chore(deps): update all non-major dependencies by renovate[bot] · Pull Request #141 · uozi-tech/cosy

renovate · 2026-09-26T02:42:49Z

This PR contains the following updates:

Package	Change	Age	Confidence
dompurify	`^3.4.15` → `^3.4.16`
github.com/gin-contrib/pprof	`v1.5.5` → `v1.5.6`
github.com/pierrec/lz4/v4	`v4.1.30` → `v4.1.31`
github.com/quic-go/quic-go	`v0.62.0` → `v0.63.0`
github.com/shirou/gopsutil/v4	`v4.26.8` → `v4.26.9`
undici (source)	`^8.10.2` → `^8.11.2`
vite (source)	`^8.3.0` → `^8.3.2`

Release Notes

cure53/DOMPurify (dompurify)

`v3.4.16`: DOMPurify 3.4.16

Compare Source

Fixed a problem with IN_PLACE node removal when working with hooks, thanks @manus-pi
Fixed a problem with IN_PLACE sanitization and raw-text roots, thanks @h-t-m
Fixed a problem with ESM default exports landing in CommonJS declarations, thanks @ssi02014
Migrated from rollup to rolldown because performance, thanks @ssi02014
Bumped several dependencies where possible

gin-contrib/pprof (github.com/gin-contrib/pprof)

`v1.5.6`

Compare Source

Changelog

Others

4946727: chore(deps)!: fix Trivy security findings (@appleboy)
c726543: Merge pull request #74 from gin-contrib/chore/fix-trivy-security-dependencies (@thinkerou)

pierrec/lz4 (github.com/pierrec/lz4/v4)

`v4.1.31`

Compare Source

quic-go/quic-go (github.com/quic-go/quic-go)

`v0.63.0`

Compare Source

This release improves HTTP/3 request handling and error reporting.

Breaking Changes

http3: non-CONNECT server requests now leave URL.Scheme and URL.Host empty, matching net/http: #5839
http3: Extended CONNECT now leaves URL.Scheme and URL.Host empty and sets RequestURI to :path: #5841
http3: stream APIs now return QUIC stream and application errors as *http3.Error: #5852

Notable Fixes

http3: :path must start with /; only OPTIONS allows *: #5842
quicvarint: complete varints now decode successfully when returned alongside io.EOF or another reader error: #5876

Notable Changes

http3.Error now supports unwrapping the underlying QUIC stream or application error: #5873
http3.ClientConn now exposes LocalAddr and RemoteAddr: #5871

Changelog

ci: bump CodSpeedHQ/action from 5.0.3 to 5.2.1 by @dependabot[bot] in #5836
http3: parse requests like net/http by @marten-seemann in #5839
http3: validate request :path pseudo-header values by @marten-seemann in #5842
http3: use :path for Extended CONNECT request targets by @marten-seemann in #5841
honor packet loss direction in handshake integration test by @marten-seemann in #5843
ackhandler: remove unused sentPacketHistory.LowestPacketNumber by @marten-seemann in #5846
ci: bump docker/setup-qemu-action from 4.2.0 to 4.3.0 by @dependabot[bot] in #5847
reenable OSS-Fuzz by rebuilding fuzz utils by @marten-seemann in #5851
use require.JSONEq in qlog and qlogwriter tests by @marten-seemann in #5853
account for 1-RTT AEAD overhead in coalesced CONNECTION_CLOSE packets by @marten-seemann in #5858
ci: bump docker/build-push-action from 7.3.0 to 7.4.0 by @dependabot[bot] in #5865
ci: bump docker/setup-qemu-action from 4.3.0 to 4.4.0 by @dependabot[bot] in #5867
ci: bump codecov/codecov-action from 7.0.0 to 7.1.1 by @dependabot[bot] in #5868
ci: bump docker/setup-buildx-action from 4.3.0 to 4.4.1 by @dependabot[bot] in #5866
http3: return consistent error types from stream APIs by @marten-seemann in #5852
use more specific require assertions in tests by @marten-seemann in #5855
fix flaky TestDial by closing transports in server tests by @marten-seemann in #5869
use more specific require assertions for errors by @marten-seemann in #5872
http3: add LocalAddr and RemoteAddr to ClientConn by @marten-seemann in #5871
add an AI policy by @marten-seemann in #5870
fix issue and pull request template by @marten-seemann in #5874
http3: allow unwrapping stream and application errors by @marten-seemann in #5873
quicvarint: handle data returned with errors when reading and peeking by @marten-seemann in #5876

Full Changelog: quic-go/quic-go@v0.62.0...v0.63.0

shirou/gopsutil (github.com/shirou/gopsutil/v4)

`v4.26.9`

Compare Source

What's Changed

cpu

[cpu][linux]: expose raw tick counters through ExLinux by @fzlzjerry in #2149
[cpu][darwin]: don't crash in getFrequency when pmgr lacks voltage-states5-sram by @hsdfat in #2163

docker

[docker][linux]: support cgroup v2 in Cgroup* functions by @hsdfat in #2143
[docker][linux]: fix the "all cgroup" case on cgroup v1 by @shirou in #2154

host

[linux] host: add nixos by @stepbrobd in #2144

mem

[mem][linux]: document that Cached includes SReclaimable by @shirou in #2155

net

net: fix MIB_IF_ROW2 layout on Windows 386 by @zhangli091011 in #2120
fix(net): include FIFO errors in aggregate I/O counters by @jakezwang in #2153
[net][linux]: skip ESRCH from /proc//fd in getProcInodesAll by @KobayashiKosuke in #2161

process

[ci][windows]: run the test suite on windows/386 by @shirou in #2151
feat(darwin): implement EnvironWithContext for Darwin processes by @nako-ruru in #2135
Return an error on empty OpenBSD KinfoProc by @AshSgDe29071999 in #2142

Other Changes

Bump perfstat to fix memory leaks by @pgimalac in #2148
[common]: use reflect.Pointer instead of the deprecated reflect.Ptr by @shirou in #2156

New Contributors

@nako-ruru made their first contribution in #2135
@AshSgDe29071999 made their first contribution in #2142
@stepbrobd made their first contribution in #2144
@zhangli091011 made their first contribution in #2120
@hsdfat made their first contribution in #2143
@fzlzjerry made their first contribution in #2149
@jakezwang made their first contribution in #2153
@KobayashiKosuke made their first contribution in #2161

Full Changelog: shirou/gopsutil@v4.26.8...v4.26.9

nodejs/undici (undici)

`v8.11.2`

Compare Source

What's Changed

fix: close rejected HTTP/2 WebSocket handshake streams by @mcollina in #5873
fix: avoid reconnecting aborted requests by @Junaid-PK in #5846

New Contributors

@Junaid-PK made their first contribution in #5846

Full Changelog: nodejs/undici@v8.11.1...v8.11.2

`v8.11.1`

Compare Source

What's Changed

deslopify websocket test by @KhafraDev in #5851
Revert "fix: preserve HTTP/2 for legacy fetch consumers" by @mcollina in #5860
fix websocketstream bugs by @KhafraDev in #5863
fix hang on 3xx response with large body by @KhafraDev in #5850
docs: warn about buffering response bodies by @mcollina in #5872
test: cover native fetch gzip decoding through the legacy bridge by @mcollina in #5874

Full Changelog: nodejs/undici@v8.11.0...v8.11.1

`v8.11.0`

Compare Source

What's Changed

fix: complete upgrade diagnostics lifecycle by @BridgeAR in #5761
build(deps): bump step-security/harden-runner from 2.19.4 to 2.21.0 by @dependabot[bot] in #5753
fix(decompress): join a repeated content-encoding header by @luantaraschi in #5664
fix(cookies): keep a cookie named proto in getCookies by @luantaraschi in #5663
build(deps-dev): bump jest from 30.5.0 to 30.5.1 by @dependabot[bot] in #5784
build(deps): bump got from 15.1.0 to 16.0.0 in /benchmarks by @dependabot[bot] in #5785
fix: selectively re-enable SIMD for ppc64 by @richardlau in #5776
use private fields for brand checks by @KhafraDev in #5792
fix(h2): do not unref a session with open streams by @kjsik11 in #5782
fix(h2): avoid pool fan-out during ALPN negotiation by @mcollina in #5799
fix issue #5715 by @KhafraDev in #5805
ci: extend macOS Node.js workflow timeout by @mcollina in #5775
fix(env-http-proxy-agent): NO_PROXY wildcard semantics by @mcollina in #5777
fix(h2): do not replay a request whose response already started after GOAWAY by @kjsik11 in #5788
test: skip HTTP/2 churn test on Node.js 25 on all platforms by @kjsik11 in #5790
fix(proxy-agent): preserve repeated iterable headers by @GiHoon1123 in #5779
docs(errors): document ProxyConnectionError (UND_ERR_PRX_CONN) by @kilisamemarisaaa in #5781
dataurl parsing improvements + update WPT by @KhafraDev in #5812
fix(decompress): treat inherited Object.prototype names as unsupported encodings by @NgoQuocViet2001 in #5807
test(h2): stabilize http2-connection by @ViniciusDev26 in #5801
fix: preserve HTTP/2 for non-upgrade legacy requests by @mcollina in #5811
fix: skip drain dispatch for clientTtl-evicted clients in PoolBase by @vwong in #5677
chore: update tests blocking release by @vwong in #5828
build(deps): bump uWebSockets.js from v20.68.0 to v20.70.0 in /benchmarks by @dependabot[bot] in #5824
fix(deduplicate): settle requests when composed with retry by @mcollina in #5817
fix(cache): do not report aborted on successful cache hits by @Yahiro025 in #5819
fix(cookies): keep an Expires of 0 when serializing a cookie by @NgoQuocViet2001 in #5808
fix: honor backpressure in decompression interceptor by @mcollina in #5829
fix(h2): validate h2Options.maxConcurrentStreams itself by @kjsik11 in #5830
test(fetch): make pull-dont-push exceed any socket buffer by @kjsik11 in #5840
test(decompress): wait for highWaterMark via readable instead of setImmediate loop by @kjsik11 in #5841
fix(h2): keep the session ref'd while requests are queued by @kjsik11 in #5839
fix cache.addAll and cache.add hanging by @KhafraDev in #5844
fix(retry): settle responses after connection close by @mcollina in #5815
fix(h2): validate response content-length by @mcollina in #5816
fix(redirect): ignore informational responses in history by @mcollina in #5813
fix(websocket): reset the compressed flag when a message completes by @askalf in #5827
fix(h2): keep queued requests alive when the last stream closes by @kjsik11 in #5847
build(deps-dev): bump jest from 30.5.1 to 30.5.2 by @dependabot[bot] in #5854
build(deps-dev): bump fast-check from 4.9.0 to 4.10.1 by @dependabot[bot] in #5852
build(deps): bump uWebSockets.js from v20.70.0 to v20.71.0 in /benchmarks by @dependabot[bot] in #5856
build(deps-dev): bump @metcoder95/https-pem from 1.0.0 to 1.0.1 by @dependabot[bot] in #5853

New Contributors

@luantaraschi made their first contribution in #5664
@kilisamemarisaaa made their first contribution in #5781
@NgoQuocViet2001 made their first contribution in #5807
@ViniciusDev26 made their first contribution in #5801
@vwong made their first contribution in #5677
@Yahiro025 made their first contribution in #5819
@askalf made their first contribution in #5827

Full Changelog: nodejs/undici@v8.10.2...v8.11.0

vitejs/vite (vite)

`v8.3.2`

Compare Source

Bug Fixes

build: preload CSS correctly when renderBuiltUrl returns URLs with queries (#23611) (64e0a21)
bundled-dev: serve lazy chunk sourcemaps (#23026) (eb7aa9a)
bundled-dev: serve the rolldown runtime from the installed rolldown (#23568) (bc598a6)
deps: update all non-major dependencies (#23601) (9944fa6)
deps: update rolldown-related dependencies (#23602) (88c1741)
html: resolve percent-encoded srcset urls (#23609) (53f1ce7)
limit size of object and array printing via forwardConsole (#23565) (e64a587)
merge build.rolldownOptions.output.minify correctly (#23536) (bba3bb8)
optimize-deps: avoid "unsupported" warnings for browser:false mappings (#23590) (5e4b9ca)
optimizer: preserve excluded optional peer require fallbacks (#23600) (a2bd6fa)
pass queries to renderBuiltUrl (#23586) (744269e)
server: handle file watcher errors without crashing (#23503) (6894f5c)
server: release previous environments after initialization (#23499) (5a3a010)
ssr: encode whitespace in module runner sourceURL (#23513) (bbc8812)
worker: align worker urls in client and server when using terser (#23614) (24bd331)

Performance Improvements

avoid encoding intermediate source maps (#23461) (89574f6)
build: avoid quadratic link scan in the preload helper (#23510) (cf5c028)
only register time middleware when debug logging is enabled (#23621) (94d0080)

Documentation

fix dead og-image PNG links in vite6/vite7 changelog entries (#23594) (1929b4c)

Miscellaneous Chores

deps: update vitest monorepo to v5 (#23604) (24339f4)

Code Refactoring

use tinyexec instead of cross-spawn (#23583) (db915e5)

Tests

bundled-dev: accept a rolldown dev runtime with no helper imports (#23606) (634745d)

`v8.3.1`

Compare Source

Bug Fixes

deps: update all non-major dependencies (#23482) (3c752c8)
deps: update all non-major dependencies (#23537) (e8990c4)
deps: update rolldown-related dependencies (#23483) (9aecbbf)
handle server.ws: false in mergeConfig (#23511) (f68c0d5)
merge build.rolldownOptions.output.comments correctly (#23514) (4aba8d8)
optimizer: don't skip imports whose binding starts with type (#23540) (39330f4)
optimizer: resolve pending discovered dep processing on close before init (#23567) (5f89433)
server: avoid reinitializing watcher when adding file after server close (#23572) (6f831f9)
sourcemap: skip URL source roots when injecting sources content (#23519) (04fc30a)

Miscellaneous Chores

merge prereleases in changelog (#23466) (99bd9d1)
optimizer: add debug log when waiting for dep before init (#23566) (63567c7)
update optimizeDeps.include comment (#23489) (6a84c72)

Code Refactoring

assets regexp use non-capture (#23491) (f4b4431)
remove duplicate configurations (#23532) (9abd99b)
replace find with some (#23554) (af7cdf6)

Configuration

📅 Schedule: (UTC)

Branch creation
- "after 2am and before 3am"
Automerge
- "after 1am and before 2am"

🚦 Automerge: Enabled.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

If you want to rebase/retry this PR, check this box

This PR was generated by Mend Renovate. View the repository job log.

renovate · 2026-10-01T10:01:51Z

ℹ️ Artifact update notice

File name: go.mod

In order to perform the update(s) described in the table above, Renovate ran the go get command, which resulted in the following additional change(s):

4 additional dependencies were updated

Details:

Package	Change
`github.com/ebitengine/purego`	`v0.10.2` -> `v0.11.1`
`github.com/power-devops/perfstat`	`v0.0.0-20240221224432-82ca36839d55` -> `v0.0.0-20260805114148-88456608a4f6`
`github.com/tklauser/go-sysconf`	`v0.3.16` -> `v0.4.0`
`github.com/tklauser/numcpus`	`v0.11.0` -> `v0.12.0`

renovate Bot force-pushed the renovate/all-minor-patch branch 2 times, most recently from d214453 to 57d53fa Compare October 1, 2026 10:01

chore(deps): update all non-major dependencies

eada6b3

renovate Bot force-pushed the renovate/all-minor-patch branch from 57d53fa to eada6b3 Compare October 1, 2026 18:31

renovate Bot merged commit 8f1e051 into main Oct 2, 2026
7 checks passed

renovate Bot deleted the renovate/all-minor-patch branch October 2, 2026 01:58

Navigation Menu

Repository navigation

chore(deps): update all non-major dependencies - #141

chore(deps): update all non-major dependencies#141
renovate[bot] merged 1 commit into
mainfrom
renovate/all-minor-patch

renovate Bot commented Sep 26, 2026 •

edited

Loading

Uh oh!

renovate Bot commented Oct 1, 2026

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants

Conversation

renovate Bot commented Sep 26, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Release Notes

v3.4.16: DOMPurify 3.4.16

Changelog

Others

Breaking Changes

Notable Fixes

Notable Changes

Changelog

What's Changed

cpu

docker

host

mem

net

process

Other Changes

New Contributors

What's Changed

New Contributors

What's Changed

What's Changed

New Contributors

Bug Fixes

Performance Improvements

Documentation

Miscellaneous Chores

Code Refactoring

Tests

Bug Fixes

Miscellaneous Chores

Code Refactoring

Configuration

Uh oh!

renovate Bot commented Oct 1, 2026

ℹ️ Artifact update notice

File name: go.mod

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants

renovate Bot commented Sep 26, 2026 •

edited

Loading

`v3.4.16`: DOMPurify 3.4.16