fix(deps): update non-major dependencies

[renovate]

ℹ️ Note

This PR body was truncated due to platform limits.

This PR contains the following updates:

Package	Change	Age	Confidence
@iconify-json/logos	^1.2.10 → ^1.2.11
@types/node (source)	^20.19.37 → ^20.19.39
@typescript-eslint/eslint-plugin (source)	^8.57.2 → ^8.58.0
@typescript-eslint/parser (source)	^8.57.2 → ^8.58.0
axios (source)	^1.13.6 → ^1.14.0
dotenv	^17.3.1 → ^17.4.0
fast-xml-parser	^5.5.9 → ^5.5.10
nodemailer (source)	^8.0.0 → ^8.0.4
turbo (source)	^2.8.20 → ^2.9.3

---

Release Notes

typescript-eslint/typescript-eslint (@​typescript-eslint/eslint-plugin)

v8.58.0

Compare Source

🚀 Features

• support TypeScript 6 (#​12124)

🩹 Fixes

• eslint-plugin: [prefer-regexp-exec] avoid fixing unknown RegExp flags (#​12161)
• eslint-plugin: [no-extraneous-class] handle index signatures (#​12142)
• eslint-plugin: crash in no-unnecessary-type-arguments (#​12163)

❤️ Thank You

• ej shafran @​ej-shafran
• Evyatar Daud @​StyleShit
• GG ZIBLAKING
• milkboy2564 @​SeolJaeHyeok
• teee32 @​teee32

See GitHub Releases for more information.

You can read about our versioning strategy and releases on our website.

typescript-eslint/typescript-eslint (@​typescript-eslint/parser)

v8.58.0

Compare Source

🚀 Features

• support TypeScript 6 (#​12124)

❤️ Thank You

• Evyatar Daud @​StyleShit

See GitHub Releases for more information.

You can read about our versioning strategy and releases on our website.

axios/axios (axios)

v1.14.0

Compare Source

motdotla/dotenv (dotenv)

v17.4.0

Compare Source

Added

• Add skills/ folder with focused agent skills: skills/dotenv/SKILL.md (core usage) and skills/dotenvx/SKILL.md (encryption, multiple environments, variable expansion) for AI coding agent discovery via the skills.sh ecosystem (npx skills add motdotla/dotenv)

Changed

• Tighten up logs: ◇ injecting env (14) from .env (#​1003)

NaturalIntelligence/fast-xml-parser (fast-xml-parser)

v5.5.10: performance improvment, increase entity expansion default limit

Compare Source

• increase default entity explansion limit as many projects demand for that

maxEntitySize: 10000,
maxExpansionDepth: 10000,
maxTotalExpansions: Infinity,
maxExpandedLength: 100000,
maxEntityCount: 1000,

• performance improvement
  • reduce calls to toString
  • early return when entities are not present
  • prepare rawAttrsForMatcher only if user sets jPath: false

Full Changelog: NaturalIntelligence/fast-xml-parser@v5.5.9...v5.5.10

vercel/turborepo (turbo)

v2.9.3: Turborepo v2.9.3

Compare Source

What's Changed

Changelog

• fix: Preserve per-workspace lockfiles during pnpm pruning by @​anthonyshew in #​12519

Full Changelog: vercel/turborepo@v2.9.2...v2.9.3

v2.9.2: Turborepo v2.9.2

Compare Source

What's Changed

Examples

• feat(examples): Add Next.js + Elysia full-stack starter template by @​eastgold15 in #​12414

Changelog

• docs: Add documentation for cacheMaxAge and cacheMaxSize options by @​anthonyshew in #​12500
• fix: Resolve correct nested bun lockfile versions during prune by @​anthonyshew in #​12506
• Revert "fix: Avoid setsid() in PTY spawn to prevent macOS Gatekeeper CPU spikes" by @​anthonyshew in #​12507
• fix: Unblock watch loop so interruptible persistent tasks restart on file changes by @​anthonyshew in #​12509
• fix(api-client): Treat * as wildcard in preflight Access-Control-Allow-Headers by @​bitttttten in #​12503
• docs: Document turbo.* generator variables by @​anthonyshew in #​12511
• fix: Backfill missing pnpm workspace importer entries during prune by @​anthonyshew in #​12514
• fix: Include transitive dependencies in engine graph pruning for affected paths using Task Graph by @​anthonyshew in #​12516
• fix: Update AI-generated response disclaimer to include human attribution by @​Copilot in #​12517
• fix: Preserve shallow install strategy during npm lockfile pruning by @​anthonyshew in #​12520

New Contributors

• @​eastgold15 made their first contribution in #​12414

Full Changelog: vercel/turborepo@v2.9.1...v2.9.2

v2.9.1: Turborepo v2.9.1

Compare Source

What's Changed

@​turbo/codemod

• feat: Handle package manager catalogs in migration codemod by @​anthonyshew in #​12496

@​turbo/repository

• feat: Add cacheMaxAge and cacheMaxSize for local cache eviction by @​anthonyshew in #​12487

Changelog

• docs: Release post for 2.9 by @​anthonyshew in #​12441

Full Changelog: vercel/turborepo@v2.9.0...v2.9.1

v2.9.0: Turborepo v2.9.0

Compare Source

What's Changed

Docs

• docs: Release post for 2.8 by @​anthonyshew in #​11559
• docs: Update oxc.mdx to include cache false by @​bestickley in #​11571
• docs: Fix curl markdown Accept header syntax in 2.8 release blog by @​marko-hologram in #​11580
• docs: Fix worktree command in blog post by @​anthonyshew in #​11583
• docs: Rename command → subcommand by @​anthonyshew in #​11584
• feat: Add requestType tracking for header-negotiated markdown by @​molebox in #​11585
• fix: Upgrade next to fix HTTP deserialization DoS by @​anthonyshew in #​11597
• fix: Upgrade mermaid to fix lodash-es vulnerability by @​anthonyshew in #​11611
• fix: Upgrade recharts to fix lodash vulnerability by @​anthonyshew in #​11606
• chore: Move applications to apps/ directory by @​anthonyshew in #​11613
• fix: Upgrade rehype packages to fix mdast-util-to-hast vulnerability by @​anthonyshew in #​11616
• chore: Migrate to Ultracite by @​haydenbleasel in #​11948
• fix: Strip JSX components from heading anchors and TOC entries by @​anthonyshew in #​12404

create-turbo

• fix: Upgrade tsup to fix rollup and glob vulnerabilities by @​anthonyshew in #​11601
• fix: Upgrade inquirer to 8.2.7 to fix tmp vulnerability by @​anthonyshew in #​11622
• fix: Upgrade ts-jest to 29.4.6 to fix brace-expansion ReDoS vulnerabilities by @​anthonyshew in #​11623
• feat: Migrate from tsup to tsdown by @​anthonyshew in #​11649
• fix: Upgrade semver to fix ReDoS vulnerability by @​anthonyshew in #​11683
• fix: Upgrade inquirer to remove lodash dependency by @​anthonyshew in #​11709
• fix: Upgrade tsdown in create-turbo to resolve valibot ReDoS vulnerability by @​anthonyshew in #​11702
• fix: Upgrade jest to v30 to resolve brace-expansion ReDoS vulnerability by @​anthonyshew in #​11706
• fix: Recover version numbering to 2.8.9-canary.0 by @​anthonyshew in #​11853
• fix: Sanitize git command inputs in create-turbo by @​anthonyshew in #​11876
• chore: Remove pnpm-eslint .vscode transform from create-turbo by @​anthonyshew in #​12186
• fix: Improve create-turbo connectivity check and offline error messages by @​anthonyshew in #​12257
• feat: Add affectedUsingTaskInputs future flag for task-level --affected detection by @​anthonyshew in #​12247
• fix: Replace dns.lookup with https.get for create-turbo online check by @​anthonyshew in #​12277
• fix: Remove redundant online check from create-turbo by @​anthonyshew in #​12281
• fix: Sort uninstalled package managers to bottom of create-turbo selection by @​anthonyshew in #​12353

turbo-ignore

• fix: Resolve pnpm audit vulnerabilities via dependency bumps by @​anthonyshew in #​12220
• feat: Deprecate turbo-ignore in favor of turbo query affected by @​anthonyshew in #​12382
• fix: Tailored turbo-ignore deprecation notice for Vercel users by @​anthonyshew in #​12385

@​turbo/codemod

• fix: Upgrade axios to fix SSRF vulnerability by @​anthonyshew in #​11599
• fix: Replace axios with native fetch in turbo-codemod by @​anthonyshew in #​11600
• fix: Upgrade diff to fix DoS vulnerabilities by @​anthonyshew in #​11621
• fix: Upgrade tsdown to fix valibot and diff vulnerabilities by @​anthonyshew in #​11766
• fix: Upgrade semver to fix ReDoS vulnerability by @​anthonyshew in #​11765
• fix: Enhance path validation in assertSafeGitArgument by @​odaysec in #​11788
• fix: Guard against missing pipeline key in clean-globs codemod by @​anthonyshew in #​12235
• fix: Stop add-package-names codemod from silently renaming existing packages by @​anthonyshew in #​12332
• fix: Handle Yarn 2+ in @​turbo/codemod install commands by @​anthonyshew in #​12477

eslint

• fix: Upgrade eslint devDependency to fix stack overflow vulnerability by @​anthonyshew in #​11610
• fix: Upgrade esbuild to fix arbitrary request vulnerability by @​anthonyshew in #​11615
• fix: Upgrade Next.js to 16.1.5 to fix DoS vulnerabilities by @​anthonyshew in #​11681
• fix: Upgrade eslint to v10 to resolve @​eslint/plugin-kit ReDoS vulnerability by @​anthonyshew in #​11705
• fix(eslint-plugin-turbo): Guard against missing tasks/pipeline in forEachTaskDef by @​sleitor in #​12411

@​turbo/repository

• fix: Rename cli workspace package to avoid false audit match by @​anthonyshew in #​11767
• perf: Defer TLS initialization to a background thread by @​anthonyshew in #​11967
• fix: Add repository field to @​turbo/repository package.json by @​anthonyshew in #​11982
• release(library): 0.0.1-canary.19 by @​github-actions[bot] in #​11983
• feat: Add experimentalObservability with an OTel backend by @​bkonkle in #​11130
• release(library): 0.0.1-canary.20 by @​github-actions[bot] in #​12116
• chore: Update to Rust 1.94.0 by @​ognevny in #​12192
• feat: Add packagesFromLockfile() NAPI binding to @turbo/repository by @​anthonyshew in #​12454
• release(library): 0.0.1-canary.21 by @​github-actions[bot] in #​12455

Examples

• examples: Update NODE_VERSION to 24.13.1 in Dockerfile by @​i5d6 in #​11591
• fix: escaping for link titles in LinksService by @​odaysec in #​11632
• examples: Update NODE_VERSION to 24.13.1 in Dockerfile by @​i5d6 in #​11679
• docs: Replace mysql refs with postgres by @​kyedavey in #​11827
• feat: Add with-otel example with pre-configured Grafana dashboard by @​anthonyshew in #​12043
• examples: Upgrade with-react-native-web example to use latest versions by @​serjooo in #​12085
• fix: Duplicate /signup? in Vercel URL by @​04cb in #​12088
• examples: Fix markdown links inside code blocks in basic README by @​sleitor in #​11946
• fix: Match vite and @vitejs/plugin-react versions on example by @​GabrielBB in #​12193
• fix: Sync yarn lockfile before upgrading turbo in examples updater by @​anthonyshew in #​12286
• chore: Upgrade Next.js to 16.2.0 in examples and apps by @​anthonyshew in #​12389
• fix(examples): Update of with-svelte example by @​floriansalihovic in #​11952
• fix: Use script-shell=bash for cross-platform with-shell-commands example by @​Goldyvaiiii in #​12436

Changelog

• fix: Support trailing commas in microfrontends JSONC files by @​anthonyshew in #​11573
• perf: Replace third-party crates with Rust std lib equivalents by @​anthonyshew in #​11569
• perf: Reduce duplicate dependency versions by @​anthonyshew in #​11568
• chore: Remove legacy Go/goreleaser buildcontainer directory by @​anthonyshew in #​11576
• chore: Rename README.md to RULE.md in skills directory by @​anthonyshew in #​11582
• fix: Validate turbo version from lockfile for all package managers by @​anthonyshew in #​11587
• fix: Add allowComments and allowTrailingCommas to turbo.json schema by @​ddmoney420 in #​11579
• chore: Eliminate ts-rs serde attribute parse warnings by @​anthonyshew in #​11589
• fix: Extract git argument validation into reusable helper by @​anthonyshew in #​11593
• fix: Upgrade fast-xml-parser to fix RangeError DoS by @​anthonyshew in #​11598
• fix: Upgrade semver to fix ReDoS vulnerability by @​anthonyshew in #​11596
• fix: Upgrade tar to fix security vulnerabilities by @​anthonyshew in #​11602
• fix: Upgrade @​actions/github to fix @​octokit vulnerabilities by @​anthonyshew in #​11607
• fix: Upgrade @​vercel/blob and @​actions packages to fix undici vulnerability by @​anthonyshew in #​11608
• docs: Running Root Tasks by @​Netail in #​11630
• Update README.md title and remove features section by @​anthonyshew in #​11651
• docs: Update using-environment-variables.mdx by @​anthonyshew in #​11652
• fix: Upgrade js-yaml to address CVE-2025-64718 by @​alexmkio in #​11650
• fix: Remove smooth scrolling from docs by @​anthonyshew in #​11654
• fix: Add sitemap link to 404 page and fix TurborepoLogo gradient by @​anthonyshew in #​11655
• fix: Upgrade capnp to 0.24 by @​anthonyshew in #​11656
• fix: Upgrade h2 to fix CONTINUATION Flood by @​anthonyshew in #​11658
• fix: Upgrade crossbeam-channel to 0.5.15 by @​anthonyshew in #​11657
• chore: Remove abandoned turbo clone command by @​anthonyshew in #​11673
• fix: Upgrade rustls and ring by @​anthonyshew in #​11659
• fix: Upgrade openssl to 0.10.75 by @​anthonyshew in #​11660
• fix: Replace unmaintained adler with adler2 by @​anthonyshew in #​11661
• fix: Upgrade tar to 7.5.7 to address security vulnerabilities by @​anthonyshew in #​11680
• fix: Upgrade ts-json-schema-generator to fix glob command injection vulnerability by @​anthonyshew in #​11684
• fix: Upgrade fumadocs and shiki in docs to resolve mdast-util-to-hast vulnerability by @​anthonyshew in #​11704
• fix: Replace ts-node with tsx to resolve diff DoS vulnerability by @​anthonyshew in #​11708
• fix: Upgrade bytes to >=1.11.1 to fix RUSTSEC-2026-0007 by @​anthonyshew in #​11715
• chore: Update ratatui dependencies (paste blocked upstream) by @​anthonyshew in #​11717
• Revert "chore: Update ratatui dependencies (paste blocked upstream)" by @​anthonyshew in #​11722
• fix: Upgrade ratatui to 0.30.0 to drop unmaintained paste crate by @​anthonyshew in #​11723
• chore: Upgrade reqwest toward addressing RUSTSEC-2025-0134 by @​anthonyshew in #​11718
• fix(docs): Fix code syntax highlighting by using correct Shiki CSS variable names by @​anthonyshew in #​11726
• fix: Upgrade async-io to 2.x to drop unmaintained instant crate by @​anthonyshew in #​11719
• fix: Migrate from unmaintained serde_yaml to serde_yml by @​anthonyshew in #​11720
• fix: Upgrade test-case and merge to drop unmaintained proc-macro-error by @​anthonyshew in #​11721
• fix: Upgrade indicatif to 0.18.3 to drop unmaintained number_prefix by @​anthonyshew in #​11716
• refactor: Centralize configuration resolution funnel by @​anthonyshew in #​11727
• fix: Upgrade rustls chain to resolve RUSTSEC-2025-0134 by @​anthonyshew in #​11739
• fix: Upgrade test-case to resolve transitive proc-macro-error by @​anthonyshew in #​11737
• fix: Upgrade pest/pest_derive to resolve yanked version by @​anthonyshew in #​11734
• fix: Upgrade git2 to fix RUSTSEC-2026-0008 by @​anthonyshew in #​11729
• fix: Upgrade pprof to fix RUSTSEC-2024-0408 by @​anthonyshew in #​11730
• fix: Upgrade portable-pty to resolve RUSTSEC-2017-0008 by @​anthonyshew in #​11732
• fix: Upgrade oxc_resolver to resolve yanked papaya dependency by @​anthonyshew in #​11733
• fix: Upgrade futures/futures-util to resolve yanked futures-util 0.3.30 by @​anthonyshew in #​11735
• fix: Replace unic-segment with unicode-segmentation in globwatch by @​anthonyshew in #​11736
• fix: Replace serde_yml with serde_yaml_ng to fix RUSTSEC-2025-0067/0068 by @​anthonyshew in #​11755
• fix: Replace oxc_resolver with unrs_resolver to fix yanked papaya dependency by @​anthonyshew in #​11754
• fix: Upgrade node-plop to 0.32.3 by @​anthonyshew in #​11756
• docs: Capitalizaiton in update github-actions.mdx by @​anthonyshew in #​11762
• fix: Add Vary: Accept header to docs markdown endpoint by @​molebox in #​11759
• chore: Agentic workflows app by @​anthonyshew in #​11773
• chore: Add internal agents app for repo automation by @​anthonyshew in #​11776
• chore: Update reproduction request message by @​anthonyshew in #​11778
• Revert "fix: Upgrade node-plop to 0.32.3" by @​anthonyshew in #​11780
• chore: Add internal agents app for repo automation by @​anthonyshew in #​11781
• feat: Add internal agents app for repo automation by @​anthonyshew in #​11783
• chore: Manual audits by @​anthonyshew in #​11785
• chore: Fixing audit agent by @​anthonyshew in #​11786
• chore: Still iterating on sec audit fixer by @​anthonyshew in #​11787
• fix: Emit space for empty vt100 cells to fix TUI repaint on task switch by @​anthonyshew in #​11789
• fix: Keep stdin alive for persistent tasks in stream mode by @​anthonyshew in #​11793
• feat: Add internal agents app for repo automation by @​anthonyshew in #​11799
• chore: Add env vars by @​anthonyshew in #​11800
• fix: Handle subpath package imports in turbo boundaries by @​anthonyshew in #​11798
• feat: Add dashboard with run tracking and live logs for agent sandboxes by @​anthonyshew in #​11802
• fix: Normalize bare LF to CRLF in TUI output to prevent garbled logs by @​anthonyshew in #​11804
• fix: Use private blob store access in agents app by @​anthonyshew in #​11811
• fix: Pass non-empty body when initializing blob log files by @​anthonyshew in #​11812
• docs: Geistdocs update by @​haydenbleasel in #​11807
• fix: Allow overwriting existing blobs in run updates and log appends by @​anthonyshew in #​11813
• docs: Geistdocs update 2 by @​haydenbleasel in #​11814
• fix: Set 5-hour timeout on security audit sandbox by @​anthonyshew in #​11815
• fix: Resolve Windows TUI hang caused by portable-pty 0.9.0 ConPTY changes by @​anthonyshew in #​11816
• fix: Repair audit fixer log streaming and replace git push with patch upload by @​anthonyshew in #​11818
• chore: Small stuff for agent fixer by @​anthonyshew in #​11819
• chore: Bump tonic to 0.14 by @​anthonyshew in #​11820
• fix: Pin @​turbo/gen version to match the running turbo binary by @​anthonyshew in #​11822
• fix: Use secret_key_override in tests to eliminate env var race condition by @​anthonyshew in #​11824
• fix: Avoid panic in sandboxed environments by removing system-configuration dependency by @​anthonyshew in #​11828
• fix: Harden token protection with secrecy crate and close exposure gaps by @​anthonyshew in #​11831
• fix: Clean up orphaned Windows child processes on shutdown by @​anthonyshew in #​11829
• chore: Update lockfile for release by @​anthonyshew in #​11840
• fix: Sync lockfile with @​turbo/gen optionalDependencies by @​anthonyshew in #​11845
• docs: Update Vitest guide with projects configuration by @​PeterPCW in #​11760
• fix: Prevent premature git tag push during release staging by @​anthonyshew in #​11851
• fix: Replace unsafe pre_exec/setsid with tokio process_group(0) by @​anthonyshew in #​11854
• fix: Resolve external npm packages in @​turbo/gen compiled binary (#​11855) by @​anthonyshew in #​11856
• fix: Move node-plop to dependencies so PlopTypes resolves for consumers by @​anthonyshew in #​11862
• chore: Use 2024 edition in more packages, do not ignore some clippy l… by @​ognevny in #​11860
• perf: Optimize hot-path hash computation by avoiding clones and using unstable sorts by @​anthonyshew in #​11872
• perf: Replace twox-hash with xxhash-rust and optimize file hashing by @​anthonyshew in #​11874
• fix: Restrict credential file permissions to owner-only by @​anthonyshew in #​11870
• perf: Reduce allocations in globwalk by @​anthonyshew in #​11528
• perf: Replace O(V³) Floyd-Warshall with O(V+E) DFS in watch mode subgraph creation by @​anthonyshew in #​11878
• feat: Generate LLM-friendly markdown alongside --profile trace output by @​anthonyshew in #​11880
• feat: Make --profile and --anon-profile filename optional by @​anthonyshew in #​11883
• perf: Batch per-package git subprocess calls into repo-wide index by @​anthonyshew in #​11887
• perf: Parallelize and pre-build RepoGitIndex by @​anthonyshew in #​11889
• perf: Pre-compile glob exclusion filter and cache path prefix in file hashing by @​anthonyshew in #​11891
• fix: Get all pnpm lockfile pruning tests passing by @​anthonyshew in #​11897
• perf: Optimize pnpm lockfile transitive closure resolution by @​anthonyshew in #​11898
• fix: Resolve npm packages in @​turbo/gen compiled binary by @​anthonyshew in #​11900
• perf: Deduplicate file hashing and parallelize globwalks by @​anthonyshew in #​11902
• perf: Improve transitive dependency resolution cache sharing across workspaces by @​anthonyshew in #​11903
• perf: Reduce filesystem syscalls in globwalk, SCM hashing, and task scheduling by @​anthonyshew in #​11907
• feat: Remove daemon from turbo run, deprecate daemon flags and config by @​anthonyshew in #​11910
• test: Replace help text integration tests with insta snapshots by @​anthonyshew in #​11911
• perf: Reduce allocations in SCM hashing, glob preprocessing, and cache lookups by @​anthonyshew in #​11916
• perf: Parallelize package.json loading and reduce builder allocations by @​anthonyshew in #​11918
• perf: Cache compiled env wildcard regexes for builtin pass-through patterns by @​anthonyshew in #​11920
• perf: Replace O(N) workspace path lookup with HashMap index in DependencySplitter by @​anthonyshew in #​11922
• perf: Parallelize lockfile parsing with workspace discovery by @​anthonyshew in #​11927
• perf: Optimize turbo run hotpath with parallelization and reduced allocations by @​anthonyshew in #​11928
• perf: Share HTTP client and improve profile instrumentation by @​anthonyshew in #​11929
• perf: Share HTTP client and improve profile instrumentation by @​anthonyshew in #​11932
• perf: Reduce git subprocess calls on startup by @​anthonyshew in #​11934
• chore: Upgrade zstd 0.12.3 to 0.13.3 by @​anthonyshew in #​11936
• perf: Replace git subprocesses with libgit2 and skip unnecessary summary work by @​anthonyshew in #​11938
• perf: Reduce per-package hashing overhead and eliminate SCM subprocesses by @​anthonyshew in #​11942
• perf: Reduce CPU overhead in turbo run hot path by @​anthonyshew in #​11947
• perf: Replace libgit2 git status with gix-index for faster file hashing by @​anthonyshew in #​11950
• perf: Resolve literal input paths via stat instead of glob walk by @​anthonyshew in #​11955
• perf: Optimize engine builder, task visitor, and untracked file discovery by @​anthonyshew in #​11956
• perf: Parallelize turbo run pre-execution hot path by @​anthonyshew in #​11958
• chore: Add tracing spans to uninstrumented hot path functions by @​anthonyshew in #​11959
• perf: Use Arc<str> for task dependency hashes to avoid heap clones by @​anthonyshew in #​11962
• perf: Add more tracing spans into startup path by @​anthonyshew in #​11965
• perf: Parallelize task hash computation across topological waves by @​anthonyshew in #​11969
• perf: Send engine callback before tracker bookkeeping and add tracing spans by @​anthonyshew in #​11970
• fix: Resolve git_root to worktree root in linked worktrees by @​anthonyshew in #​11974
• perf: Fast path for shallow wildcard glob patterns in workspace discovery by @​anthonyshew in #​11972
• chore: Move git hooks from pre-commit to pre-push and match CI lint checks by @​anthonyshew in #​11977
• chore: Update AGENTS.md by @​anthonyshew in #​11978
• perf: Replace heap-allocated String with stack-allocated OidHash for git OIDs by @​anthonyshew in #​11984
• perf: Eliminate redundant syscalls in FSCache fetch and exists by @​anthonyshew in #​11985
• perf: Reduce per-task allocations in visitor dispatch loop by @​anthonyshew in #​11986
• docs: Fix same-page anchor links that don't scroll to target by @​anthonyshew in #​11989
• docs: Mention inputs key in package hash inputs table by @​anthonyshew in #​11990
• fix(docs): update sitemap.md to single-line pipe-delimited format by [@​molebox](https://redirect.git

---

Configuration

📅 Schedule: Branch creation - Between 12:00 AM and 03:59 AM, only on Monday ( * 0-3 * * 1 ) (UTC), Automerge - At any time (no schedule defined).

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.