Dependency Dashboard

This issue lists Renovate updates and detected dependencies. Read the [Dependency Dashboard](https://docs.renovatebot.com/key-concepts/dashboard/) docs to learn more.

## Deprecations / Replacements
> [!WARNING]
The following dependencies are either deprecated or have replacements available.

| Datasource | Package | Replacement PR? |
|------------|------|--------------|
| npm | `@types/glob` |  |
| npm | `@types/tar` |  |

## Pending Status Checks

The following updates await pending status checks. To force their creation now, click on a checkbox below.

- [ ] chore(deps): update grafana/shared-workflows/create-github-app-token action to v1.0

## Open

The following updates have all been created. To force a retry/rebase of any, click on a checkbox below.

- [ ] [fix(security/high/): update dependency fast-uri to v4.1.3 [security]](../pull/669)
- [ ] [chore(deps): pin dependencies](../pull/661) (`@arethetypeswrong/core`, `@babel/core`, `@babel/preset-env`, `@jest/globals`, `@types/node`, `ansis`, `axios`, `babel-jest`, `jest`, `js-yaml`, `lerna`, `metro`, `publint`, `rollup`, `tsdown`, `undici`, `undici-types`, `webpack`)
- [ ] [chore(deps): update dependency brace-expansion to v2](../pull/665)
- [ ] [chore(deps): update dependency brace-expansion to v3](../pull/657)
- [ ] [chore(deps): update dependency brace-expansion to v4](../pull/658)
- [ ] [chore(deps): update dependency brace-expansion to v5](../pull/659)
- [ ] [fix(deps): update dependency magic-string to v1](../pull/638)
- [ ] [chore(deps): update github/codeql-action action to v4.38.0](../pull/660)
- [ ] [chore(deps): lock file maintenance](../pull/633)
- [ ] **Click on this checkbox to rebase all open PRs at once**

## PR Closed (Blocked)

The following updates are blocked by an existing closed PR. To recreate the PR, click on a checkbox below.

- [ ] [chore(deps): update dependency typescript to v7](../pull/634)

## Vulnerabilities

> [!IMPORTANT]
> `4`/`4` CVEs have Renovate fixes.

npm

package.json

fast-uri

- [GHSA-5jgf-p345-68v8](https://osv.dev/vulnerability/GHSA-5jgf-p345-68v8) (fixed in >= 4.1.3)
- [GHSA-f65p-4m7j-42xc](https://osv.dev/vulnerability/GHSA-f65p-4m7j-42xc) (fixed in >= 4.1.3)
- [GHSA-fph4-wmhf-6fwf](https://osv.dev/vulnerability/GHSA-fph4-wmhf-6fwf) (fixed in >= 4.1.3)
- [GHSA-jqff-g426-hqxp](https://osv.dev/vulnerability/GHSA-jqff-g426-hqxp) (fixed in >= 4.1.3)

## Detected Dependencies

github-actions (3)

.github/workflows/codeql.yml (3)

- `actions/checkout v7.0.1@3d3c42e5aac5ba805825da76410c181273ba90b1`
- `github/codeql-action v4.37.6@5595ccaf912efad79be6eef63a5619ff05969be3` → [Updates: `v4.38.0`]
- `github/codeql-action v4.37.6@5595ccaf912efad79be6eef63a5619ff05969be3` → [Updates: `v4.38.0`]

.github/workflows/release-please.yml (1)

- `grafana/shared-workflows create-github-app-token/v0.3.1@46f48da11e78ebdba7a8747ae456b11062fac83e` → [Updates: `create-github-app-token/v1.0`]

.github/workflows/run-tests.yml (1)

- `node ${{ matrix.node }}`

npm (7)

package.json (17)

- `@arethetypeswrong/core ^0.18.1` → [Updates: `0.18.5`]
- `lerna 10.0.0` → [Updates: `10.0.1`]
- `publint ^0.3.8` → [Updates: `0.3.23`, `^0.3.23`]
- `axios 1.19.0` → [Updates: `1.20.0`]
- `fast-uri 4.1.2` → [Updates: `4.1.3`]
- `form-data 4.0.6`
- `tar 7.5.22`
- `js-yaml 5.2.3` → [Updates: `5.4.2`]
- `tmp ^0.2.7`
- `brace-expansion ^1.1.18` → [Updates: `^1.1.18`, `^2.0.0`, `^3.0.0`, `^4.0.0`, `^5.0.0`]
- `brace-expansion 1.1.18` → [Updates: `1.1.21`, `2.1.4`, `3.0.6`, `4.0.1`, `5.0.9`]
- `brace-expansion ^2.1.4` → [Updates: `^2.1.4`, `^3.0.0`, `^4.0.0`, `^5.0.0`]
- `brace-expansion 2.1.4` → [Updates: `2.1.7`, `3.0.6`, `4.0.1`, `5.0.9`]
- `brace-expansion ^5.0.9` → [Updates: `^5.0.9`]
- `brace-expansion 5.0.9` → [Updates: `5.0.12`]
- `brace-expansion 5.0.9` → [Updates: `5.0.12`]
- `yarn 4.18.0`

packages/faro-bundlers-shared/package.json (10)

- `ansis ^4.0.0` → [Updates: `^4.0.0`]
- `tar ^7.5.21`
- `undici ^8.5.0` → [Updates: `^8.5.0`]
- `@babel/core 8.0.1` → [Updates: `8.0.5`]
- `@babel/preset-typescript 8.0.1`
- `@grafana/tsconfig 2.2.0`
- `@types/tar 7.0.87`
- `tsdown 0.22.14` → [Updates: `0.23.0`]
- `typescript 6.0.3` → [Updates: `7.0.2`]
- `undici-types 8.10.0` → [Updates: `8.10.2`]

packages/faro-cli/package.json (16)

- `commander ^15.0.0`
- `dotenv ^17.0.1`
- `glob ^13.0.0`
- `tar ^7.5.21`
- `@babel/core 8.0.1` → [Updates: `8.0.5`]
- `@babel/preset-typescript 8.0.1`
- `@grafana/tsconfig 2.2.0`
- `@jest/globals 30.4.1` → [Updates: `30.5.1`]
- `@types/glob 9.0.0`
- `@types/jest 30.0.0`
- `@types/node 24.13.3` → [Updates: `24.13.4`]
- `@types/tar 7.0.87`
- `jest 30.4.2` → [Updates: `30.5.1`]
- `ts-jest 29.4.12`
- `tsdown 0.22.14` → [Updates: `0.23.0`]
- `typescript 6.0.3` → [Updates: `7.0.2`]

packages/faro-esbuild/package.json (10)

- `esbuild ^0.28.0`
- `@babel/core 8.0.1` → [Updates: `8.0.5`]
- `@babel/preset-typescript 8.0.1`
- `@grafana/tsconfig 2.2.0`
- `@jest/globals 30.4.1` → [Updates: `30.5.1`]
- `@types/jest 30.0.0`
- `jest 30.4.2` → [Updates: `30.5.1`]
- `ts-jest 29.4.12`
- `tsdown 0.22.14` → [Updates: `0.23.0`]
- `typescript 6.0.3` → [Updates: `7.0.2`]

packages/faro-metro-plugin/package.json (14)

- `cross-fetch ^4.0.0`
- `source-map ^0.8.0`
- `@babel/core 8.0.1` → [Updates: `8.0.5`]
- `@grafana/tsconfig 2.2.0`
- `@jest/globals 30.4.1` → [Updates: `30.5.1`]
- `@types/jest 30.0.0`
- `@types/node 24.13.3` → [Updates: `24.13.4`]
- `jest 30.4.2` → [Updates: `30.5.1`]
- `metro 0.87.0` → [Updates: `0.87.1`]
- `ts-jest 29.4.12`
- `tsdown 0.22.14` → [Updates: `0.23.0`]
- `tslib 2.8.1`
- `typescript 6.0.3` → [Updates: `7.0.2`]
- `metro >=0.81.0`

packages/faro-rollup/package.json (11)

- `magic-string ^0.30.5` → [Updates: `^1.0.0`]
- `@babel/core 8.0.1` → [Updates: `8.0.5`]
- `@babel/preset-typescript 8.0.1`
- `@grafana/tsconfig 2.2.0`
- `@jest/globals 30.4.1` → [Updates: `30.5.1`]
- `@types/jest 30.0.0`
- `jest 30.4.2` → [Updates: `30.5.1`]
- `rollup 4.62.4` → [Updates: `4.63.2`]
- `ts-jest 29.4.12`
- `tsdown 0.22.14` → [Updates: `0.23.0`]
- `typescript 6.0.3` → [Updates: `7.0.2`]

packages/faro-webpack/package.json (13)

- `webpack ^5.89.0` → [Updates: `^5.89.0`]
- `@babel/core 8.0.1` → [Updates: `8.0.5`]
- `@babel/preset-env 8.0.2` → [Updates: `8.0.5`]
- `@babel/preset-typescript 8.0.1`
- `@grafana/tsconfig 2.2.0`
- `@jest/globals 30.4.1` → [Updates: `30.5.1`]
- `@types/jest 30.0.0`
- `@types/node 26.2.0` → [Updates: `26.5.1`]
- `babel-jest 30.4.1` → [Updates: `30.5.1`]
- `jest 30.4.2` → [Updates: `30.5.1`]
- `ts-jest 29.4.12`
- `tsdown 0.22.14` → [Updates: `0.23.0`]
- `typescript 6.0.3` → [Updates: `7.0.2`]

nvm (1)

.nvmrc (1)

- `node 24`

renovate-config (1)

.github/renovate.json

---
## Need help?
You can ask for more help in the following Slack channel: #proj-renovate-self-hosted. In that channel you can also find ADR and FAQ docs in the Resources section.