chore(deps): update all non-major dependencies

[renovate]

This PR contains the following updates:

Package	Change	Age	Confidence	Type	Update
github.com/aws/aws-sdk-go-v2	v1.43.0 → v1.43.1			indirect	patch
github.com/aws/aws-sdk-go-v2/aws/protocol/eventstream	v1.7.14 → v1.7.15			indirect	patch
github.com/aws/aws-sdk-go-v2/config	v1.32.31 → v1.32.32			indirect	patch
github.com/aws/aws-sdk-go-v2/credentials	v1.19.30 → v1.19.31			indirect	patch
github.com/aws/aws-sdk-go-v2/feature/ec2/imds	v1.18.31 → v1.18.32			indirect	patch
github.com/aws/aws-sdk-go-v2/internal/configsources	v1.4.31 → v1.4.32			indirect	patch
github.com/aws/aws-sdk-go-v2/internal/endpoints/v2	v2.7.31 → v2.7.32			indirect	patch
github.com/aws/aws-sdk-go-v2/internal/v4a	v1.4.32 → v1.4.33			indirect	patch
github.com/aws/aws-sdk-go-v2/service/internal/accept-encoding	v1.13.13 → v1.13.14			indirect	patch
github.com/aws/aws-sdk-go-v2/service/internal/checksum	v1.9.24 → v1.9.25			indirect	patch
github.com/aws/aws-sdk-go-v2/service/internal/presigned-url	v1.13.31 → v1.13.32			indirect	patch
github.com/aws/aws-sdk-go-v2/service/internal/s3shared	v1.19.32 → v1.19.33			indirect	patch
github.com/aws/aws-sdk-go-v2/service/s3	v1.106.0 → v1.106.1			indirect	patch
github.com/aws/aws-sdk-go-v2/service/signin	v1.5.0 → v1.5.1			indirect	patch
github.com/aws/aws-sdk-go-v2/service/sso	v1.33.0 → v1.33.1			indirect	patch
github.com/aws/aws-sdk-go-v2/service/ssooidc	v1.38.0 → v1.38.1			indirect	patch
github.com/aws/aws-sdk-go-v2/service/sts	v1.45.0 → v1.45.1			indirect	patch
github.com/aws/smithy-go	v1.27.4 → v1.27.5			indirect	patch
github.com/hashicorp/aws-sdk-go-base/v2	v2.0.0-beta.73 → v2.0.0-beta.74			indirect	patch
github.com/planetscale/vtprotobuf	0393e58 → 8ae5a48			indirect	digest
go.yaml.in/yaml/v3	v3.0.4 → v3.0.5			require	patch
golang.org/x/exp	764159d → b88d891			indirect	digest
google.golang.org/api	v0.290.0 → v0.291.0			indirect	minor
google.golang.org/genproto	b2f2020 → 6c54ddd			indirect	digest
google.golang.org/genproto/googleapis/api	b2f2020 → 6c54ddd			indirect	digest
google.golang.org/genproto/googleapis/rpc	b2f2020 → 6c54ddd			indirect	digest
mvdan.cc/sh/moreinterp	dccf23f → 58a8c02			require	digest
mvdan.cc/sh/v3	dccf23f → 58a8c02			require	digest
netlify-cli	27.0.0 → 27.0.1			devDependencies	patch
pnpm (source)	11.17.0+sha512.cca3cea332ad254bb84145f966d19f4879615210346fc92c79a047f23a0d7b3cca3c3792f0076ba1f1831d277efbcf0a9119b31a9a60eca7fb3d6231f331ef72 → 11.18.0			packageManager	minor
pnpm (source)	11.17.0 → 11.18.0				minor
vitepress-plugin-group-icons	1.7.5 → 1.7.6			devDependencies	patch
vitepress-plugin-llms	1.13.3 → 1.13.4			devDependencies	patch

---

Release Notes

aws/aws-sdk-go-v2 (github.com/aws/aws-sdk-go-v2)

v1.43.1

Compare Source

General Highlights

• Dependency Update: Updated to the latest SDK module versions

Module Highlights

• github.com/aws/aws-sdk-go-v2/service/acm: v1.32.0
  • Feature: Add support for file-based HTTP domain control validation, available through Amazon CloudFront.
• github.com/aws/aws-sdk-go-v2/service/cloudfront: v1.46.0
  • Feature: Add distribution tenant, connection group, and multi-tenant distribution APIs to the CloudFront SDK.
• github.com/aws/aws-sdk-go-v2/service/dynamodb: v1.43.1
  • Documentation: Doc only update for GSI descriptions.
• github.com/aws/aws-sdk-go-v2/service/imagebuilder: v1.42.0
  • Feature: Add integration with SSM Parameter Store to Image Builder.
• github.com/aws/aws-sdk-go-v2/service/internal/checksum: v1.7.1
  • Bug Fix: Don't emit warnings about lack of checksum validation for non-200 responses.

aws/smithy-go (github.com/aws/smithy-go)

v1.27.5

Compare Source

General Highlights

• Dependency Update: Updated to the latest SDK module versions

Module Highlights

• github.com/aws/smithy-go: v1.27.5
  • Bug Fix: Fix a performance issue in awsQuery with large response payloads.

hashicorp/aws-sdk-go-base (github.com/hashicorp/aws-sdk-go-base/v2)

v2.0.0-beta.74

Compare Source

ENHANCEMENTS

• Reduces memory allocation in logging. (#​1496)

BUG FIXES

• Updates dependencies.

yaml/go-yaml (go.yaml.in/yaml/v3)

v3.0.5

Compare Source

googleapis/google-api-go-client (google.golang.org/api)

v0.291.0

Compare Source

Features

• all: Auto-regenerate discovery clients (#​3666) (e3721ba)
• all: Auto-regenerate discovery clients (#​3670) (4067374)
• all: Auto-regenerate discovery clients (#​3674) (432658c)
• all: Auto-regenerate discovery clients (#​3676) (9998a11)
• all: Auto-regenerate discovery clients (#​3678) (b5c5526)
• all: Auto-regenerate discovery clients (#​3679) (499d9b1)

Bug Fixes

• transport: Use ds.GetUniverseDomain() instead of raw ds.UniverseDomain field (#​3660) (6bad358)

netlify/cli (netlify-cli)

v27.0.1

Compare Source

Bug Fixes

• allow --site-id as a silent flag to prevent common guessing mistakes from agents (#​8180) (4984c3c)
• api: teach instead of leaking SyntaxError on malformed --data (#​8333) (6e0298c)
• deps: update dependency @​netlify/blobs to ^10.7.10 (#​8375) (3bc357a)
• deps: update dependency @​netlify/images to ^1.3.11 (#​8376) (e0ebaf5)
• deps: update dependency readdirp to v5 (#​8012) (12645a8)
• deps: update netlify packages (major) (#​8322) (0d36749)
  • Vite Plus projects are now detected and configured automatically: netlify/build#7128
  • Fixes a bug in the Frameworks API where .netlify/v1/config.json#edge_functions was not respected: netlify/build#7125

pnpm/pnpm (pnpm)

v11.18.0: pnpm 11.18

Compare Source

Minor Changes

• Fixed an installed optional dependency being left without one of its own required dependencies. When a package reached through optionalDependencies is installable on the current system but one of its regular dependencies is not, a lockfile-based install skipped that dependency and installed the parent anyway, so importing the parent failed with MODULE_NOT_FOUND. The dependency is now installed, and an install-check warning reports the incompatibility. A dependency is still only skipped when every path to it is optional, or when the package that pulls it in was itself skipped #​13286.

• pnpm setup now appends PNPM_HOME and the global bin directory to the GitHub Actions environment files (GITHUB_ENV and GITHUB_PATH), so later steps in the same job can run pnpm add --global and other global commands #​9191.

• Added support for publishConfig.name, which publishes a package under a different name than the one its manifest carries in the workspace. It is for a project whose published name is already taken by a sibling project, which otherwise has to be renamed by a build step just before publishing. Only the published artifact is renamed — dependents, pnpm-lock.yaml, and release tooling keep addressing the project by its manifest name — and the new name reaches the packed manifest, the tarball filename, and everything that addresses the package at the registry: the already-published check of pnpm publish -r, its registry selection, and the release-planning probes of pnpm change status and pnpm version -r #​13345.

• pnpm self-update no longer takes any instruction from the project it is run in:

  • pnpm is fetched through the same trusted registry and auth configuration used when switching pnpm versions, so a project .npmrc or pnpm-workspace.yaml can no longer redirect the download or attach credentials to it, and the project's default .pnpmfile.(c|m)js is no longer loaded. Pnpmfiles from trusted sources (the pnpmfile setting, the global pnpmfile, config dependencies) still apply.
  • The minimumReleaseAge settings in pnpm-workspace.yaml no longer affect self-update. They still govern the project's own dependencies; for self-update the cooldown now comes from the built-in default, your global config, a PNPM_CONFIG_* environment variable, or a command-line flag. This fixes self-update failing inside a workspace that raises the cutoff while succeeding everywhere else, and stops a repository from either waiving the cooldown or keeping you on an outdated pnpm by raising it.
  • The same applies to the trustPolicy settings and to ci: a project can no longer weaken the trust check that guards the pnpm download, nor re-enable the confirmation prompt that a CI run suppresses.

  When self-update refuses a version that is younger than the cutoff, an interactive run now offers to update anyway; non-interactive runs still fail. CI never prompts, even on a runner that attaches a TTY.

Patch Changes

• Fixed pnpm licenses list to report every version when the same package is installed under multiple aliases pnpm/pnpm#13438.

• Sort pnpm dedupe --check snapshot changes for stable output across pnpm implementations.

• Strip Unicode formatting characters from registry- and manifest-derived terminal output.

• Speed up installs after compatible catalog or direct dependency range changes by retaining the locked version without resolving the dependency graph again.

• Speed up installs after safe override changes by reusing unambiguous compatible dependency resolutions, pruning obsolete dependencies, applying independent replacements and removals together, and handling parent-scoped "-" overrides without full lockfile resolution.

• Installing a local file: directory dependency with the global virtual store enabled no longer fails with TypeError: Cannot read properties of undefined (reading 'split') #​13335.

  Local directory dependencies — file: directories and injected workspace packages — now get a global-virtual-store slot of their own per project. They used to share one slot across every project that depended on a directory of the same name, so a project could end up linked to another project's copy of the dependency.

• The Workspace column of pnpm update --interactive now falls back to the project's path when its name is only whitespace, as it already did for a missing or empty one — all three render an equally blank label otherwise.

• Checking GitHub Actions dependencies for updates is now opt-in for every command. Neither pnpm outdated nor pnpm update reads the workflow files unless --include-github-actions is passed or update.githubActions is set to true in pnpm-workspace.yaml. Reading them runs git ls-remote against every referenced repository, which fails in environments where GitHub is not reachable the way pnpm assumes (a GitHub Enterprise Server, a custom certificate authority, or an offline network) #​13254.

  pnpm outdated accepts the --include-github-actions option too.

• pnpm update --interactive now measures its table in terminal columns rather than in characters. A package name, workspace name, or version containing wide characters (CJK, most emoji) no longer knocks its row's columns out of line with the rest of the group, and a wide character in a version no longer aborts the command with Subject parameter value width cannot be greater than the container width #​13357.

• The Workspace column of pnpm update --interactive is more informative in two cases. A dependency outdated at the same version in several workspace projects is offered as one choice, since selecting it updates every project — that choice now names all of them instead of only the first. And a workspace project without a name is now labelled with its path rather than left blank, so several unnamed projects can be told apart.

• An auto-installed optional peer is no longer hoisted at a version the workspace root's own dependency on that package excludes. resolvePeersFromWorkspaceRoot already made the workspace root's specifier decide which version a missing required peer is installed at; the optional-peer picker ignored it and always took the highest version present anywhere in the graph. In a workspace whose root pins postcss: 8.5.10, an importer that depends on webpack and declares no postcss of its own got postcss@8.5.22 hoisted for terser-webpack-plugin's optional postcss peer, leaving two postcss@8.5.x instances in the graph #​13320.

• overrides now also govern peers that pnpm auto-installs. Previously an override only rewrote dependencies declared in a manifest, so a peer nobody declares — installed because autoInstallPeers is on — resolved against its declared peer range and could bring in a second copy of the very package the override pinned. For example, with overrides: { react: npm:react@19.2.0 } and a lone lucide-react dependency, pnpm installed react@18.3.1; it now installs the pinned react@19.2.0 #​13320.

• Under resolvePeersFromWorkspaceRoot, a workspace root dependency declared with link: or file: (or the path form of workspace:, such as workspace:../pkg) now satisfies another project's missing peer dependency at the linked package's own version, instead of being hoisted as a path. Those specifiers are relative to the project that declares them, so the same specifier reached a different directory — or none — from the project the peer was hoisted into, leaving a broken link. The root now has the same authority over the peer as it has when it declares the package with a version range #​13373.

• Installs through a pnpr server now apply the project's whole verification policy. minimumReleaseAgeExclude, minimumReleaseAgeIgnoreMissingTime, trustPolicy, trustPolicyExclude, trustPolicyIgnoreAfter, and trustLockfile were ignored, so excluded packages were still held back and a lockfile containing them could be rejected.

  trustPolicy: no-downgrade no longer fails with TRUST_POLICY_INCOMPATIBLE_WITH_PNPR when a pnpr server is configured.

  --frozen-lockfile and --no-prefer-frozen-lockfile are now honored on the pnpr path, instead of resolving and rewriting the lockfile anyway. Since frozenLockfile defaults to true on CI, a CI install through a pnpr server now fails on an out-of-date lockfile rather than updating it.

• Workspace installs through a pnpr server no longer crash with Cannot read properties of undefined (reading 'filter') after linking, when minimumReleaseAge is active #​13275.

• Fixed pnpm dedupe updating valid catalog resolutions when another matching version exists in the lockfile.

• pnpm -r run "/pattern/" --no-bail no longer exits zero when one of a project's matched scripts fails and a later one passes. The run summary carries a single status per project, and the passing script overwrote the recorded failure.

• Restored the store block a first install prints, naming how packages were materialized and where the stores live #​13315:

  Packages are hard linked from the content-addressable store to the virtual store.
    Content-addressable store is at: ~/.local/share/pnpm/store/v11
    Virtual store is at:             node_modules/.pnpm
  

• The root project's pnpm:devPreinstall script now runs before resolution and linking, as it does in pnpm 11. It is skipped under --ignore-scripts, --lockfile-only and --dry-run, by pnpm fetch and pnpm rebuild, and by a repeat install that is already up to date. Workspaces that use the hook to prepare state the install depends on — such as next.js, which generates a placeholder next bin with it — were left with dependents linked against files that were never created #​13313.

• Prevented pnpm dedupe --check from removing an incompatible node_modules directory.

• pnpm update --workspace no longer links dependencies the user never named:

  • Running it with updateConfig.ignoreDependencies configured no longer fails with ERR_PNPM_WORKSPACE_PACKAGE_NOT_FOUND for a dependency that is only published to the registry. Such dependencies keep their specifiers, as they already did when no dependencies were ignored.
  • Passing package selectors that match no direct dependency no longer falls back to linking every workspace dependency.

Platinum Sponsors

Gold Sponsors

yuyinws/vitepress-plugin-group-icons (vitepress-plugin-group-icons)

v1.7.6

Compare Source

   🚀 Features

• Add skills for plugin  -  by @​yuyinws (42886)

   🐞 Bug Fixes

• Support double-tilde named icons  -  by @​yuyinws (e0cb7)

    View changes on GitHub

okineadev/vitepress-plugin-llms (vitepress-plugin-llms)

v1.13.4

Compare Source

    🩹 Fixes

• Isolate llms.txt template variables by depth (#​137)  -  by @​zhyupe (39ed3)

   💖 Contributors

• @​zhyupe

     View changes on GitHub

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • Between 12:00 AM and 03:59 AM, only on Monday (* 0-3 * * 1)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

[renovate]

ℹ️ Artifact update notice

File name: go.mod

In order to perform the update(s) described in the table above, Renovate ran the go get command, which resulted in the following additional change(s):

• The go directive was updated for compatibility reasons

Details:

Package	Change
go	1.25.10 -> 1.26.4