chore(deps): update all non-major dependencies by renovate[bot] · Pull Request #42 · dankerow/rawgo-api

renovate · 2026-05-14T14:24:44Z

This PR contains the following updates:

Package	Change	Age	Confidence
@types/node (source)	`^22.19.19` → `^22.20.0`
mongodb	`^7.2.0` → `^7.3.0`
pnpm (source)	`10.33.4` → `10.34.4`
sharp (source, changelog)	`^0.34.5` → `^0.35.2`
tsx (source)	`^4.21.0` → `^4.22.4`
typescript-eslint (source)	`^8.59.3` → `^8.62.0`

Release Notes

mongodb/node-mongodb-native (mongodb)

`v7.3.0`

Compare Source

Features

NODE-7518: bump maxWireVersion (#4950) (4447050)

Bug Fixes

NODE-7548: SCRAM authentication fails on non-Node runtimes (#4932) (a10d2c9)

pnpm/pnpm (pnpm)

Patch Changes

Reject pnpm-lock.yaml entries whose remote tarball resolution: block is missing the integrity field. Previously the worker that extracts a downloaded tarball skipped hash verification when no integrity was supplied and minted a fresh one from the unverified bytes, so an attacker who could both alter the lockfile (e.g. via a pull request that strips integrity:) and serve modified content at the referenced tarball URL could install a tampered package without any error — including under --frozen-lockfile. pnpm now fails closed at lockfile-read time with ERR_PNPM_MISSING_TARBALL_INTEGRITY. Git-hosted tarballs (gitHosted: true or a URL on codeload.github.com / bitbucket.org / gitlab.com) and file: tarballs are exempt — the commit SHA in a git-host URL and the user-controlled local path already anchor the bytes.

Platinum Sponsors

Gold Sponsors

`v10.34.0`: pnpm 10.34

Compare Source

Minor Changes

Treat tarball-integrity mismatches against the lockfile as a hard failure by default. Previously, pnpm install (non-frozen) would log ERR_PNPM_TARBALL_INTEGRITY, silently re-resolve from the registry, and overwrite the locked integrity — which meant a compromised registry, proxy, or republished version could substitute attacker-controlled content on a clean machine even though the project shipped a committed lockfile.

pnpm install now exits with ERR_PNPM_TARBALL_INTEGRITY and a hint pointing at the new opt-in flag.

The only opt-in is pnpm install --update-checksums — narrowly scoped to refreshing the locked integrity values from what the registry currently serves. Mirrors yarn's flag of the same name. A warning still prints when the bypass takes effect so the operation is auditable.

--force and pnpm update deliberately do not bypass the integrity check. They are routine refresh operations; silently overwriting a locked integrity in those flows would erase the protection a committed lockfile is supposed to provide. --frozen-lockfile behavior is unchanged. --fix-lockfile keeps its documented purpose (filling in missing lockfile entries) and is also not a bypass.

Patch Changes

Pin unscoped per-registry settings (_authToken, _auth, username/_password, tokenHelper, inline cert/key) to the registry declared in the same config source at load time, so a later layer overriding registry= (workspace .npmrc, pnpm-workspace.yaml, CLI --registry) cannot redirect a credential or client certificate authored for a different host. A deprecation warning is emitted whenever an unscoped per-registry setting is encountered, naming the source and the URL it was pinned to. Reported by JUNYI LIU.
Fixed minimumReleaseAge handling when cached metadata is abbreviated. The npm registry returns abbreviated package metadata (without the per-version time field) by default, which made the maturity check throw ERR_PNPM_MISSING_TIME whenever cached abbreviated metadata was reused. pnpm now upgrades cached abbreviated metadata to the full document via a follow-up fetch when minimumReleaseAge is active, persists the upgrade to the on-disk cache so subsequent installs skip the extra fetch, and lets ERR_PNPM_MISSING_TIME from the cache fast-path fall through to the network fetch even under strict mode.
Reject git resolutions whose commit field is not a 40-character hexadecimal SHA before invoking git. A malicious lockfile could otherwise smuggle a value such as --upload-pack=<command> through git fetch / git checkout, which on SSH or local-file transports executes the supplied command.
Reject patch files whose diff --git headers reference paths outside the patched package directory. Previously a malicious .patch file added via a pull request could write, delete, or rename arbitrary files reachable by the user running pnpm install.
Fixed --prefix=<dir> not being honored when locating the workspace root. The --prefix → dir rename was applied after workspace detection, so workspace settings declared in <dir>/pnpm-workspace.yaml were not loaded when pnpm was invoked from outside <dir> #11535.
Reject dependency aliases that contain path-traversal segments (such as @x/../../../../../.git/hooks) when reading them from a package manifest or symlinking them into node_modules. A malicious registry package could otherwise use a transitive dependency key to make pnpm install create symlinks at attacker-chosen paths outside the intended node_modules directory.

Platinum Sponsors

Gold Sponsors

lovell/sharp (sharp)

`v0.35.2`

Compare Source

`v0.35.1`

Compare Source

TypeScript: Ensure type definitions are published for both ESM and CJS.
#4537
WebAssembly: Ensure wrapper file is published.
#4538

`v0.35.0`

Compare Source

Breaking: Drop support for Node.js 18, now requires Node.js >= 20.9.0.
Breaking: Remove install script from package.json file.
Compiling from source is now opt-in via the build script.
Breaking: Lossy AVIF output is now tuned using SSIMULACRA2-based iq quality metrics.
Breaking: Add limitInputChannels with a default value of 5.
Breaking: Remove deprecated failOnError constructor property.
Breaking: Remove deprecated paletteBitDepth from metadata response.
Breaking: Remove deprecated properties from sharpen operation.
Breaking: Rename format.jp2k as format.jp2 for API consistency.
Upgrade to libvips v8.18.3 for upstream bug fixes.
Remove experimental status from WebAssembly binaries.
Add prebuilt binaries for FreeBSD (WebAssembly).
Deprecate Windows 32-bit (win32-ia32) prebuilt binaries.
Ensure TIFF output bitdepth option is limited to 1, 2 or 4.
Add AVIF/HEIF tune option for control over quality metrics.
#4227
Add keepGainMap and withGainMap to process HDR JPEG images with embedded gain maps.
#4314
Add toUint8Array for output image as a TypedArray backed by a transferable ArrayBuffer.
#4355
Require prebuilt binaries using static paths to aid code bundling.
#4380
TypeScript: Ensure FormatEnum keys match reality.
#4475
Add margin option to trim operation.
#4480
@eddienubes
Ensure HEIF primary item is used as default page/frame.
#4487
Add image Media Type (MIME Type) to metadata response.
#4492
Add withDensity to set output density in EXIF metadata.
#4496
Improve pkg-config path discovery.
#4504
Add WebP exact option for control over transparent pixel colour values.
Add support for ECMAScript Modules (ESM).
#4509
@florian-lefebvre

privatenumber/tsx (tsx)