Update all non-major dependencies - #527
Open
renovate[bot] wants to merge 1 commit into
Open
Conversation
Deploying bats-ai with
|
| Latest commit: |
1764d48
|
| Status: | ✅ Deploy successful! |
| Preview URL: | https://b0e5984d.bats-ai.pages.dev |
| Branch Preview URL: | https://renovate-all-minor-patch.bats-ai.pages.dev |
renovate
Bot
force-pushed
the
renovate/all-minor-patch
branch
5 times, most recently
from
August 7, 2026 17:56
f206a39 to
ec884c8
Compare
renovate
Bot
force-pushed
the
renovate/all-minor-patch
branch
11 times, most recently
from
August 15, 2026 05:03
2d8a506 to
5cc482d
Compare
renovate
Bot
force-pushed
the
renovate/all-minor-patch
branch
5 times, most recently
from
August 21, 2026 06:10
844d33c to
29b37cf
Compare
renovate
Bot
force-pushed
the
renovate/all-minor-patch
branch
6 times, most recently
from
August 27, 2026 16:32
7491fe3 to
4fc2c4a
Compare
renovate
Bot
force-pushed
the
renovate/all-minor-patch
branch
from
August 29, 2026 09:02
4fc2c4a to
1764d48
Compare
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
This PR contains the following updates:
10.68.0→10.71.010.72.01.18.1→1.20.0==65.18.0→==65.19.1==1.6.2→==1.6.3==3.4.0→==3.4.1==40.36.0→==40.37.0==9.15.0→==9.16.19.17.03.3.0→3.4.0==2.5.1→==2.5.2==4.13.0.92→==4.14.0.94==1.18.0→==1.18.1==2.66.1→==2.68.1==4.69.1→==4.70.03.5.40→3.5.413.5.423.12.11→3.13.2Release Notes
getsentry/sentry-javascript (@sentry/vue)
v10.71.0Compare Source
Important Changes
The
enableLogsclient option now defaults totrue, so Sentry Logs work without any manual opt-in. Nothing is captured unless you call theSentry.logger.*APIs or add a log-forwarding integration (such asconsoleLoggingIntegration,pinoIntegration, or the winston transport), and you can setenableLogs: falseto opt out. Although a default change like this would normally land in a major release, we are shipping it in a minor after careful consideration, since it sends no data on its own and only takes effect once you actively use the logging APIs or a logging integration.Other Changes
scope.clear()method (#23231)Headersinstances (#23241)captureExceptionfrom scope, not fromClient(#23280)Internal Changes
Bundle size 📦
v10.70.0Compare Source
@sentry/node-cpu-profilerto 2.4.3 (#22992)@solidjs/routerv1 (#23163)onRequestpath (#22985)beforeSendwhile preserving session updates (#22819)meriyahissue forstandalonebuild (#23055)sourcemaps.disablewhenunstable_sentryVitePluginOptionsis set (#22966)<Routes>unmount (#22948)metricsfrom worker entry point (#23027)Internal Changes
@sentry/coredep to nextjs-16-userfeedback (#23009)sveltekit-3test (#23016)Work in this release was contributed by @davidmurdoch, @Jxxunnn, and @kamilogorek. Thank you for your contributions!
Bundle size 📦
v10.69.0Compare Source
Important Changes
instrumentAgentWithSentryfor Cloudflare Agents (#22786)The Cloudflare SDK adds a new
instrumentAgentWithSentryAPI for Cloudflare Agents. It works likeinstrumentDurableObjectWithSentryforAgentclasses from theagentsSDK and additionally creates spans for@callableRPC methods and automatically sets theconversationIdbased on the agent's name. When building with the Sentry Vite plugin, Agents are instrumented automatically (#22788).Other Changes
CREATE INDEXspans oncf_-prefixed tables (#22767)cf_spans stay filtered (#22766)sentry.originon logs fromSentryEffectLogger(#22806)@apm-js-collab/code-transformer-bundler-plugins(#22678)Internal Changes
Bundle size 📦
axios/axios (axios)
v1.20.0Compare Source
v1.20.0 — August 19, 2026
This release hardens runtime option handling, adds RFC 9110 status-code aliases, fixes Node.js and XHR reliability issues, and refreshes project tooling and documentation.
🔒 Security Fixes
🐛 Bug Fixes
🔧 Maintenance & Chores
🌟 New Contributors
We are thrilled to welcome our new contributors. Thank you for helping improve axios:
Full Changelog (axios/axios@v1.19.0...v1.20.0)
v1.19.0Compare Source
This release raises the form-data security floor, adds configuration and type-system capabilities, and fixes NO_PROXY matching, interceptor errors, progress reporting, and serialization edge cases.
allauth/django-allauth (django-allauth)
v65.19.1Compare Source
v65.19.0Compare Source
vitalik/django-ninja (django-ninja)
v1.6.3: 1.6.3Compare Source
What's Changed
Hotfix release cut from v1.6.2 — contains only the changes above, none of the other work currently on master.
Full Changelog: vitalik/django-ninja@v1.6.2...v1.6.3
django-oauth/django-oauth-toolkit (django-oauth-toolkit)
v3.4.1Compare Source
This release is dominated by security hardening of redirect URI matching, token revocation and
refresh token handling. Several entries below change behavior that was previously accepted, and
they are spread across Fixed and Security: the "Upgrading to 3.4.1" section of the
Upgrading guide collects everything you need to act on in one place, so start there. Of particular
note: redirect URIs are now matched exactly per
RFC 9700 §2.1, so a request may no
longer carry query parameters, path parameters, credentials or a fragment that the registered URI
does not have;
REFRESH_TOKEN_EXPIRE_SECONDS, where set, is now enforced when a refresh token ispresented rather than only by the
cleartokenssweep; and the built-in templates now link astylesheet shipped with the package instead of a CDN, so run
collectstaticor the pages renderunstyled.
Added
oauth2_providerlogger atDEBUG,reporting the requested URI, every registered candidate it was compared against, and which
component of each one differed (scheme, hostname, port, path, query). The same detail is
emitted for
post_logout_redirect_uriand for the token endpoint's comparison against theURI recorded on the grant. The error response is unchanged: the registered URIs are never
disclosed to the requester, only to the server's log. See "Debugging redirect URI
mismatches" in the documentation. Note that
AbstractApplication.redirect_uri_allowed()and
post_logout_redirect_uri_allowed()now call the newcheck_redirect_to_uri_allowed()(same verdict, plus the mismatch reasons) instead of
redirect_to_uri_allowed(), so codethat wrapped or patched the latter to influence those methods must target the former.
oauth2_provider.W011) that warns when theAccessTokenandRefreshTokenmodels are swapped into different apps, and a new"Extending the token models" documentation section explaining how to swap the
interrelated token models together.
the authorization-code flow under a strict
form-actionContent Security Policy, whichChromium enforces against the post-authorization redirect to the client's
redirect_uri.TokenHasResourceScopechecks each
required_scopesentry suffixed with theREAD_SCOPE/WRITE_SCOPEsettingvalue (defaults
read/write, e.g.music:read,music:write), so a baremusicscopeis rejected; with the default settings-based scopes backend the suffixed scopes must be
declared in
SCOPES.every release that needs them — 2.0, 3.0 and this release — linked from the documentation index,
so upgrade guidance is discoverable outside the CHANGELOG. A release that asks nothing of you has
no section there, so a gap between two versions is an answer rather than an omission.
settings-driven scopes backend via
SCOPES_BACKEND_CLASS, including a worked model-basedexample that stores scopes in the database.
admin site for applications and issued tokens, including client-secret hashing, credential
masking, and that tokens cannot be created by hand.
gettext_lazy)verbose_namelabels on every field of theApplication,Grant,AccessToken,RefreshToken,IDTokenandDeviceGrantmodels, sothe Django admin and the authorization UI can be localized. Migration
oauth2_provider.0021_translatable_field_labelsrecords the label changes; it makes nodatabase schema changes.
Deprecated
JSONOAuthLibCore(OAUTH2_PROVIDER["OAUTH2_BACKEND_CLASS"]set tooauth2_provider.oauth2_backends.JSONOAuthLibCore) is deprecated and now emits aDeprecationWarning. It makes the OAuth token, introspection, andrevocation endpoints read
application/jsonbodies, but those endpoints are defined touse
application/x-www-form-urlencoded(RFC 6749, RFC 7662, RFC 7009); the JSON mode isnon-standard and breaks interoperability with spec-compliant clients. It is scheduled for
removal in 4.0.
Changed
Application.clean()now reports its validation errors per field instead of asnon-field errors, and reports all of them at once instead of stopping at the first
problem. The application forms (the built-in registration/edit views and the Django
admin) render each message next to the offending input — a rejected redirect URI on
redirect_uris, a non-https CORS origin onallowed_origins, an unusable algorithm onalgorithm, and the HS256 client-secret conflicts onclient_secret/hash_client_secret.ValidationError.message_dictis keyed by those field names, socallers of
Application.full_clean()(including dynamic client registration and CIMD)now surface the field name alongside the message. A custom
ModelFormthat omits one ofthose fields still gets the message as a non-field error, provided it subclasses
oauth2_provider.forms.ApplicationForm.third-party CDN.
oauth2_provider/base.htmlnow links a small stylesheet distributedwith the package (
static/oauth2_provider/css/oauth2_provider.css), which also absorbsthe inline
<style>block that template carried. The built-in pages therefore render inair-gapped installs and under a strict Content Security Policy such as
default-src 'self', which blocks a foreign style host and an inline style block alike,and the authorization page no longer makes an unpinned (no Subresource Integrity)
third-party request while the user is making a consent decision. The stylesheet is served
through
staticfiles, so runcollectstaticfor the pages to be styled. The Bootstrap 2class names used by the templates are unchanged, and the
cssblock ofbase.htmlisstill the supported way to substitute your own styles.
AccessTokenandRefreshTokenadmins now invalidate tokens through a "Revoke selected"action instead of raw delete (delete is disabled on those two admins). A raw delete of an access
token left its bound refresh token behind (
RefreshToken.access_tokenisSET_NULL) — an orphanthat could still mint new access tokens — and a raw delete of a refresh token discarded the
revoked tombstone that
REFRESH_TOKEN_REUSE_PROTECTIONrelies on. The revoke action invalidatesthe whole token family consistently; expired rows are still pruned by
cleartokens.GrantandIDTokenadmins keep the default delete. The access-token revoke logic is now a single sharedoauth2_provider.models.revoke_access_token()helper used by the admin action, the/revoke/endpoint, and
AuthorizedTokenDeleteView.cleartokensmanagement command now prints a warning to stderr whenREFRESH_TOKEN_EXPIRE_SECONDSis unset (or0), explaining that only revoked andorphaned refresh tokens are removed and that expired access/ID tokens still bound to a
refresh token are retained until that refresh token is gone. The management-command docs
were clarified to match.
/revoke/endpoint) now also revokesthe refresh token bound to it, matching the admin "delete access token" view and
RFC 7009 §2.1. Previously the refresh token survived and could immediately mint a new
access token, defeating the revocation and leaving the refresh token an active "orphan"
(its
access_tokenforeign key isSET_NULL). Whether a refresh token may surviveaccess-token revocation will become a configurable policy in 4.0.
REFRESH_TOKEN_EXPIRE_SECONDSas defense-in-depth (rotation remains the primarymitigation), and document why
OIDC_RP_INITIATED_LOGOUT_ACCEPT_EXPIRED_TOKENSdefaultsto
True(theid_token_hintis a previously issued token per OIDC RP-Initiated Logout)and how to harden it.
Fixed
AccessToken,IDToken, andRefreshTokenmodels arerouted to a single database is now registered under the
modelstag instead ofdatabase.Django 6.1 stopped running
database-tagged checks unless a database alias is passedexplicitly (
manage.py check --database default), because such checks may do more thanstatic analysis; this one only asks the configured routers where the token models would be
written and never opens a connection, so under the old tag a plain
manage.py checkwouldhave silently stopped reporting a cross-database token configuration on Django 6.1.
REFRESH_TOKEN_REUSE_PROTECTIONnow revokes a compromised token family as a setinstead of one row at a time. A rotating client keeps every refresh token it has ever been
issued in the same family, so the old per-row loop cost one
SELECT ... FOR UPDATEroundtrip per token in the family, paid again on every replay of the stale token: a client stuck
on a retry timer could hold a worker and a database connection for tens of seconds per
request. The sweep now runs in a fixed number of queries whatever the size of the family,
through the new
AbstractRefreshToken.revoke_family(), andtoken_familyis indexed(migration
0022_refreshtoken_token_family_index) so it no longer scans the whole refreshtoken table. What gets revoked is unchanged: every live member of the family, and the
family's access tokens. If you swap in your own refresh token model, run
makemigrationstopick up the index, and if you override
revoke()overriderevoke_family()to match.Such a scheme has no naming authority, so only a single slash follows it
(
com.example.app:/oauth2redirect), butApplication.clean()reassembled every URI with://before validating and rejected the result with "Enter a valid URL." — leaving nativeapps no way to register the form the RFC prescribes and their clients actually send. The
double-slash variant was not a workaround: the two spellings parse to different hostnames
and produce
redirect_uri_mismatchagainst each other. Schemes that require an authority(
http,https,ws,wss,ftp) must still include a host, and the redundantcom.example.app:///oauth2redirectand rootlesscom.example.app:oauth2redirectspellingsare rejected so that each callback has one canonical registration (RFC 9700 §2.1).
Upgrade note: the rootless spelling was previously accepted, but the same reassembly
rewrote it to
com.example.app://oauth2redirect— registeringoauth2redirectas ahostname, which no client matches. It is now rejected at registration instead of
Configuration
📅 Schedule: (UTC)
* 0-3 1 * *)🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.
♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.
👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.
This PR was generated by Mend Renovate. View the repository job log.