Update all non-major dependencies - autoclosed

[renovate]

This PR contains the following updates:

Package	Change	Age	Confidence	Type	Update
@types/node (source)	22.19.3 → 22.19.7			devDependencies	patch
@typescript/native-preview (source)	7.0.0-dev.20260126.1 → 7.0.0-dev.20260201.1			devDependencies	patch
pnpm (source)	10.25.0 → 10.28.2			packageManager	minor
prettier (source)	3.7.4 → 3.8.1			devDependencies	minor
zizmorcore/zizmor-action	v0.3.0 → v0.4.1			action	minor

---

Release Notes

microsoft/typescript-go (@​typescript/native-preview)

v7.0.0-dev.20260201.1

Compare Source

v7.0.0-dev.20260131.1

Compare Source

v7.0.0-dev.20260130.1

Compare Source

v7.0.0-dev.20260129.1

Compare Source

v7.0.0-dev.20260128.1

Compare Source

v7.0.0-dev.20260127.1

Compare Source

pnpm/pnpm (pnpm)

v10.28.2: pnpm 10.28.2

Compare Source

Patch Changes

• Security fix: prevent path traversal in directories.bin field.

• When pnpm installs a file: or git: dependency, it now validates that symlinks point within the package directory. Symlinks to paths outside the package root are skipped to prevent local data from being leaked into node_modules.

  This fixes a security issue where a malicious package could create symlinks to sensitive files (e.g., /etc/passwd, ~/.ssh/id_rsa) and have their contents copied when the package is installed.

  Note: This only affects file: and git: dependencies. Registry packages (npm) have symlinks stripped during publish and are not affected.

• Fixed optional dependencies to request full metadata from the registry to get the libc field, which is required for proper platform compatibility checks #​9950.

Platinum Sponsors

Gold Sponsors

v10.28.1

Compare Source

v10.28.0

Compare Source

v10.27.0

Compare Source

v10.26.2: pnpm 10.26.2

Compare Source

Patch Changes

• Improve error message when a package version exists but does not meet the minimumReleaseAge constraint. The error now clearly states that the version exists and shows a human-readable time since release (e.g., "released 6 hours ago") #​10307.

• Fix installation of Git dependencies using annotated tags #​10335.

  Previously, pnpm would store the annotated tag object's SHA in the lockfile instead of the actual commit SHA. This caused ERR_PNPM_GIT_CHECKOUT_FAILED errors because the checked-out commit hash didn't match the stored tag object hash.

• Binaries of runtime engines (Node.js, Deno, Bun) are written to node_modules/.bin before lifecycle scripts (install, postinstall, prepare) are executed #​10244.

• Try to avoid making network calls with preferOffline #​10334.

Platinum Sponsors

Gold Sponsors

v10.26.1: pnpm 10.26.1

Compare Source

Patch Changes

• Don't fail on pnpm add, when blockExoticSubdeps is set to true #​10324.
• Always resolve git references to full commits and ensure HEAD points to the commit after checkout #​10310.

Platinum Sponsors

Gold Sponsors

v10.26.0

Compare Source

prettier/prettier (prettier)

v3.8.1

Compare Source

v3.8.0

Compare Source

diff

🔗 Release note

zizmorcore/zizmor-action (zizmorcore/zizmor-action)

v0.4.1

Compare Source

This version fixes an error in the 0.4.0 release that prevented non-relative use
of the action.

What's Changed

• Fix version file path by @​woodruffw in #​83

Full Changelog: zizmorcore/zizmor-action@v0.4.0...v0.4.1

v0.4.0

Compare Source

This new version of zizmor-action brings two major changes:

• The new fail-on-no-inputs option can be used to control whether
  zizmor-action fails if no inputs were collected by zizmor. The default
  remains true, reflecting the pre-existing behavior.

• The action's use of the official zizmor Docker images is now fully
  hash-checked internally, preventing accidental or malicious modification
  to the images. This also means that subsequent releases of zizmor
  will induce a release of this action, rather than the action always picking
  up the latest version by default.

What's Changed

• docs: extended permissions required for internal repos by @​AntoineSebert in #​61
• docs: clarify description of "token" to indicate it is only used for online audits by @​rmuir in #​63
• Hash-check zizmor Docker images by @​woodruffw in #​68
• Add fail-on-no-inputs option by @​woodruffw in #​67

New Contributors

• @​AntoineSebert made their first contribution in #​61
• @​rmuir made their first contribution in #​63

Full Changelog: zizmorcore/zizmor-action@v0.3.0...v0.4.0

---

Configuration

📅 Schedule: Branch creation - Between 12:00 AM and 03:59 AM, on day 1 of the month ( * 0-3 1 * * ) (UTC), Automerge - At any time (no schedule defined).

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

[renovate]

⚠️ Artifact update problem

Renovate failed to update an artifact related to this branch. You probably do not want to merge this PR as-is.

♻ Renovate will retry this branch, including artifacts, only when one of the following happens:

• any of the package files in this branch needs updating, or
• the branch becomes conflicted, or
• you click the rebase/retry checkbox if found above, or
• you rename this PR's title to start with "rebase!" to trigger it manually

The artifact failure details are included below:

File name: pnpm-lock.yaml

 ERR_PNPM_NO_MATURE_MATCHING_VERSION  Version 7.0.0-dev.20260201.1 (released 7 hours ago) of @typescript/native-preview does not meet the minimumReleaseAge constraint

This error happened while installing a direct dependency of /tmp/renovate/repos/github/beeequeue/binary-util

The latest release of @typescript/native-preview is "7.0.0-dev.20260201.1". Published at 2/1/2026 8:00:14 AM

If you need the full list of all 248 published versions run "$ pnpm view @typescript/native-preview versions".

If you want to install the matched version ignoring the time it was published, you can add the package name to the minimumReleaseAgeExclude setting. Read more about it: https://pnpm.io/settings#minimumreleaseageexclude
Progress: resolved 1, reused 0, downloaded 0, added 0