Update Non-breaking updates by renovate[bot] · Pull Request #20 · misskey-dev/sensitive-detector

renovate · 2026-07-12T15:04:26Z

ℹ️ Note

This PR body was truncated due to platform limits.

This PR contains the following updates:

Package	Change	Type	Update	Pending
@biomejs/biome (source)	`2.5.0` → `2.5.14`	pnpm.catalog.default	patch	`2.5.15`
@hono/node-server	`2.0.10` → `2.1.1`	pnpm.catalog.default	minor	`2.1.3` (+1)
@types/node (source)	`22.19.21` → `22.20.4`	pnpm.catalog.default	minor	`22.20.5`
actions/checkout	`v6.0.2` → `v6.1.0`	action	minor
actions/checkout	`v6.0.3` → `v6.1.0`	action	minor
actions/setup-node	`v6.4.0` → `v6.5.0`	action	minor
onnxruntime-node	`1.27.0` → `1.30.0`	pnpm.catalog.default	minor
pnpm/action-setup	`v6.0.9` → `v6.1.0`	action	minor
tsx (source)	`4.22.4` → `4.23.15`	pnpm.catalog.default	minor

Release Notes

biomejs/biome (@biomejs/biome)

`v2.5.14`

Compare Source

Patch Changes

#9022 0d49e24 Thanks @dyc3! - Added the nursery rule noReturnInFinally. This rule disallows return statements in Promise.prototype.finally() callbacks, including inside nested blocks and conditional branches. Returns in nested functions are ignored by the rule.
```
// Invalid: return in finally callback
Promise.resolve(1).finally(() => { return 2 })

// Valid: no return in finally callback
Promise.resolve(1).finally(() => { console.log(2) })
```
Returning a value from a Promise.prototype.finally() callback does not replace the original promise's fulfillment value, which can be confusing. Returned promises and thenables are awaited, and their rejection rejects the resulting promise.
#11754 71eaa0d Thanks @griff-rees! - Added the nursery rule noSvelteAtDebugTags, which disallows Svelte's {@debug} tag.
```

{@debug user}
```
The {@debug} tag is a debugging aid and should be removed once you no longer need it, as it should not remain in production code. The rule provides a safe fix that removes the tag.
#11725 5eb5f09 Thanks @m1handr! - Added the nursery rule useValidTestTitle, which enforces valid titles for unit test cases and suites.
#11735 9bd70c7 Thanks @ematipico! - Fixed #8471: source.fixAll.biome ignored formatter.formatWithErrors. It now applies safe fixes without formatting files that have parse errors when the option is disabled.
#11715 f05a3c3 Thanks @ematipico! - Fixed #7771: Grit plugins that use sequential no longer panic when Biome processes files.
#11766 c2542c6 Thanks @dyc3! - Fixed validation of readonly and accessor modifiers: combining them in either order now reports that they cannot be used together.
#11461 22e9966 Thanks @FoundDream! - Fixed #11423: Multiline template interpolations now preserve the indentation of their closing brace when the source indentation is not a multiple of tabWidth.
```
 const value = `
      ${
        condition
          ? "yes"
          : "no"
-}
+     }
 `;
```
#11766 c2542c6 Thanks @dyc3! - Fixed #11763: TypeScript class members using override accessor, such as override accessor value = 1, now parse correctly. The reversed order, accessor override, now reports that override must precede accessor.
#11790 17d0ff0 Thanks @ematipico! - Fixed #10248: noUselessFragments now allows fragments with props in Astro files, such as <Fragment slot="name">{text}</Fragment> inside template expressions.
#11777 7ee3a6c Thanks @ematipico! - Fixed #7573: added the requireExplicitCase option to useExhaustiveSwitchCases. When set to true, the rule reports missing cases even when the switch has a default clause, so you can keep a runtime fallback while checking that every value in the union has its own case. The option defaults to false.
#11751 d37f24b Thanks @ematipico! - Fixed #8347: the fix from useConsistentArrowReturn now parenthesizes returned expressions that begin with object literals before removing the arrow function body braces, preventing invalid output for expressions such as object property access.
#11784 46e8912 Thanks @dyc3! - Fixed #11782: noUndeclaredCustomProperties could hang while checking stylesheets imported by JavaScript modules with many shared dependencies.
#11731 1534885 Thanks @ematipico! - Fixed #7984: The fix from useSimplifiedLogicExpression now preserves line breaks in multiline conditions with line comments, preventing the right-hand side condition from being commented out.
#11735 9bd70c7 Thanks @ematipico! - Fixed #7304: the HTML formatter now preserves authored segment breaks between CJK characters, and next to CJK punctuation, instead of replacing them with spaces.
```
 <div lang="zh-Hant-TW">
-  這個段落是那麼長， 在一行寫不行。
+  這個段落是那麼長，
+  在一行寫不行。
 </div>
```
#11749 ff992a1 Thanks @ematipico! - Fixed #11747: formatting and checking large parenthesized object expressions no longer exhibit quadratic slowdowns.
#11736 1dd1fc4 Thanks @dyc3! - Fixed #8177: code actions no longer modify the wrong part of Vue, Svelte, or Astro files when experimental full HTML support is disabled.
#11743 3835945 Thanks @santichausis! - Fixed #10247: biome check --write/biome lint --write now correctly writes fixes for code inside an HTML attribute expression (for example a Svelte onclick={...} handler, or a mustache expression like {count}), instead of silently reporting the diagnostic as fixable and applying nothing.

For example, running biome lint --write --unsafe for useBlockStatements (an unsafe fix) on this Svelte component used to leave the file unchanged:
```
<button onclick={() => { if (open) close(); }}>Close</button>
```
#11740 8ea8b4a Thanks @dyc3! - Fixed #11453: useConsistentTestIt now updates imports alongside calls, preserving the original export through an alias. The rule ignores locally declared functions and withholds fixes when the preferred name would conflict with another binding or global reference.
#11355 27177ca Thanks @dyc3! - Fixed the HTML formatter incorrectly applying native HTML element formatting to PascalCase component names such as <Ul> and <Body> in Vue, Svelte, and Astro files.
```
-<Body>
-  <div>content</div>
-</Body>
+<Body><div>content</div></Body>
```
#11355 27177ca Thanks @dyc3! - Fixed the HTML formatter incorrectly applying SVG block formatting to unknown elements whose names matched SVG element names.
```
-<foreignobject>
-  <div>content</div>
-</foreignobject>
+<foreignobject><div>content</div></foreignobject>
```
#11741 fc69047 Thanks @dyc3! - Fixed #8893: useImportExtensions no longer suggests adding .ts to .jsx imports when a colocated .d.ts file provides type declarations.
#11642 c87341c Thanks @dyc3! - Added the nursery rule useConsistentFunctionStyle, which requires a consistent style for defining functions.

By default, the rule reports the following declaration because it requires a function expression assigned to a variable:
```
function greet() {
    return "Hello";
}
```
#11770 ddfd622 Thanks @dyc3! - Fixed #8980: suppression comments targeting the entire assist category are now respected, including biome-ignore-all assist when running check.
#11792 7a4b895 Thanks @dyc3! - Fixed dashed utility base names in the Tailwind parser, including border-bs, font-features, and scrollbar-thumb. Classes such as min-inline-[12rem] now preserve the complete base name and parse the arbitrary value separately.
#11739 1fc17e3 Thanks @Netail! - The rule useIncludes now also reports lastIndexOf() comparisons and some() calls with a strict-equality callback.
```
arr.lastIndexOf(x) !== -1

arr.some(item => item === x)
```
#11735 9bd70c7 Thanks @ematipico! - Fixed #6888. GritQL plugins can now use contains on import-clause metavariables such as $clause in import $clause from "module" patterns.
#11790 17d0ff0 Thanks @ematipico! - Fixed #11786: useAnchorContent now reports anchors without accessible content in HTML, Astro, Vue, and Svelte even when they have an aria-label, aria-labelledby, or title attribute, matching JSX behavior.
#11651 a9c4aa0 Thanks @saberoueslati! - Added the new nursery rule noVueUndeclaredDirectives, which reports custom Vue directives that are not declared by a <script setup> binding, the component's directives option, or the rule's globals option. Closes #11478.
```
<template>
  
  <div v-highlight></div>
</template>
```
Aliased named imports in single-file components are now tracked under their local name, so noUndeclaredVariables recognizes vHighlight in import { highlight as vHighlight } from "./directives".
#11715 f05a3c3 Thanks @ematipico! - Fixed #7795. The noJsxLiterals rule now ignores surrounding whitespace when matching literals against allowedStrings.
#11780 99c7049 Thanks @ematipico! - Fixed false positives in useExhaustiveSwitchCases when numeric cases use different spellings of the same value. For example, case 0x1 now covers the numeric literal type 1.
#11720 c7c4e2b Thanks @ematipico! - Fixed #7880: noUselessStringConcat no longer reports literal concatenations split across multiple lines when a numeric literal ends the chain.
#11355 27177ca Thanks @dyc3! - Improved performance of the HTML formatter for documents that contain many HTML-native or SVG-native tags.
#11720 c7c4e2b Thanks @ematipico! - Fixed #7949: useReadonlyClassProperties now reports static class properties that are never reassigned.
#11751 d37f24b Thanks @ematipico! - Fixed #7644: useImportExtensions now resolves path aliases declared by referenced TypeScript project configurations.
#11791 f88793c Thanks @dyc3! - Fixed a false positive in useTailwindShorthandClasses for strings in conditional tests, such as cn(m === "w-2 h-2" ? "bg-red-800" : "bg-red-400").
#11720 c7c4e2b Thanks @ematipico! - Fixed #7783: noNoninteractiveElementInteractions no longer reports event handlers on native <dialog> elements.
#11733 7030068 Thanks @dyc3! - Fixed #11730: useExhaustiveSwitchCases reports missing cases when iterating over a class property with for...of.
#11717 2107dae Thanks @ternaus! - Fixed #11716: the noUnknownAttribute rule now accepts fullscreen event handlers, the credentialless iframe property, and the SVG maskType property when the React dependency range allows React 19.3 or later. The credentialless and maskType properties are restricted to <iframe> and <mask> elements, respectively.
#11737 b7e3559 Thanks @dyc3! - Fixed #11692: noFloatingPromises now detects unhandled promises returned through generic method signatures, including Playwright fixtures.
#11780 99c7049 Thanks @ematipico! - Fixed #7747: useExhaustiveSwitchCases now reports missing cases for literal unions derived from const tuples with (typeof values)[number] and objects with keyof typeof object.

Other type-aware rules, including noFloatingPromises and noUselessTypeConversion, also recognize supported indexed-access results.
#11724 a9a5e9a Thanks @dyc3! - Fixed redundant parentheses around binary and logical unary operands with leading line comments.
```
 !(
   // leading
-  (a || b)
+  a || b
 );
```
#11715 f05a3c3 Thanks @ematipico! - Fixed #7722: noUnusedImports no longer reports type-only imports used in computed names of declared class properties.
#11731 1534885 Thanks @ematipico! - Fixed #6390: Biome now offers suppression actions for noDynamicNamespaceImportAccess in editors.
#11751 d37f24b Thanks @ematipico! - Fixed #7533: noDescendingSpecificity no longer compares selector specificity across separate cascade layer blocks.

#11735 9bd70c7 Thanks @ematipico! - Fixed #6206: useUniqueElementIds no longer reports static IDs on elements in SVG contexts.

<svg>
    <defs>
        <pattern id="dots" width="10" height="10" />
    </defs>
    <rect fill="url(#dots)" width="100%" height="100%" />
</svg>

#11715 f05a3c3 Thanks @ematipico! - Fixed #5447, so the GitHub reporter now associates annotations with the correct files when Biome runs from a nested directory.
#11720 c7c4e2b Thanks @ematipico! - Fixed #7816: useHookAtTopLevel no longer reports methods named like hooks when called on another function's result, such as Reactotron.configure(...).useReactNative(...).
#11355 27177ca Thanks @dyc3! - Removed special HTML formatter handling for the obsolete <listing> element.
#11731 1534885 Thanks @ematipico! - Fixed an issue where Grit plugin code fixes weren't available as editor code actions.
#11726 dea163f Thanks @dyc3! - Fixed #11722: the JavaScript formatter inserts a newline before the closing angle bracket when a leading comment forces type arguments onto multiple lines.
```
 type Foo = Record<
   // comment
   string,
-  number>;
+  number
+>;
```

#9758 02ea438 Thanks @Netail! - Added the nursery rule noJsonUnsafeValues, which disallows JSON values that are unsafe to use between different tools or languages.

Invalid:

[
  2e308, // Number evaluating to Infinity
  -2e308, // Number evaluating to -Infinity
  "\ud83d", // String with lone surrogate
  1e-400, // Unsafe zero (too small, will evaluate to 0)
  9007199254740992, // Unsafe integer (outside safe integer range)
  2.2250738585072009e-308, // Subnormal number
]

#11790 17d0ff0 Thanks @ematipico! - Fixed #8574: the JavaScript formatter sometimes added extra parentheses and moved comments when formatting multiline expressions after operators such as !. Comments now stay beside the values they describe, without an extra pair of parentheses.
```
 !(
-  (
-    cond1 || // force this to be multi line
-    cond3
-  ) // comment
+  cond1 || // force this to be multi line
+  cond3 // comment
 );
```
#11715 f05a3c3 Thanks @ematipico! - Fixed #7711: biome lint --suppress no longer fails with conflicting rule fixes when multiple diagnostics target a declaration preceded by a multiline comment.
#11700 0e9fe53 Thanks @dyc3! - Added the nursery rule noObsoleteTags, which reports obsolete HTML elements in HTML and JSX, such as <font color="red">Text</font>.
#11735 9bd70c7 Thanks @ematipico! - Fixed #7363: Biome GritQL plugins now match TypeScript interface snippets such as interface $name { $body }.
#11729 f047985 Thanks @m1handr! - Added support for suite() as an alias of describe() across test analysis rules and formatter. Rules now recognize suite, fsuite, xsuite, and test.suite blocks. The formatter recognises them as test declarations.
#11778 4b7aa1f Thanks @ematipico! - Fixed #7727: GritQL snippets such as import $what from $where now match namespace imports, including type-only imports. Explicit import type $what from $where patterns also match type-only named and namespace imports.
#11715 f05a3c3 Thanks @ematipico! - Fixed #7603: useSingleJsDocAsterisk no longer reports asterisks that are part of JSDoc comment content, such as italic text, as extra line markers.
#11706 e19512a Thanks @dyc3! - Fixed #11704: files re-included by negation patterns in a nested .gitignore are processed when vcs.useIgnoreFile is enabled, even when the ignore file contains *.
#11718 76a302a Thanks @dyc3! - Fixed #8573: own-line comments before binary operators stay above the operator when javascript.formatter.operatorLinebreak is "before".
```
 foo
-  || // comment
-  bar;
+  // comment
+  || bar;
```
#9797 64fd314 Thanks @Netail! - Added the nursery rule useConsistentObjectKeys, which requires JSON object keys to follow a consistent Unicode representation.

`v2.5.13`

Compare Source

Patch Changes

#11379 07a0073 Thanks @Netail! - Added the nursery rule useLayeredStyles, which enforces that style rules are defined within a cascade layer and import rules to import its styles into a cascade layer.
```
/* Invalid */
@import 'foo.css';

.my-style {
  color: red;
}

/* Valid */
@import 'foo.css' layer(base);

@layer base {
  .my-style {
    color: red;
  }
}
```
#11667 e997900 Thanks @devtechedge! - Added the nursery rule useBetterDomTraversing, which prefers .firstChild, .firstElementChild, .closest(), and merged .querySelector() calls over positional DOM traversal.
```
element.childNodes[0];
element.children[0];
element.parentElement.parentElement;
element.querySelector("a").querySelector("b");
```
#11620 20e513a Thanks @jakeleventhal! - Fixed #11610, #11611, #11612, #11615, and #11616: Biome no longer fully infers an imported generic declaration just to apply its type arguments, restoring type-aware lint performance for large libraries such as Zod. This improves useRegexpExec, noFloatingPromises, noMisusedPromises, useNullishCoalescing, and noUnsafePlusOperands.
#11657 e322040 Thanks @ematipico! - Fixed #7495: noUselessConstructor now ignores TypeScript constructors that forward at least one argument to super, preserving constructors that narrow the subclass's accepted parameter types. The exemption also applies when the parent and child signatures are identical; JavaScript and zero-argument forwarding behavior are unchanged.
#11670 4969ee1 Thanks @ematipico! - Fixed #7076: useAriaPropsForRole and useFocusableInteractive no longer report non-focusable elements with role="separator". A separator with an explicit tabIndex or tabindex still requires aria-valuenow.
#11627 23aad6d Thanks @ematipico! - Fixed #6571 so Grit plugins can capture and inspect multiple named import specifiers.
#11631 00dbd3a Thanks @ematipico! - Reduced unnecessary type inference when type-aware lint rules inspect members of namespace imports from libraries such as Zod. Fixed type inference so blanket re-exports do not expose default exports.
#11628 a2f8ff7 Thanks @dyc3! - Added the nursery rule noXorAsExponentiation, which reports the bitwise XOR operator ^ between two decimal integer literals, where the exponentiation operator ** was likely intended.
```
const kibibyte = 2 ^ 10; // 8, not 1024
```
#11670 4969ee1 Thanks @ematipico! - Fixed #7192: noUnusedPrivateClassMembers now considers compound assignments such as ??= to read and use private class members.
#11676 840a52a Thanks @dyc3! - Fixed #11672 and #11671 by disabling the experimental capitalized-call and effect-dependency checks in useReactCompiler, matching their exclusion from upstream's recommended lint preset. Valid calls such as Intl.NumberFormat() and captures of variables declared inside effects no longer produce these diagnostics.
#11660 49485ed Thanks @ematipico! - Fixed #11653: Astro template suppression comments ({/* biome-ignore lint: reason */}) now suppress matching HTML lint diagnostics on the following line when full HTML support is enabled.
#11664 9a73b9c Thanks @dyc3! - Improved the performance of useRegexpExec.
#11661 5341b3f Thanks @ematipico! - Fixed #7479. noUnusedVariables now treats Unicode escapes in identifiers as the same binding as their decoded spelling.

#11630 62e1fc5 Thanks @dyc3! - Fixed the HTML formatter inserting whitespace between adjacent Svelte expressions when their combined length exceeds the line width.

 <span>
-  {head.median - base.median >= 0 ? "+" : "−"}
-  {formatMs(Math.abs(head.median - base.median))}
+  {head.median - base.median >= 0 ? "+" : "−"}{formatMs(Math.abs(head.median - base.median))}
 </span>

#11658 ed4bfa4 Thanks @fredrikblau! - Fixed #11644: useHeadingContent no longer reports headings that render their text with a directive: set:html and set:text in Astro files, v-html and v-text in Vue files.
```
<h1 set:html={heading} />
<h2 set:text={heading}></h2>
```
```
<template>
  <h1 v-html="heading"></h1>
  <h2 v-text="heading"></h2>
</template>
```
#11613 47d7383 Thanks @ematipico! - Improved the performance of Biome Formatter up to ~50% in some cases.
#11655 fd8fc74 Thanks @ematipico! - Fixed #6974, where noUnusedPrivateClassMembers incorrectly reported TypeScript private constructor properties read through object destructuring from this as unused.
#11618 21a10cf Thanks @siketyan! - Fixed #11605: Type inference now infers the type of an unannotated callback parameter from the signature of the function the callback is passed to, and honours explicit type arguments on call expressions. This improves type-aware analysis for noBaseToString, noFloatingPromises, noMisleadingReturnType, noMisusedPromises, noUnnecessaryConditions, noUnsafePlusOperands, noUselessTypeConversion, useArrayFind, useArraySortCompare, useAwaitThenable, useDisposables, useExhaustiveSwitchCases, useIncludes, useNullishCoalescing, useRegexpExec, and useStringStartsEndsWith. For example, noFloatingPromises can now detect Promises reached through such parameters:
```
interface Context {
  doSomething(): Promise<void>;
}

declare function test(callback: (ctx: Context) => Promise<void>): void;

test(async (ctx) => {
	ctx.doSomething(); // now reported as a floating promise
});
```
#11698 b019982 Thanks @denbezrukov! - Fixed parsing of unquoted CSS URLs beginning with @ or !, such as url(@/assets/icon.svg) and url(!font.woff2). Preserved escaped and non-ASCII whitespace in raw URLs during formatting.
```
-background-image: url(image\);
+background-image: url(image\ );
```
#11622 c23e4c7 Thanks @Netail! - Added the nursery rule noUnsafeIframeSandbox, which reports iframe elements whose sandbox attribute combines allow-scripts and allow-same-origin, since that combination lets the embedded document remove its own sandboxing.
```
<iframe src="https://example.com" sandbox="allow-scripts allow-same-origin" />
```
#11606 de0528f Thanks @dyc3! - Added the recommended noSvelteAtHtmlTags nursery rule, which reports Svelte {@html} tags that render unescaped HTML.
#11670 4969ee1 Thanks @ematipico! - Fixed #6782: GritQL plugins now match captured JSX component names against code snippets such as React.Fragment.
#11687 09d97d9 Thanks @hori-design! - Fixed #11678: useReactCompiler no longer panics on files that contain non-ASCII characters. This bumps the React Compiler version.
#11595 a64d757 Thanks @dyc3! - Added the nursery Vue-domain rule useVueBaseImport rule, which enforces importing Vue APIs from vue instead of internal @vue/* packages.
#11675 353cbae Thanks @dyc3! - Fixed useReactCompiler silently producing no diagnostics in WebAssembly builds, including the playground.
#11625 ea20e5a Thanks @denbezrukov! - Improved linting performance for large CSS and JSON files.
#11670 4969ee1 Thanks @ematipico! - Fixed #7527: suppression actions for diagnostics emitted on comments are now inserted before the diagnostic comment. In particular, suppressing noTsIgnore now places the biome-ignore comment before @ts-ignore.
#11655 fd8fc74 Thanks @ematipico! - Fixed #8629, where noUnusedPrivateClassMembers incorrectly reported used private TypeScript method overload signatures as unused.
#11669 579f401 Thanks @denbezrukov! - Improved the performance of noExcessiveLinesPerFile when skipBlankLines is false.

`v2.5.12`

Compare Source

Patch Changes

#11440 b88f1ea Thanks @Princesseuh! - Fixed Astro attribute expressions rejecting TypeScript and JSX syntax that is accepted in text expressions.
```
<Component icon={<Icon />} count={total as number} onSelect={(e: Event) => e} />
```
#11440 b88f1ea Thanks @Princesseuh! - Fixed Astro attribute names being split on : and . inside an expression, such as {x && <button x-on:keyup.enter={go} client:load.foo />}.
#11440 b88f1ea Thanks @Princesseuh! - Fixed a bare > in the children of an Astro expression being treated as markup, such as {x && <div>a > b</div>}.
#11440 b88f1ea Thanks @Princesseuh! - Fixed HTML comments inside an Astro expression failing to parse. They are now read as trivia, wherever they appear among the children.
```
{x && <div>text</div>}
{cond && <a></a><b></b>}
```
#11440 b88f1ea Thanks @Princesseuh! - Fixed is:raw children inside an Astro expression being read as JSX, such as {x && <div is:raw>{not js} < & text</div>}.
#11440 b88f1ea Thanks @Princesseuh! - Fixed an apostrophe or quote in the text of a JSX element inside an Astro expression ending the expression early, such as {items.map((i) => <li>it's {i}</li>)}.
[#114

❗ Important

✂ PR body was truncated to here.

Configuration

📅 Schedule: (in timezone Asia/Tokyo)

Branch creation
- Between 12:00 AM and 12:59 AM (* 0 * * *)
Automerge
- At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

If you want to rebase/retry this PR, check this box

This PR was generated by Mend Renovate. View the repository job log.

coderabbitai · 2026-07-28T03:32:47Z

Important

Review skipped

Bot user detected.

To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Organization UI
Review profile: CHILL
Plan: Advanced
Run ID: a8637459-7e7e-4b61-9715-e8aadf7d5a77

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

🔍 Trigger review

📝 Walkthrough

Walkthrough

This PR updates pinned versions for GitHub Actions, pnpm, and selected workspace catalog dependencies. Existing CI and Docker workflow commands, Node.js configuration, caching, installation, and build steps remain unchanged.

Changes

Tooling updates

Layer / File(s)	Summary
Runtime and dependency pins `package.json`, `pnpm-workspace.yaml`	Updates the pnpm package manager version and five catalog dependency pins.
CI action pins `.github/actions/setup/action.yml`, `.github/workflows/ci.yml`, `.github/workflows/docker.yml`	Updates the setup-node and checkout action versions while preserving existing workflow steps.

Estimated code review effort: 2 (Simple) | ~10 minutes

Possibly related issues

misskey-dev/mfm.js#183 — Tracks updates to several of the same pnpm, dependency, and GitHub Actions version pins.

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Title check	✅ Passed	The title identifies the pull request as a set of non-breaking updates, which matches the dependency and action version changes.
Description check	✅ Passed	The description clearly lists the dependency and GitHub Action updates included in the pull request.

✨ Finishing Touches

📝 Generate docstrings

Create stacked PR
Commit on current branch

🧪 Generate unit tests (beta)

Create PR with unit tests
Commit unit tests in branch renovate/non-breaking-updates

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

_{A rabbit hops through pins so bright,
Fresh tools burrow into place tonight.
Checkout, pnpm, actions too,
Wear their newest coats of blue.
Builds keep steady, clean, and light—
Version carrots taste just right!}

_{Comment @coderabbitai help to get the list of available commands.}

coderabbitai

Actionable comments posted: 1

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In @.github/workflows/ci.yml:
- Line 13: Disable checkout credential persistence by setting
persist-credentials to false on the actions/checkout steps at
.github/workflows/ci.yml lines 13 and 21, and .github/workflows/docker.yml lines
35-36; no later git push or fetch is required.

🪄 Autofix (Beta)

Fix all unresolved CodeRabbit comments on this PR:

Push a commit to this branch (recommended)
Create a new PR with the fixes

ℹ️ Review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro Plus

Run ID: 88ce58c7-e592-4bf3-9c67-23219a264c95

📥 Commits

Reviewing files that changed from the base of the PR and between fdd71bb and bc94ac0.

⛔ Files ignored due to path filters (1)

pnpm-lock.yaml is excluded by !**/pnpm-lock.yaml

📒 Files selected for processing (5)

.github/actions/setup/action.yml
.github/workflows/ci.yml
.github/workflows/docker.yml
package.json
pnpm-workspace.yaml

coderabbitai · 2026-07-28T03:35:33Z

    runs-on: ubuntu-latest
    steps:
-      - uses: actions/checkout@v6.0.3
+      - uses: actions/checkout@v6.1.0


🔒 Security & Privacy | 🟠 Major | ⚡ Quick win

🧩 Analysis chain

🏁 Script executed:

#!/bin/bash set -euo pipefail printf '--- .github/workflows/ci.yml ---\n' cat -n .github/workflows/ci.yml | sed -n '1,220p' printf '\n--- .github/workflows/docker.yml ---\n' cat -n .github/workflows/docker.yml | sed -n '1,220p'

Repository: misskey-dev/sensitive-detector

Length of output: 259

🏁 Script executed:

#!/bin/bash set -euo pipefail # Find every checkout usage in workflow files and show nearby context. rg -n -C 3 'uses:\s*actions/checkout@' .github/workflows

Repository: misskey-dev/sensitive-detector

Length of output: 1372

🏁 Script executed:

#!/bin/bash set -euo pipefail printf '%s\n' '--- .github/workflows/ci.yml ---' cat -n .github/workflows/ci.yml | sed -n '1,220p' printf '\n%s\n' '--- .github/workflows/docker.yml ---' cat -n .github/workflows/docker.yml | sed -n '1,220p' printf '\n%s\n' '--- checkout usages ---' rg -n -C 3 'uses:\s*actions/checkout@' .github/workflows

Repository: misskey-dev/sensitive-detector

Length of output: 6161

🏁 Script executed:

#!/bin/bash set -euo pipefail printf '%s\n' '--- .dockerignore ---' if [ -f .dockerignore ]; then cat -n .dockerignore else echo '(missing)' fi printf '\n%s\n' '--- .github/actions/setup ---' if [ -d .github/actions/setup ]; then find .github/actions/setup -maxdepth 2 -type f | sort | while read -r f; do printf '\n[%s]\n' "$f" cat -n "$f" done else echo '(missing)' fi

Repository: misskey-dev/sensitive-detector

Length of output: 999

🏁 Script executed:

#!/bin/bash set -euo pipefail # Inspect relevant ignore/config files only if present. for f in .dockerignore .gitignore; do if [ -f "$f" ]; then printf '\n--- %s ---\n' "$f" cat -n "$f" fi done

Repository: misskey-dev/sensitive-detector

Length of output: 6837

🏁 Script executed:

#!/bin/bash set -euo pipefail # Read only the small, relevant files around checkout-related workflow steps. for f in .github/workflows/ci.yml .github/workflows/docker.yml .github/actions/setup/action.yml; do if [ -f "$f" ]; then printf '\n--- %s ---\n' "$f" cat -n "$f" fi done

Repository: misskey-dev/sensitive-detector

Length of output: 5428

Disable checkout credential persistence in these workflows.
actions/checkout writes the token into .git/config; set persist-credentials: false unless a later git push/fetch is required.

.github/workflows/ci.yml#L13

.github/workflows/ci.yml#L21

.github/workflows/docker.yml#L35-L36

🧰 Tools

🪛 zizmor (1.26.1)

[warning] 13-13: credential persistence through GitHub Actions artifacts (artipacked): does not set persist-credentials: false

(artipacked)

📍 Affects 2 files

.github/workflows/ci.yml#L13-L13 (this comment)

.github/workflows/ci.yml#L21-L21

.github/workflows/docker.yml#L35-L36

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In @.github/workflows/ci.yml at line 13, Disable checkout credential persistence by setting persist-credentials to false on the actions/checkout steps at .github/workflows/ci.yml lines 13 and 21, and .github/workflows/docker.yml lines 35-36; no later git push or fetch is required.

Source: Linters/SAST tools

renovate Bot added the dependencies label Jul 12, 2026

renovate Bot force-pushed the renovate/non-breaking-updates branch 5 times, most recently from d836295 to 9042936 Compare July 20, 2026 02:56

renovate Bot force-pushed the renovate/non-breaking-updates branch 4 times, most recently from 4b4ef2e to bc94ac0 Compare July 28, 2026 03:32

coderabbitai Bot reviewed Jul 28, 2026

View reviewed changes

renovate Bot force-pushed the renovate/non-breaking-updates branch 7 times, most recently from 888bc06 to b27a1c0 Compare August 4, 2026 04:26

renovate Bot force-pushed the renovate/non-breaking-updates branch 9 times, most recently from 311dd61 to e721f37 Compare August 11, 2026 04:24

renovate Bot force-pushed the renovate/non-breaking-updates branch 2 times, most recently from 426ac79 to c9366ef Compare August 12, 2026 09:07

renovate Bot force-pushed the renovate/non-breaking-updates branch 6 times, most recently from 5a1915b to 96c1796 Compare August 22, 2026 20:26

renovate Bot force-pushed the renovate/non-breaking-updates branch 6 times, most recently from d25ac18 to bcabcc3 Compare August 31, 2026 20:29

renovate Bot force-pushed the renovate/non-breaking-updates branch 5 times, most recently from 18ac013 to e16fa1b Compare September 6, 2026 04:21

renovate Bot force-pushed the renovate/non-breaking-updates branch 4 times, most recently from cff9fc7 to 90c8378 Compare September 15, 2026 10:27

renovate Bot force-pushed the renovate/non-breaking-updates branch 5 times, most recently from 6c1d10f to 4fdf1e4 Compare September 23, 2026 11:30

renovate Bot force-pushed the renovate/non-breaking-updates branch 2 times, most recently from be5fccd to 680f576 Compare September 27, 2026 08:22

Update Non-breaking updates

f28b2ac

renovate Bot force-pushed the renovate/non-breaking-updates branch from 680f576 to f28b2ac Compare October 5, 2026 19:44

Navigation Menu

Update Non-breaking updates - #20

Update Non-breaking updates#20
renovate[bot] wants to merge 1 commit into
mainfrom
renovate/non-breaking-updates

renovate Bot commented Jul 12, 2026 •

edited

Loading

Uh oh!

coderabbitai Bot commented Jul 28, 2026 •

edited

Loading

Review skipped

Walkthrough

Changes

Uh oh!

coderabbitai Bot left a comment

Uh oh!

coderabbitai Bot Jul 28, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants

Conversation

renovate Bot commented Jul 12, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Release Notes

v2.5.14

Patch Changes

v2.5.13

Patch Changes

v2.5.12

Patch Changes

Configuration

Uh oh!

coderabbitai Bot commented Jul 28, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Review skipped

Walkthrough

Changes

Uh oh!

coderabbitai Bot left a comment

Choose a reason for hiding this comment

Uh oh!

coderabbitai Bot Jul 28, 2026

Choose a reason for hiding this comment

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants

renovate Bot commented Jul 12, 2026 •

edited

Loading

`v2.5.14`

`v2.5.13`

`v2.5.12`

coderabbitai Bot commented Jul 28, 2026 •

edited

Loading