sanitizer now also strips the Unicode line and paragraph separators U+2028 and U+2029.

• pnpm exec <command> and pnpm <command> run from a subdirectory of a project now find the executables installed in the project's node_modules/.bin. The command still runs in the subdirectory. PNPM_PACKAGE_NAME names the project #​5068.

• pnpm exec and pnpm dlx now wait for the command to finish shutting down after Ctrl+C. A signal sent to pnpm alone now reaches the command, the way it does with pnpm run. pnpm used to exit on the interrupt and terminate the command while it was still shutting down #​7374.

• Warnings about ignored environment variables in project .npmrc credentials now link to the npmrc documentation pnpm/pnpm#15051.

• pnpm audit --interactive --fix=update no longer opens a second prompt for selecting dependencies to update #​14927.

• Fixed pnpm dedupe requiring a second pass after bumping a direct dependency in package.json pnpm/pnpm#14987.

• pnpm deploy now writes plain versions for registry dependencies with peer dependencies in the deployed package.json. The deployed lockfile retains the resolved peer bindings. npm aliases keep their target package names #​14873.

• pnpm publish now allows a detached Git HEAD in CI, including checkouts of release tags. The working tree must still be clean. Branch and remote-history checks still apply when HEAD is attached pnpm/pnpm#5894.

• pnpm dlx and pnx now prompt to approve dependency build scripts in interactive terminals. Cached packages with pending builds also prompt for approval. Without an interactive terminal, use --allow-build to allow the required builds. Fixes pnpm/pnpm#14943.

• pnpm install --force now removes obsolete dependency links inside virtual-store packages when their dependencies change. Invalid dependency names are ignored during obsolete-link cleanup #​15039.

• pnpm add -g and pnpm update -g now ignore incomplete unrelated global package groups when every command from the replaced group is retained. Operations that could remove a global command still require complete ownership information.

• Resolving a Node.js runtime now fails when unofficial-builds.nodejs.org cannot be reached. pnpm used to ignore that failure and leave the musl builds out of pnpm-lock.yaml. pnpm update then wrote a different lockfile on a machine whose network blocks the mirror pnpm/pnpm#14813.

• pnpm now deduplicates a package whose child dependency resolved an optional peer in one workspace project but not in another. Two copies of next could appear when only some projects could reach styled-jsx's optional babel-plugin-macros peer #​14800.

• Fixed shell completion of package scripts for pnpm run and pnpm run-script pnpm/pnpm#15034.

  Bash completion now preserves literal script names containing glob characters and shell punctuation in pnpm v11 and v12.

• pnpm sbom now publishes a valid URL in the CycloneDX externalReferences[].url and the SPDX homepage. An npm shorthand such as vercel/ms or gitlab:group/subgroup/project is expanded to the git+https URL npm derives for it. An scp-style remote such as git@github.com:vercel/ms.git is expanded the same way. Any other URL is published in its normalized form, without embedded credentials. A value that names no repository, an email address for example, is left out. pnpm used to publish the raw value, so a shorthand produced a URL that consumers such as Dependency-Track reject pnpm/pnpm#14773.

• pnpm setup now describes the displayed configuration changes as "the following configuration changes."

• pnpm --version now reports why the pnpm version a project pins cannot be installed or recorded, then prints the version of the running CLI. It used to fail, which made the command unusable where the filesystem is read-only. pnpm --version also honors --store-dir and its --store alias now #​14831.

• pnpm install --force now reinstalls dependencies when the manifest and lockfile are unchanged. It previously reported "Already up to date" without reinstalling. Files changed in node_modules are restored when the store content is intact. Combining --force with --frozen-store now reports a configuration conflict on repeat installs #​919.

• pnpm install now installs git-hosted dependencies without preparing them when their builds are explicitly denied by allowBuilds. Dependencies that require preparation still need an explicit allow or deny decision pnpm/pnpm#10522.

• pnpm runtime set and pnpm env use now use the pnpm version that started the command. They could run a different installed pnpm when the command was started through Corepack or another wrapper.

• The install summary now names the version each dependency resolved to when node-linker is hoisted. It also lists what an install restores after node_modules is deleted, and both sides of a version change. The summary showed the range recorded in package.json, or nothing at all #​15161.

• The @pnpm/npm-lifecycle package is now available as @pnpm/exec.npm-lifecycle.

• Fixed minimumReleaseAge making pnpm download a package's full metadata again on every install. The cached copy carried a validator the registry could not match, so pnpm could never revalidate it pnpm/pnpm#15103.

• pnpm now measures a pnpm.overrides entry written as a bare path, such as ./local-dep, from the directory holding pnpm-workspace.yaml. It used to be measured from each package the override rewrote, so the dependency linked to a directory that does not exist #​11131.

• pnpm now preserves scalar YAML anchors and aliases when editing pnpm-workspace.yaml. Removing the entry that defines an anchor keeps surviving aliases valid. Entries updated to different values are written separately #​8245.

• pnpm now preserves comments and existing key order when updating package.yaml. New keys are appended to their mapping pnpm/pnpm#2008.

• pnpm install --prod no longer downloads the registry packages that only a devDependency reaches #​881.

• pnpm update --global no longer reinstalls a global package when its dependency graph resolves to what is already installed. It reports Already up to date pnpm/pnpm#12002.

• The minimumReleaseAge approval prompt now counts and displays each package version once pnpm/pnpm#15083.

• pnpm run no longer sends a script a second SIGINT when Ctrl+C is pressed in a terminal. A script that shuts down on the first SIGINT and exits at once on a second used to die before its shutdown finished #​7374.

• pnpm now reads a pnpm-workspace.yaml whose tasks section uses a setting only pnpm 12 acts on, such as concurrencyGroup. A task's unrecognized fields are ignored, unless the field only differs in case from concurrency or dependsOn, which pnpm reports as a typo.

  The warning about unrecognized top-level settings now names cargo, concurrencyGroups, and pipelines as pnpm 12 settings.

• pnpm -r list --json now prints one JSON array. It printed a separate array for each project when sharedWorkspaceLockfile was false, so the output could not be parsed.

  pnpm -r list now reads each project's own modules directory when the projects keep their own lockfiles, so --long and --parseable report the packages that project installed #​15011.

• A signal sent to pnpm while it runs without a terminal, as a container runtime or a service manager does, now reaches the script even when the shell running it stays the script's parent. pnpm then waits for the script to finish shutting down. Such a signal used to end the shell at once or stay with it, and the script was never told to stop #​7374.

• Fixed minimumReleaseAge being skipped for packages served by a registry that returns the same ETag for abbreviated and full package metadata pnpm/pnpm#14925.

• pnpm install now returns "Already up to date" in a workspace where dedupeDirectDeps left a project without a node_modules directory of its own. Such a project forced a full install on every run.

• Installs in different projects that share a global virtual store no longer fail on Windows with Access is denied while repairing the same slot #​15114.

• pnpm sbom now emits a license value as a CycloneDX expression only when it is a valid SPDX license expression. Anything else is emitted as a CycloneDX license name pnpm/pnpm#14786.

• A dependency's own bins can no longer take over another package's bin shim. The POSIX shims pnpm generates used to look up their shell helpers on PATH, where a dependency's bins come first #​14837. Reinstalling replaces the shims already in your node_modules. On Cygwin, MSYS2, and WSL the shims still take their Windows path conversion from PATH, so a dependency can still redirect them there.

• POSIX bin shims now convert a Windows-form path such as C:\node_modules\.bin\tsc correctly. The shim mangled the backslashes in such a path and could not reach the package it runs. Installing again replaces the shims already in node_modules #​14867.

• pnpm pack now writes tarball entries grouped by file extension and file name, the order npm uses. Packages that ship many same-named files, such as template collections, pack much smaller #​14766.

• A command run in a project that the workspace does not include now acts on that project alone. A project is outside the workspace when it has a manifest of its own and no pattern in the packages setting selects it, or when a ! pattern excludes it. A directory with no manifest of its own, such as a package's source directory, still belongs to the workspace. pnpm install in an excluded project used to install every project in the workspace #​3561.

• POSIX bin shims now take cygpath and wslpath from the system default path on Cygwin, MSYS2, and WSL2. The shims looked both helpers up on PATH, where a dependency's own bins come first, so a dependency could redirect another package's shim. Installing again replaces the shims already in node_modules #​14866.

• pnpm update and pnpm audit --fix=update no longer copy dependencies added by packageExtensions, a readPackage hook, or an override into package.json. Those dependencies keep the specifier the hook or override gives them. pnpm update --latest no longer resolves past that specifier. pnpm audit --fix=update now warns when one of them pins a vulnerable version. The warning points at pnpm audit --fix #​14928.

Platinum Sponsors

Gold Sponsors

prettier/prettier (prettier)

v3.9.9

Compare Source

diff

Markdown: Fix text with $ been incorrectly parsed as math syntax (#​20140 by @​fisker)

<!-- Input -->
**Uses $FOO** from `a.sh` and `b.sh`, plus `$BAR` from `c.sh`, before anything else runs here.

<!-- Prettier 3.9.8 -->
**Uses $FOO** from `a.sh` and `b.sh`, plus `$BAR`from`c.sh`, before anything else runs here.

<!-- Prettier 3.9.9 -->
**Uses $FOO** from `a.sh` and `b.sh`, plus `$BAR` from `c.sh`, before anything else runs here.

v3.9.8

Compare Source

diff

Markdown: Don't let Liquid objects interrupt paragraphs (#​20087 by @​seiyab)

<!-- Input -->
If `module` is not a [`WebAssembly.Module`](/en-US/docs/WebAssembly/Reference/JavaScript_interface/Module) object instance, a
{{jsxref("TypeError")}} is thrown.

<!-- Prettier 3.9.7 -->
If `module` is not a [`WebAssembly.Module`](/en-US/docs/WebAssembly/Reference/JavaScript_interface/Module) object instance, a

{{jsxref("TypeError")}} is thrown.

<!-- Prettier 3.9.8 -->
If `module` is not a [`WebAssembly.Module`](/en-US/docs/WebAssembly/Reference/JavaScript_interface/Module) object instance, a
{{jsxref("TypeError")}} is thrown.

renovatebot/renovate (renovate)

v44.109.1

Compare Source

Code Refactoring

• http-mock: Remove request tracing (#​44482) (ac2fc77)

Build System

• deps: update dependency prettier to v3.9.7 (main) (#​46411) (41856b2)

v44.109.0

Compare Source

Features

• datasource: add GraalVM version datasource (#​40497) (0d9888a)

Documentation

• move call-to-action lower (#​46410) (854083c)

Miscellaneous Chores

• deps: update dependency @​biomejs/biome to v2.5.14 (main) (#​46409) (87a7f38)

v44.108.2

Compare Source

Bug Fixes

• deps: update ghcr.io/renovatebot/base-image docker tag to v13.99.7 (main) (#​46406) (bdf59d6)

Miscellaneous Chores

• deps: update dependency astral-sh/uv to v0.12.18 (main) (#​46404) (fd6f048)
• deps: update dependency uv to v0.12.18 (main) (#​46405) (1ce7ca2)

v44.108.1

Compare Source

Build System

• deps: update dependency cronstrue to v3.27.0 (main) (#​46399) (4939bce)

v44.108.0

Compare Source

Features

• manager/helmv3: support token-only registry logins (#​46373) (2e23302)

Miscellaneous Chores

• deps: update dependency @​types/node to v24.13.5 (main) (#​46394) (2e0b166)

v44.107.3

Compare Source

Bug Fixes

• datasource: declare metadata as instance fields, not statics (#​46101) (a4b263a)

Code Refactoring

• datasource: add cached() helper to the Datasource base class (#​46102) (1e6ffa8)

v44.107.2

Compare Source

Build System

• deps: update dependency @​renovatebot/pgp to v2.0.2 (main) (#​46390) (c865607)

v44.107.1

Compare Source

Bug Fixes

• versioning: use BigInt to avoid integer precision loss in gradle, maven and loose (#​43901) (96ad4be)
• workers/repository/extract: pass vulnerability alert state to managers (#​46385) (eee64df)

Code Refactoring

• types: Add lockfile-only skip reason (#​46384) (6eedb41)

Tests

• utill/git: add 30s timeout to beforeAll (#​46386) (3b70d5f)

v44.107.0

Compare Source

Features

• manager/mise: support pypi backend (#​46359) (fd5e9f4), closes #​46343

Bug Fixes

• manager/helmv3: share generateHelmEnvs with kustomize (#​46179) (35f44f3)
• manager: share one local Helm chart path check (#​46181) (2169a57)

Documentation

• align colour scheme with Mend colours (#​46316) (fd2c455)

Miscellaneous Chores

• deps: update astral-sh/setup-uv action to v10.2.0 (main) (#​46367) (f2a8dc2)

Code Refactoring

• manager/helmv3: share OCI registry login helper with helmfile (#​46180) (c8ce514)

v44.106.0

Compare Source

Features

• platform: one "read repo file at ref" helper per host (#​46190) (58d9a01)

Code Refactoring

• changelog: derive api base urls from the platform family table (#​46193) (a88aaed)
• changelog: move platform fetchers onto ChangeLogSource (#​46192) (66f6747)
• constants: add a platform family capability table (#​46191) (0583e54)
• http: read platform families instead of the host type aliases (#​46347) (853290d)
• platform: drop the GiteaLikeHttp alias (#​46098) (5fdc338)

v44.105.4

Compare Source

Code Refactoring

• datasource/rpm: remove "gzip" from identifiers (#​46264) (cbe339c)

Build System

• deps: update dependency azure-devops-node-api to v17.0.1 (main) (#​46363) (b31c429)

v44.105.3

Compare Source

Bug Fixes

• manager/gomod: match gofmt-style unindented closing paren in block end regex (#​45781) (87111d8)
• manager/quadlet: make Image optional for volume (#​44959) (75647e2)

Miscellaneous Chores

• docs: fix broken image rendering (#​45893) (1762e24)

v44.105.2

Compare Source

Bug Fixes

• dashboard: handle OSV database fetch failures gracefully (#​46306) (907fa59)

Code Refactoring

• changelog: share the Gitea changelog source with Forgejo ([#&

❗ Important

✂ PR body was truncated to here.

[gemini-code-assist]

Code Review

This pull request performs a series of dependency updates across the repository. Notably, it upgrades "@types/node" from 24.13.5 to 24.13.6 across various packages and local actions, updates the "pnpm" package manager version from 11.27.0 to 11.27.1, and bumps several other dependencies including "@google/genai", "firebase-tools", "prettier", "tsx", "yargs", and "jsdom". The lockfiles have been regenerated to reflect these changes. I have no feedback to provide as there are no review comments.

[alan-agius4]

This PR was merged into the repository. The changes were merged into the following branches:

• main: a98a0a6