Skip to content

Update non-major dependencies - #4

Closed
renovate[bot] wants to merge 1 commit into
mainfrom
renovate/non-major-dependencies
Closed

Update non-major dependencies#4
renovate[bot] wants to merge 1 commit into
mainfrom
renovate/non-major-dependencies

Conversation

@renovate

@renovate renovate Bot commented Jun 29, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

ℹ️ Note

This PR body was truncated due to platform limits.

This PR contains the following updates:

Package Change Age Confidence Type Update Pending
@a2a-js/sdk ^0.3.12 → ^0.3.14 age confidence dependencies patch
@types/express (source) ^5.0.0 → ^5.0.6 age confidence devDependencies patch
@types/node (source) ^22.0.0 → ^22.20.1 age confidence devDependencies minor
express (source) ^5.1.0 → ^5.2.1 age confidence dependencies patch
node (source) >=18 → >=18.20.8 age confidence engines minor
node 20 → 20.20.2 age confidence uses-with minor
tsx (source) ^4.19.0 → ^4.23.11 age confidence devDependencies minor 4.23.12
typescript (source) ^5.7.0 → ^5.9.3 age confidence devDependencies patch
viem (source) ^2.0.0 → ^2.55.11 age confidence dependencies minor 2.55.19 (+5)
ws 8.21.0 → 8.21.3 age confidence overrides patch

Release Notes

a2aproject/a2a-js (@​a2a-js/sdk)

v0.3.14

Compare Source

Bug Fixes

v0.3.13

Compare Source

Bug Fixes
nodejs/node (node)

v18.20.8: 2025-03-27, Version 18.20.8 'Hydrogen' (LTS), @​richardlau

Compare Source

Notable Changes

This release updates OpenSSL to 3.0.16 and root certificates to NSS 3.108.

Commits

v18.20.7: 2025-02-20, Version 18.20.7 'Hydrogen' (LTS), @​aduh95

Compare Source

Notable Changes
Commits

v18.20.6: 2025-01-21, Version 18.20.6 'Hydrogen' (LTS), @​RafaelGSS

Compare Source

This is a security release.

Notable Changes
  • CVE-2025-23085 - src: fix HTTP2 mem leak on premature close and ERR_PROTO (Medium)
  • CVE-2025-23084 - path: fix path traversal in normalize() on Windows (Medium)

Dependency update:

  • CVE-2025-22150 - Use of Insufficiently Random Values in undici fetch() (Medium)
Commits

v18.20.5: 2024-11-12, Version 18.20.5 'Hydrogen' (LTS), @​aduh95

Compare Source

Notable Changes
  • [ac37e554a5] - esm: mark import attributes and JSON module as stable (Nicolò Ribaudo) #​55333
Commits

v18.20.4: 2024-07-08, Version 18.20.4 'Hydrogen' (LTS), @​RafaelGSS

Compare Source

This is a security release.

Notable Changes
Commits

v18.20.3: 2024-05-21, Version 18.20.3 'Hydrogen' (LTS), @​richardlau

Compare Source

Notable Changes

This release fixes a regression introduced in Node.js 18.19.0 where http.server.close() was incorrectly closing idle connections.

A fix has also been included for compiling Node.js from source with newer versions of Clang.

The list of keys used to sign releases has been synchronized with the current list from the main branch.

Updated dependencies
  • acorn updated to 8.11.3.
  • acorn-walk updated to 8.3.2.
  • ada updated to 2.7.8.
  • c-ares updated to 1.28.1.
  • corepack updated to 0.28.0.
  • nghttp2 updated to 1.61.0.
  • ngtcp2 updated to 1.3.0.
  • npm updated to 10.7.0. Includes a fix from npm@​10.5.1 to limit the number of open connections npm/cli#7324.
  • simdutf updated to 5.2.4.
  • zlib updated to 1.3.0.1-motley-7d77fb7.
Commits

v18.20.2: 2024-04-10, Version 18.20.2 'Hydrogen' (LTS), @​RafaelGSS

Compare Source

This is a security release.

Notable Changes
  • CVE-2024-27980 - Command injection via args parameter of child_process.spawn without shell option enabled on Windows
Commits

v18.20.1: 2024-04-03, Version 18.20.1 'Hydrogen' (LTS), @​RafaelGSS

Compare Source

This is a security release.

Notable Changes
  • CVE-2024-27983 - Assertion failed in node::http2::Http2Session::~Http2Session() leads to HTTP/2 server crash- (High)
  • CVE-2024-27982 - HTTP Request Smuggling via Content Length Obfuscation - (Medium)
  • llhttp version 9.2.1
  • undici version 5.28.4
Commits

v18.20.0: 2024-03-26, Version 18.20.0 'Hydrogen' (LTS), @​richardlau

Compare Source

Notable Changes
Added support for import attributes

Support has been added for import attributes, to replace the old import
assertions syntax. This will aid migration by making the new syntax available
across all currently supported Node.js release lines.

This adds the with keyword which should be used in place of the previous
assert keyword, which will be removed in a future semver-major Node.js
release.

For example,

import "foo" assert { ... }

should be replaced with

import "foo" with { ... }

For more details, see

Contributed by Nicolò Ribaudo in #​51136
and Antoine du Hamel in #​50140.

Doc deprecation for dirent.path

Please use newly added dirent.parentPath instead.

Contributed by Antoine du Hamel in #​50976
and #​51020.

Experimental node-api feature flags

Introduces an experimental feature to segregate finalizers that affect GC state.
A new type called node_api_nogc_env has been introduced as the const version
of napi_env and node_api_nogc_finalize as a variant of napi_finalize that
accepts a node_api_nogc_env as its first argument.

This feature can be turned off by defining
NODE_API_EXPERIMENTAL_NOGC_ENV_OPT_OUT.

Contributed by Gabriel Schulhof in #​50060.

Root certificates updated to NSS 3.98

Certificates added:

  • Telekom Security TLS ECC Root 2020
  • Telekom Security TLS RSA Root 2023

Certificates removed:

  • Security Communication Root CA
Updated dependencies
  • ada updated to 2.7.6.
  • base64 updated to 0.5.2.
  • c-ares updated to 1.27.0.
  • corepack updated to 0.25.2.
  • ICU updated to 74.2. Includes CLDR 44.1 and Unicode 15.1.
  • npm updated to 10.5.0. Fixes a regression in signals not being passed onto child processes.
  • simdutf8 updated to 4.0.8.
  • Timezone updated to 2024a.
  • zlib updated to 1.3.0.1-motley-40e35a7.
vm: fix V8 compilation cache support for vm.Script

Previously repeated compilation of the same source code using vm.Script
stopped hitting the V8 compilation cache after v16.x when support for
importModuleDynamically was added to vm.Script, resulting in a performance
regression that blocked users (in particular Jest users) from upgrading from
v16.x.

The recent fixes allow the compilation cache to be hit again
for vm.Script when --experimental-vm-modules is not used even in the
presence of the importModuleDynamically option, so that users affected by the
performance regression can now upgrade. Ongoing work is also being done to
enable compilation cache support for vm.CompileFunction.

Contributed by Joyee Cheung in #​49950
and #​50137.

Commits

✂ Note

PR body was truncated to here.

Configuration

📅 Schedule: (UTC)

  • Branch creation
    • "before 12:00 on Monday"
  • Automerge
    • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

  • If you want to rebase/retry this PR, check this box

This PR was generated by Mend Renovate. View the repository job log.

@renovate
renovate Bot force-pushed the renovate/non-major-dependencies branch 2 times, most recently from 8d7032c to d5f44d5 Compare July 4, 2026 13:31
@renovate
renovate Bot force-pushed the renovate/non-major-dependencies branch 6 times, most recently from b47ec43 to 922ac47 Compare July 20, 2026 10:02
@renovate
renovate Bot force-pushed the renovate/non-major-dependencies branch 6 times, most recently from 9850fc2 to af82954 Compare July 28, 2026 18:12
@renovate
renovate Bot force-pushed the renovate/non-major-dependencies branch 4 times, most recently from da3f61c to 0d1ee5c Compare August 6, 2026 05:50
@renovate
renovate Bot force-pushed the renovate/non-major-dependencies branch 3 times, most recently from 816479c to ecef2e5 Compare August 17, 2026 02:05
@renovate
renovate Bot force-pushed the renovate/non-major-dependencies branch 7 times, most recently from cc600f9 to dc89d26 Compare August 21, 2026 06:30
@renovate
renovate Bot force-pushed the renovate/non-major-dependencies branch from dc89d26 to 9831cf3 Compare August 21, 2026 17:45
Ectsang added a commit that referenced this pull request Aug 31, 2026
@Ectsang
Clear the dependency backlog and exact-pin; hold the a2a-js SDK major
f69a77b 
Four of five Renovate PRs applied together in one verified commit. Every dep
moved off caret ranges to exact pins, per house convention.

- @a2a-js/sdk ^0.3.12 to 0.3.14 (patch within the current major)
- express ^5.1.0 to 5.2.1, viem ^2.0.0 to 2.56.0 (#4). This also clears a low
  advisory in body-parser, where an invalid limit value silently disabled request
  size enforcement; npm audit now reports 0 vulnerabilities.
- @types/express ^5.0.0 to 5.0.6, @types/node ^22.0.0 to 24.13.3, tsx ^4.19.0 to
  4.23.13, typescript ^5.7.0 to 7.0.2 (#8), all verified by a clean typecheck.
- actions/checkout v4 to v7 (#6), actions/setup-node v4 to v7 (#9), workflow
  node-version 20 to 24.

NOT taken: @a2a-js/sdk v1 (#10). It is a breaking migration, not a bump. Against
1.1.0 the code produces 20+ type errors: stream event kinds are renamed
("status-update" to "statusUpdate", "artifact-update" to "artifactUpdate"),
TextPart and DataPart are no longer exported, Part loses its `kind` discriminant,
and AgentCapabilities and AgentSkill change shape (stateTransitionHistory gone,
securityRequirements now required). That deserves its own commit with the
executor and client rewritten and exercised, so #10 stays open.

Verified: typecheck clean, npm audit reports 0 vulnerabilities, and the server
still fails closed on missing AGENT_PRIVATE_KEY rather than booting unconfigured.
@Ectsang

Ectsang commented Sep 6, 2026

Copy link
Copy Markdown
Member

Applied on main in f69a77b with exact pins rather than caret ranges. Superseded.

@Ectsang Ectsang closed this Sep 6, 2026
@Ectsang
Ectsang deleted the renovate/non-major-dependencies branch September 6, 2026 03:25
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

1 participant

@Ectsang