chore(deps): update all non-major dependencies

[renovate]

This PR contains the following updates:

Package	Change	Age	Confidence	Type	Update
@types/node (source)	24.10.9 → 24.10.10			devDependencies	patch
github.com/alecthomas/chroma/v2	v2.23.0 → v2.23.1			require	patch
github.com/puzpuzpuz/xsync/v4	v4.3.0 → v4.4.0			require	minor
github.com/zeebo/xxh3	v1.0.2 → v1.1.0			require	minor
go (source)	1.25.6 → 1.25.7			toolchain	patch
go.yaml.in/yaml/v4	v4.0.0-rc.3 → v4.0.0-rc.4			require	patch
netlify-cli	23.13.4 → 23.15.1			devDependencies	minor
pnpm (source)	10.28.1+sha512.7d7dbbca9e99447b7c3bf7a73286afaaf6be99251eb9498baefa7d406892f67b879adb3a1d7e687fc4ccc1a388c7175fbaae567a26ab44d1067b54fcb0d6a316 → 10.28.2			packageManager	patch
prettier (source)	3.8.0 → 3.8.1			devDependencies	patch
vitepress-plugin-llms	1.10.0 → 1.11.0			devDependencies	minor

---

Release Notes

alecthomas/chroma (github.com/alecthomas/chroma/v2)

v2.23.1

Compare Source

Changelog

• 5b4188b fix: remove AGPL licensed testdata
• b9b4edc Add .env.* pattern to bash lexer (#​1197)
• f163adc docs: add AGENTS.md
• fe6f0f3 fix: title link to Chroma

puzpuzpuz/xsync (github.com/puzpuzpuz/xsync/v4)

v4.4.0

Compare Source

• Micro-optimize Map for integer keys #​185
• Add Map.RangeRelaxed method for faster map iteration #​187
• Add Map.DeleteMatching method for batch entry deletion #​186

Read-heavy operations on Map with integer keys are now 24-29% faster due to a more efficient hash function, as well as a number of micro-optimizations.

RangeRelaxed is a much faster (~11x), lock-free alternative to Range. The downside is that the same key may be visited by RangeRelaxed more than once if it is concurrently deleted and re-inserted during the iteration. RangeRelaxed should be preferred over Range in all cases when weaker consistency is acceptable.

m := xsync.NewMap[string, int]()
m.Store("alice", 10)
m.Store("bob", 20)
m.Store("carol", 30)
m.Store("dave", 40)

// Iterate map entries and calculate sum of all values.
sum := 0
m.RangeRelaxed(func(key string, value int) bool {
	sum += value
	return true // continue iteration
})

DeleteMatching deletes all entries for which the delete return value of the input function is true. If the cancel return value is true, the iteration stops immediately. The function returns the number of deleted entries. The call locks a hash table bucket for the duration of evaluating the function for all entries in the bucket and performing deletions. It performs up to 20% faster than Range + Delete, yet if the percentage of the entries to-be-deleted is low, RangeRelaxed + Delete combination should be more efficient.

// Delete entries with value greater than 25.
deleted := m.DeleteMatching(func(key string, value int) (delete, cancel bool) {
	return value > 25, false
})

zeebo/xxh3 (github.com/zeebo/xxh3)

v1.1.0

Compare Source

golang/go (go)

v1.25.7

yaml/go-yaml (go.yaml.in/yaml/v4)

v4.0.0-rc.4

Compare Source

netlify/cli (netlify-cli)

v23.15.1

Compare Source

Bug Fixes

• deps: update dependency ansi-escapes to v7.2.0 (#​7919) (5f58186)
• deps: update dependency ci-info to v4.4.0 (#​7930) (3434c65)
• deps: update dependency dot-prop to v10 (#​7931) (6727067)
• deps: update dependency env-paths to v4 (#​7932) (284a6fa)
• deps: upgrade express to v5 and http-proxy-middleware to v3 (#​7927) (6414c14)

v23.15.0

Compare Source

Features

• use site caps for AIG gating, add support to dev-exec and serve (#​7904) (f33a839)

Bug Fixes

• deploy: add normalize content in deploy command (#​7908) (c5317e3)
• deps: bump @​isaacs/brace-expansion from 5.0.0 to 5.0.1 (#​7926) (d18c7a6)
• deps: pin dependency @​netlify/images to 1.2.5 (#​7897) (ac561d1)
• deps: update dependency find-up to v8 (#​7920) (fef2c08)
• deps: update dependency open to v11 (#​7921) (2f32c3a)
• deps: update dependency p-wait-for to v6 (#​7922) (827d71a)
• deps: update dependency read-package-up to v12 (#​7923) (71e8517)
• deps: update dependency terminal-link to v5 (#​7917) (ea72f39)
• deps: update dependency uuid to v13 (#​7924) (64f2819)
• deps: update netlify packages (#​7915) (6a26e81)
• deps: upgrade fastify and tar [security] (#​7913) (3dff328)

v23.14.0

Compare Source

Features

• ai gateway disabled check (#​7891) (4a57375)
• init: mention detected framework when presenting build settings (#​7828) (f5b3588)

Bug Fixes

• address flaky integration tests (#​7890) (a329330)
• deps: bump tar from 7.5.3 to 7.5.6 (#​7883) (d563fac)
• deps: update dependency @​netlify/edge-functions to v3.0.3 (#​7860) (803c6ae)
• deps: update dependency lodash to v4.17.23 [security] (#​7885) (e0fe8dc)
• deps: update netlify packages (#​7895) (63e1eea)
• refactor image handling to use @netlify/images (#​7584) (321170d)

v23.13.5

Compare Source

Bug Fixes

• deps: bump tar from 7.5.2 to 7.5.3 (#​7871) (3e7c3a0)
• deps: update netlify packages (#​7873) (be07b3c)

pnpm/pnpm (pnpm)

v10.28.2: pnpm 10.28.2

Compare Source

Patch Changes

• Security fix: prevent path traversal in directories.bin field.

• When pnpm installs a file: or git: dependency, it now validates that symlinks point within the package directory. Symlinks to paths outside the package root are skipped to prevent local data from being leaked into node_modules.

  This fixes a security issue where a malicious package could create symlinks to sensitive files (e.g., /etc/passwd, ~/.ssh/id_rsa) and have their contents copied when the package is installed.

  Note: This only affects file: and git: dependencies. Registry packages (npm) have symlinks stripped during publish and are not affected.

• Fixed optional dependencies to request full metadata from the registry to get the libc field, which is required for proper platform compatibility checks #​9950.

Platinum Sponsors

Gold Sponsors

prettier/prettier (prettier)

v3.8.1

Compare Source

okineadev/vitepress-plugin-llms (vitepress-plugin-llms)

v1.11.0

Compare Source

    🩹 Fixes

• Fix rewrites path resolution on Windows  -  by @​okineadev (12791)

   💖 Contributors

• @​okineadev

     View changes on GitHub

---

Configuration

📅 Schedule: Branch creation - Between 12:00 AM and 03:59 AM, only on Monday ( * 0-3 * * 1 ) (UTC), Automerge - At any time (no schedule defined).

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

[renovate]

ℹ️ Artifact update notice

File name: go.mod

In order to perform the update(s) described in the table above, Renovate ran the go get command, which resulted in the following additional change(s):

• 1 additional dependency was updated

Details:

Package	Change
github.com/klauspost/cpuid/v2	v2.2.7 -> v2.2.10

[andreynering]

go.yaml.in/yaml/v4 has breaking changes. We need to figure it out how to adjust or if this is a bug on the package.