#25299 Dependency Dashboard

This issue lists Renovate updates and detected dependencies. Read the [Dependency Dashboard](https://docs.renovatebot.com/key-concepts/dashboard/) docs to learn more. Before approving any upgrade: read the description and comments in the [`renovate.json5` file](https://redirect.github.com/mastodon/mastodon/blob/main/.github/renovate.json5). ## Repository Problems These problems occurred while renovating this repository. [View logs](https://developer.mend.io//github/mastodon/mastodon). - ⚠️ WARN: Some release(s) did not have a releaseTimestamp, but as we're running with minimumReleaseAgeBehaviour=timestamp-optional, proceeding. See debug logs for more information - ⚠️ WARN: Custom registries are not allowed for this datasource and will be ignored - ⚠️ WARN: Some upgrade(s) did not have a releaseTimestamp, but as we're running with minimumReleaseAgeBehaviour=timestamp-optional, proceeding. See debug logs for more information ## Deprecations / Replacements > [!WARNING] The following dependencies are either deprecated or have replacements available. | Datasource | Package | Replacement PR? | |------------|------|--------------| | npm | [@github/webauthn-json](https://redirect.github.com/github/webauthn-json) | ![Unavailable](https://img.shields.io/badge/unavailable-orange?style=flat-square) | ## Pending Approval The following branches are pending approval. To create them, click on a checkbox below. - [ ] Update dependency history to v5 - [ ] Update dependency redis to v6 - [ ] Update postgres Docker tag to v18 - [ ] Update react-router monorepo (major) (`react-router`, `react-router-dom`) - [ ] **Create all pending approval PRs at once** ## Awaiting Schedule The following updates are awaiting their schedule. To get an update now, click on a checkbox below. - [ ] Update docker.elastic.co/elasticsearch/elasticsearch Docker tag to v8.19.21 - [ ] Update eslint (non-major) (`@eslint/js`, `eslint-plugin-formatjs`, `eslint-plugin-jsdoc`, `eslint-plugin-storybook`, `globals`, `typescript-eslint`) - [ ] Update peter-evans/create-pull-request action to v8.1.1 - [ ] Update DefinitelyTyped types (non-major) (`@types/pg`, `@types/react`, `@types/react-dom`) - [ ] Update devDependencies (non-major) (`@formatjs/cli`, `@testing-library/dom`, `@testing-library/react`, `@vitest/coverage-v8`, `@vitest/ui`, `lint-staged`, `oxfmt`, `stylelint`, `type-fest`) - [ ] Update docker/dockerfile Docker tag to v1.27 - [ ] Update libretranslate/libretranslate Docker tag to v1.9.6 - [ ] Update mcr.microsoft.com/devcontainers/ruby Docker tag to v4.1 - [ ] Update storybook (non-major) (`@storybook/addon-a11y`, `@storybook/addon-docs`, `@storybook/addon-vitest`, `@storybook/react-vite`, `chromatic`, `msw`, `msw-storybook-addon`, `storybook`) - [ ] Update actions/cache action to v6 - [ ] Update actions/checkout action to v7 - [ ] Update actions/setup-node action to v7 - [ ] Update artifact actions (major) (major) (`actions/download-artifact`, `actions/upload-artifact`) - [ ] Update chromaui/action action to v18 - [ ] Update codecov/codecov-action action to v7 - [ ] Update crowdin/github-action action to v3 - [ ] Update docker.elastic.co/elasticsearch/elasticsearch Docker tag to v9 - [ ] Update docker/build-push-action action to v7 - [ ] Update docker/login-action action to v4 - [ ] Update docker/metadata-action action to v6 - [ ] Update docker/setup-buildx-action action to v4 - [ ] Update dorny/paths-filter action to v4 - [ ] Update redis Docker tag to v8 - [ ] Lock file maintenance - [ ] **Create all awaiting schedule PRs at once** ## Pending Status Checks The following updates await pending status checks. To force their creation now, click on a checkbox below. - [ ] Update dependency @formatjs/unplugin to v1.2.11 - [ ] Update dependency @unhead/react to v3.4.1 - [ ] Update dependency aws-sdk-s3 to v1.232.1 - [ ] Update opentelemetry-ruby (non-major) (`opentelemetry-api`, `opentelemetry-instrumentation-net_http`, `opentelemetry-sdk`) - [ ] Update dependency aws-sdk-core to v3.257.0 - [ ] Update dependency jsdom to v30.1.0 - [ ] Update dependency eslint-plugin-formatjs to v8 - [ ] Update formatjs monorepo to v12 (`intl-messageformat`, `react-intl`) --- > [!WARNING] > Renovate failed to look up the following dependencies: `Could not determine new digest for update (github-tags package ruby/setup-ruby)`, `Could not determine new digest for update (github-tags package eps1lon/actions-label-merge-conflict)`. > > Files affected: `.github/actions/setup-ruby/action.yml`, `.github/workflows/bundler-audit.yml`, `.github/workflows/lint-haml.yml`, `.github/workflows/lint-ruby.yml`, `.github/workflows/rebase-needed.yml` --- ## Open The following updates have all been created. To force a retry/rebase of any, click on a checkbox below. - [ ] [Update dependency @formatjs/intl-pluralrules to v6.3.15](../pull/40513) - [ ] [Update formatjs monorepo](../pull/40176) (`intl-messageformat`, `react-intl`) - [ ] [Update dependency annotaterb to v4.24.0](../pull/39937) - [ ] [Update dependency fuzzysort to v4](../pull/40105) - [ ] [Update dependency http to v6](../pull/40424) - [ ] [Update dependency json to v3](../pull/40425) - [ ] [Update dependency msw-storybook-addon to v3](../pull/39944) - [ ] [Update dependency rack-proxy to v2](../pull/40426) - [ ] [Update emojibase monorepo to v17](../pull/36921) (`emojibase`, `emojibase-data`, `emojibase-regex`) - [ ] [Update eslint monorepo to v10](../pull/37774) (`@eslint/js`, `eslint`) - [ ] [Update vitest monorepo to v5](../pull/40427) (`@vitest/browser`, `@vitest/browser-playwright`, `@vitest/coverage-v8`, `@vitest/ui`, `vitest`) - [ ] **Click on this checkbox to rebase all open PRs at once** ## PR Closed (Blocked) The following updates are blocked by an existing closed PR. To recreate the PR, click on a checkbox below. - [ ] [Update dependency immutable to v5](../pull/32762) ## Detected Dependencies bundler (1)

Gemfile (154) - `propshaft lock file @ 1.3.2` - `puma lock file @ 8.0.2` - `rails '~> 8.1.0'` - `thor '~> 1.2'` - `dotenv lock file @ 3.2.0` - `haml-rails '~>3.0'` - `pg '~> 1.5'` - `pghero lock file @ 4.0.1` - `aws-sdk-core lock file @ 3.256.0` → [Updates: `undefined`] - `aws-sdk-s3 '~> 1.123'` → [Updates: `'~> 1.123'`] - `blurhash '~> 0.1'` - `fog-core '<= 2.6.0'` - `fog-openstack '~> 1.0'` - `jd-paperclip-azure '~> 3.0'` - `kt-paperclip '~> 8.0'` - `ruby-vips '~> 2.2'` - `active_model_serializers '~> 0.10'` - `addressable '~> 2.8'` - `bootsnap lock file @ 1.26.0` - `browser lock file @ 6.2.0` - `charlock_holmes '~> 0.7.7'` - `chewy lock file @ 8.4.1` - `devise lock file @ 5.0.4` - `devise-two-factor lock file @ 6.4.1` - `devise_pam_authenticatable2 '~> 9.2'` - `net-ldap '~> 0.18'` - `omniauth '~> 2.0'` - `omniauth-cas '~> 3.0.0.beta.1'` - `omniauth_openid_connect '~> 0.8.0'` - `omniauth-rails_csrf_protection '~> 2.0'` - `omniauth-saml '~> 2.0'` - `color_diff '~> 0.1'` - `csv '~> 3.2'` - `discard '~> 2.0'` - `doorkeeper '~> 5.6'` - `faraday-httpclient lock file @ 2.0.2` - `fast_blank '~> 1.0'` - `fastimage lock file @ 2.4.1` - `hiredis-client lock file @ 0.30.1` - `htmlentities '~> 4.3'` - `http '~> 5.3.0'` → [Updates: `'~> 6.0.0'`] - `http_accept_language '~> 2.1'` - `httplog '~> 1.8.0'` - `i18n lock file @ 1.15.2` - `idn-ruby lock file @ 0.1.5` - `inline_svg lock file @ 1.10.0` - `ipaddr '~> 1.2'` - `irb '~> 1.8'` - `kaminari '~> 1.2'` - `link_header '~> 0.0'` - `linzer '~> 0.8.0'` - `mario-redis-lock '~> 1.2'` - `mime-types '~> 3.7.0'` - `mutex_m lock file @ 0.3.0` - `nokogiri '~> 1.15'` - `ox '~> 2.14'` - `parslet lock file @ 2.0.0` - `premailer-rails lock file @ 1.12.0` - `public_suffix '~> 7.0'` - `pundit '~> 2.3'` - `rack-attack '~> 6.6'` - `rack-cors lock file @ 3.0.0` - `rack-proxy lock file @ 1.0.2` → [Updates: `undefined`] - `rails-i18n '~> 8.0'` - `redcarpet '~> 3.6'` - `redis '~> 5'` → [Updates: `'~> 6'`] - `rqrcode '~> 3.0'` - `ruby-progressbar '~> 1.13'` - `sanitize '~> 7.0'` - `scenic '~> 1.7'` - `sidekiq '< 9'` - `sidekiq-bulk '~> 0.2.0'` - `sidekiq-scheduler '~> 6.0'` - `sidekiq-unique-jobs '> 8'` - `simple_form '~> 5.2'` - `simple-navigation '~> 4.4'` - `stoplight lock file @ 5.8.3` - `strong_migrations lock file @ 2.8.0` - `tty-prompt '~> 0.23'` - `twitter-text '~> 3.1.0'` - `tzinfo-data '~> 1.2023'` - `webauthn '~> 3.0'` - `webpush 9631ac63045cfabddacc69fc06e919b4c13eb913` - `json lock file @ 2.21.2` → [Updates: `undefined`] - `json-canonicalization '~> 1.0'` - `json-ld lock file @ 3.3.2` - `json-ld-preloaded '~> 3.2'` - `rdf-normalize '~> 0.5'` - `prometheus_exporter '~> 2.2'` - `opentelemetry-api '~> 1.11.0'` → [Updates: `'~> 1.11.0'`] - `opentelemetry-exporter-otlp '~> 0.36.0'` - `opentelemetry-instrumentation-active_job '~> 0.13.0'` - `opentelemetry-instrumentation-active_model_serializers '~> 0.25.0'` - `opentelemetry-instrumentation-concurrent_ruby '~> 0.25.0'` - `opentelemetry-instrumentation-excon '~> 0.29.0'` - `opentelemetry-instrumentation-faraday '~> 0.33.0'` - `opentelemetry-instrumentation-http '~> 0.30.0'` - `opentelemetry-instrumentation-http_client '~> 0.29.0'` - `opentelemetry-instrumentation-net_http '~> 0.29.0'` → [Updates: `'~> 0.29.0'`] - `opentelemetry-instrumentation-pg '~> 0.37.0'` - `opentelemetry-instrumentation-rack '~> 0.31.0'` - `opentelemetry-instrumentation-rails '~> 0.42.0'` - `opentelemetry-instrumentation-redis '~> 0.29.0'` - `opentelemetry-instrumentation-sidekiq '~> 0.29.0'` - `opentelemetry-sdk '~> 1.4'` → [Updates: `'~> 1.4'`] - `flatware-rspec lock file @ 2.4.0` - `rspec-github '~> 3.0'` - `rspec-sidekiq '~> 5.0'` - `capybara '~> 3.39'` - `capybara-playwright-driver lock file @ 0.5.10` - `playwright-ruby-client lock file @ 1.63.0` - `database_cleaner-active_record lock file @ 2.2.2` - `climate_control lock file @ 1.2.0` - `json-schema '~> 6.0'` - `rack-test '~> 2.1'` - `shoulda-matchers lock file @ 8.0.1` - `simplecov lock file @ 1.3.0` - `simplecov-lcov '~> 0.8'` - `webmock '~> 3.18'` - `websocket-driver '~> 0.8'` - `rubocop lock file @ 1.91.0` - `rubocop-capybara lock file @ 3.0.0` - `rubocop-i18n lock file @ 3.3.0` - `rubocop-performance lock file @ 1.27.0` - `rubocop-rails lock file @ 2.37.0` - `rubocop-rspec lock file @ 3.10.2` - `rubocop-rspec_rails lock file @ 2.32.0` - `annotaterb '~> 4.13'` → [Updates: `'~> 4.13'`] - `better_errors '~> 2.9'` - `binding_of_caller lock file @ 2.0.0` - `letter_opener '~> 1.8'` - `letter_opener_web '~> 3.0'` - `brakeman '~> 8.0'` - `bundler-audit '~> 0.9'` - `haml_lint lock file @ 0.78.0` - `i18n-tasks '~> 1.0'` - `debug '~> 1.8'` - `faker '~> 3.2'` - `fabrication lock file @ 3.0.0` - `memory_profiler lock file @ 1.1.0` - `ruby-prof lock file @ 2.0.5` - `stackprof lock file @ 0.2.28` - `test-prof lock file @ 1.6.3` - `rspec-rails '~> 8.0'` - `lograge '~> 0.12'` - `cocoon '~> 1.2'` - `concurrent-ruby lock file @ 1.3.8` - `connection_pool lock file @ 3.0.2` - `xorcist '~> 1.1'` - `net-http '~> 0.9.0'` - `rubyzip '~> 3.0'` - `hcaptcha '~> 7.1'` - `mail '~> 2.8'` - `base58 '~> 0.2.3'`

devcontainer (3)

.devcontainer/codespaces/devcontainer.json (1) - `ghcr.io/devcontainers/features/sshd 1` .devcontainer/devcontainer-lock.json (1) - `ghcr.io/devcontainers/features/sshd 1` .devcontainer/devcontainer.json (1) - `ghcr.io/devcontainers/features/sshd 1`

docker-compose (2)

.devcontainer/compose.yaml (4) - `postgres 14-alpine` → [Updates: `18-alpine`] - `redis 7-alpine` → [Updates: `8-alpine`] - `docker.elastic.co/elasticsearch/elasticsearch 8.19.15` → [Updates: `8.19.21`, `9.5.4`] - `libretranslate/libretranslate v1.7.3` → [Updates: `v1.9.6`] docker-compose.yml (5) - `postgres 14-alpine` → [Updates: `18-alpine`] - `redis 7-alpine` → [Updates: `8-alpine`] - `ghcr.io/mastodon/mastodon v4.7.2` - `ghcr.io/mastodon/mastodon-streaming v4.7.2` - `ghcr.io/mastodon/mastodon v4.7.2`

dockerfile (3)

.devcontainer/Dockerfile (1) - `mcr.microsoft.com/devcontainers/ruby 4.0-trixie` → [Updates: `4.1-trixie`] Dockerfile (4) - `docker/dockerfile 1.18` → [Updates: `1.27`] - `docker.io/node 24-trixie-slim` - `docker.io/ruby 4.0.7-slim-trixie` - `docker.io/ruby 4.0.7-slim-trixie` streaming/Dockerfile (2) - `docker/dockerfile 1.18` → [Updates: `1.27`] - `docker.io/node 24-trixie-slim`

github-actions (23)

.github/actions/setup-javascript/action.yml (2) - `actions/setup-node v6@249970729cb0ef3589644e2896645e5dc5ba9c38` → [Updates: `v7`] - `actions/cache v5@caa296126883cff596d87d8935842f9db880ef25` → [Updates: `v6`] .github/actions/setup-ruby/action.yml (1) - `ruby/setup-ruby v1@984c0c890880bbf811283d6f09c4607c62d210a4` .github/workflows/build-container-image.yml (14) - `actions/checkout v6@d23441a48e516b6c34aea4fa41551a30e30af803` → [Updates: `v7`] - `docker/setup-buildx-action v3@8d2750c68a42422c14e847fe6c8ac0403b4cbd6f` → [Updates: `v4`] - `docker/login-action v3@c94ce9fb468520275223c153574b00df6fe4bcc9` → [Updates: `v4`] - `docker/login-action v3@c94ce9fb468520275223c153574b00df6fe4bcc9` → [Updates: `v4`] - `docker/metadata-action v5@c299e40c65443455700f0fdfc63efafe5b349051` → [Updates: `v6`] - `docker/build-push-action v6@10e90e3645eae34f1e60eeb005ba3a3d33f178e8` → [Updates: `v7`] - `actions/upload-artifact v6@b7c566a772e6b6bfb58ed0dc250532a479d7789f` → [Updates: `v7`] - `actions/checkout v6@d23441a48e516b6c34aea4fa41551a30e30af803` → [Updates: `v7`] - `actions/download-artifact v7@37930b1c2abaa49bbe596cd826c3c89aef350131` → [Updates: `v8`] - `docker/login-action v3@c94ce9fb468520275223c153574b00df6fe4bcc9` → [Updates: `v4`] - `docker/login-action v3@c94ce9fb468520275223c153574b00df6fe4bcc9` → [Updates: `v4`] - `docker/setup-buildx-action v3@8d2750c68a42422c14e847fe6c8ac0403b4cbd6f` → [Updates: `v4`] - `docker/metadata-action v5@c299e40c65443455700f0fdfc63efafe5b349051` → [Updates: `v6`] - `ubuntu 24.04` .github/workflows/build-nightly.yml .github/workflows/build-push-pr.yml (1) - `actions/checkout v6@d23441a48e516b6c34aea4fa41551a30e30af803` → [Updates: `v7`] .github/workflows/build-releases.yml (1) - `actions/checkout v6@d23441a48e516b6c34aea4fa41551a30e30af803` → [Updates: `v7`] .github/workflows/build-security.yml .github/workflows/bundler-audit.yml (2) - `actions/checkout v6@d23441a48e516b6c34aea4fa41551a30e30af803` → [Updates: `v7`] - `ruby/setup-ruby v1@984c0c890880bbf811283d6f09c4607c62d210a4` .github/workflows/check-i18n.yml (1) - `actions/checkout v6@d23441a48e516b6c34aea4fa41551a30e30af803` → [Updates: `v7`] .github/workflows/chromatic.yml (4) - `actions/checkout v6@d23441a48e516b6c34aea4fa41551a30e30af803` → [Updates: `v7`] - `dorny/paths-filter v3@0e4a8c6effa4802afeda77dc8d303f8176d7dfad` → [Updates: `v4`] - `actions/checkout v6@d23441a48e516b6c34aea4fa41551a30e30af803` → [Updates: `v7`] - `chromaui/action v17@98132da0fca2211fb41b3af7b49ce85176007851` → [Updates: `v18`] .github/workflows/codeql.yml (4) - `actions/checkout v6@d23441a48e516b6c34aea4fa41551a30e30af803` → [Updates: `v7`] - `github/codeql-action v4@b96794f015dfd88f77b49b1c93e0fa7110f94c63` - `github/codeql-action v4@b96794f015dfd88f77b49b1c93e0fa7110f94c63` - `github/codeql-action v4@b96794f015dfd88f77b49b1c93e0fa7110f94c63` .github/workflows/crowdin-download-stable.yml (3) - `actions/checkout v6@d23441a48e516b6c34aea4fa41551a30e30af803` → [Updates: `v7`] - `crowdin/github-action v2@8f01d54f70f1713ee3f09d82c2bbb2daeac28689` → [Updates: `v3`] - `peter-evans/create-pull-request v8.1.0@c0f553fe549906ede9cf27b5156039d195d2ece0` → [Updates: `v8.1.1`] .github/workflows/crowdin-download.yml (3) - `actions/checkout v6@d23441a48e516b6c34aea4fa41551a30e30af803` → [Updates: `v7`] - `crowdin/github-action v2@8f01d54f70f1713ee3f09d82c2bbb2daeac28689` → [Updates: `v3`] - `peter-evans/create-pull-request v8@5f