Dependency Dashboard

This issue lists Renovate updates and detected dependencies. Read the [Dependency Dashboard](https://docs.renovatebot.com/key-concepts/dashboard/) docs to learn more.
[View this repository on the Mend.io Web Portal](https://developer.mend.io/github/matrix-org/matrix-hookshot).

## Deprecations / Replacements
> [!WARNING]
The following dependencies are either deprecated or have replacements available.

| Datasource | Package | Replacement PR? |
|------------|------|--------------|
| npm | [@octokit/webhooks-types](https://redirect.github.com/octokit/webhooks) |  |
| npm | [@tsconfig/node22](https://redirect.github.com/tsconfig/bases) |  |
| npm | `@types/ajv` |  |
| npm | `@types/mime` |  |
| npm | [prom-client](https://redirect.github.com/siimon/prom-client) |  |
| regex | [@tsconfig/node22](https://redirect.github.com/tsconfig/bases) |  |

## Rate-Limited

The following updates are currently rate-limited. To force their creation now, click on a checkbox below.

- [ ] Update dependency @types/node to v22.20.4
- [ ] Update dependency express to v4.22.3
- [ ] Update dependency yaml to v2.9.1
- [ ] Update eslint monorepo to v9.39.5 (`@eslint/js`, `eslint`)
- [ ] Update Rust crate reqwest to v0.13.5
- [ ] Update Rust crate serde_json to v1.0.151
- [ ] Update serde monorepo to v1.0.229 (`serde`, `serde_derive`)
- [ ] Update vitest monorepo to v4.1.11 (`@vitest/coverage-v8`, `vitest`)
- [ ] Update actions-rust-lang/setup-rust-toolchain action to v1.17.0
- [ ] Update actions/checkout action to v6.1.0
- [ ] Update actions/setup-node action to v6.5.0
- [ ] Update dependency @alloc/quick-lru to v5.3.0
- [ ] Update dependency @element-hq/element-web-module-api to v2.1.0
- [ ] Update dependency @fontsource/inter to v5.3.0
- [ ] Update dependency @napi-rs/cli to v3.10.4
- [ ] Update dependency @vector-im/compound-web to v9.9.0
- [ ] Update dependency axios to v1.20.0
- [ ] Update dependency helm to v3.22.0
- [ ] Update dependency helmet to v8.3.0
- [ ] Update dependency markdown-it to v14.3.2
- [ ] Update dependency matrix-widget-api to v1.19.0
- [ ] Update dependency prettier to v3.9.8
- [ ] Update dependency sass to v1.104.1
- [ ] Update dependency typescript-eslint to v8.70.0
- [ ] Update dependency vite-plugin-magical-svg to v1.10.3
- [ ] Update pnpm/action-setup action to v6.1.0
- [ ] Update react monorepo to v19.3.0 (`@types/react`, `@types/react-dom`, `react`, `react-dom`)
- [ ] Update Rust crate napi to v3.12.6
- [ ] Update Rust crate napi-build to v2.4.3
- [ ] Update Rust crate napi-derive to v3.6.7
- [ ] Update Rust crate rss to v2.1.2
- [ ] Update zizmorcore/zizmor-action action to v0.6.4
- [ ] Update actions-rust-lang/setup-rust-toolchain action to v2
- [ ] Update actions/checkout action to v7
- [ ] Update actions/setup-node action to v7
- [ ] Update actions/setup-python action to v7
- [ ] Update actions/upload-artifact action to v7
- [ ] Update dependency @types/chai to v5
- [ ] Update dependency @types/markdown-it to v14
- [ ] Update dependency @vector-im/compound-design-tokens to v11
- [ ] Update dependency @vector-im/compound-web to v10
- [ ] Update dependency @vitejs/plugin-react to v6
- [ ] Update dependency express to v5 (`express`, `@types/express`)
- [ ] Update dependency helm to v4
- [ ] Update dependency ioredis to v6
- [ ] Update dependency markdown-it to v15
- [ ] Update dependency matrix-appservice-bridge to v12
- [ ] Update dependency typescript to v7
- [ ] Update dependency ubuntu to v26
- [ ] Update dependency vite to v8
- [ ] Update docker/build-push-action action to v7
- [ ] Update docker/login-action action to v4
- [ ] Update docker/metadata-action action to v6
- [ ] Update eslint monorepo to v10 (`@eslint/js`, `eslint`)
- [ ] Update Node.js to v24 (`node`, `@types/node`)
- [ ] Update octokit monorepo (major) (`@octokit/auth-app`, `@octokit/auth-token`, `@octokit/openapi-types`, `@octokit/rest`, `@octokit/types`, `@octokit/webhooks`)
- [ ] Update vitest monorepo to v5 (`@vitest/coverage-v8`, `vitest`)
- [ ] Update WyriHaximus/github-action-helm3 action to v4
- [ ] 🔐 **Create all rate-limited PRs at once** 🔐

## Open

The following updates have all been created. To force a retry/rebase of any, click on a checkbox below.

- [ ] [Update Rust crate rand to 0.9.0 [SECURITY]](../pull/1262)
- [ ] [Update azure/setup-helm digest to 9bc31f4](../pull/1352)
- [ ] [Update cachix/install-nix-action digest to 13d8dd5](../pull/1359)
- [ ] [Update Swatinem/rust-cache digest to 6323deb](../pull/1377)
- [ ] [Update Rust crate atom_syndication to v0.12.10](../pull/1395)
- [ ] [Update Rust crate ruma to 0.17](../pull/1134)
- [ ] [Update Rust crate sha1 to 0.11.0](../pull/1321)
- [ ] [Update dependency @babel/core to v8](../pull/1342)
- [ ] [Update dependency @sentry/node to v10](../pull/1199)
- [ ] [Update dependency @types/mime to v4](../pull/1298)
- [ ] [Update testcontainers-node monorepo to v12](../pull/1129) (`@testcontainers/redis`, `testcontainers`)
- [ ] **Click on this checkbox to rebase all open PRs at once**

## PR Closed (Blocked)

The following updates are blocked by an existing closed PR. To recreate the PR, click on a checkbox below.

- [ ] [Replace dependency @tsconfig/node22 with @tsconfig/node24](../pull/1138)

## Detected Dependencies

cargo (1)

Cargo.toml (19)

- `napi 3` → [Updates: `3`]
- `napi-derive 3` → [Updates: `3`]
- `url 2`
- `serde_json 1` → [Updates: `1`]
- `serde 1` → [Updates: `1`]
- `serde_derive 1` → [Updates: `1`]
- `contrast 0`
- `rgb 0`
- `md-5 0.11`
- `hex 0.4`
- `rss 2.0` → [Updates: `2.0`]
- `atom_syndication 0.12` → [Updates: `0.12`]
- `ruma 0.9` → [Updates: `0.17`]
- `reqwest 0.13.0` → [Updates: `0.13.0`]
- `rand 0.8.5` → [Updates: `0.9.0`]
- `rsa 0.9.6`
- `base64ct 1.6.0`
- `sha1 0.10.6` → [Updates: `0.11.0`]
- `napi-build 2` → [Updates: `2`]

docker-compose (1)

docker-compose.yml (2)

- `valkey/valkey 9`
- `alpine 3`

dockerfile (1)

Dockerfile (2)

- `node 22-slim` → [Updates: `24-slim`]
- `node 22-slim` → [Updates: `24-slim`]

github-actions (11)

.github/workflows/devenv.yml (3)

- `actions/checkout v6@d23441a48e516b6c34aea4fa41551a30e30af803` → [Updates: `v7`]
- `cachix/install-nix-action v31@8aa03977d8d733052d78f4e008a241fd1dbf36b3` → [Updates: `v31`]
- `cachix/cachix-action v17@38b082610b782e7e93e209c35fd730d399dee866`

.github/workflows/docker.yml (7)

- `docker/metadata-action v5@c299e40c65443455700f0fdfc63efafe5b349051` → [Updates: `v6`]
- `actions/checkout v6@d23441a48e516b6c34aea4fa41551a30e30af803` → [Updates: `v7`]
- `docker/login-action v3@c94ce9fb468520275223c153574b00df6fe4bcc9` → [Updates: `v4`]
- `docker/metadata-action v5@c299e40c65443455700f0fdfc63efafe5b349051` → [Updates: `v6`]
- `docker/build-push-action v6@10e90e3645eae34f1e60eeb005ba3a3d33f178e8` → [Updates: `v7`]
- `docker/build-push-action v6@10e90e3645eae34f1e60eeb005ba3a3d33f178e8` → [Updates: `v7`]
- `docker/login-action v3@c94ce9fb468520275223c153574b00df6fe4bcc9` → [Updates: `v4`]

.github/workflows/docs.yml (8)

- `actions/checkout v6.0.3@df4cb1c069e1874edd31b4311f1884172cec0e10` → [Updates: `v6.1.0`, `v7.0.1`]
- `pnpm/action-setup v6.0.9@0ebf47130e4866e96fce0953f49152a61190b271` → [Updates: `v6.1.0`]
- `actions/setup-node v6.4.0@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e` → [Updates: `v6.5.0`, `v7.0.0`]
- `actions/configure-pages v6.0.0@45bfe0192ca1faeb007ade9deae92b16b8254a0d`
- `peaceiris/actions-mdbook v2.0.0@ee69d230fe19748b7abf22df32acaa93833fad08`
- `actions/checkout v6.0.3@df4cb1c069e1874edd31b4311f1884172cec0e10` → [Updates: `v6.1.0`, `v7.0.1`]
- `actions/upload-pages-artifact v5.0.0@fc324d3547104276b827a68afc52ff2a11cc49c9`
- `actions/deploy-pages v5.0.1@368f82528645a54fb793d4d04e342629a3f51346`

.github/workflows/helm-lint.yml (3)

- `actions/checkout v6@d23441a48e516b6c34aea4fa41551a30e30af803` → [Updates: `v7`]
- `WyriHaximus/github-action-helm3 v3@fc4ba26e75cf5d08182c6ce3b72623c8bfd7272b` → [Updates: `v4`]
- `nlamirault/helm-kubeconform-action v0.2.0@d29c4d227a42190dae7b25e668a267539d68a6ce`

.github/workflows/helm.yml (6)

- `actions/checkout v6@d23441a48e516b6c34aea4fa41551a30e30af803` → [Updates: `v7`]
- `azure/setup-helm v5@dda3372f752e03dde6b3237bc9431cdc2f7a02a2` → [Updates: `v5`]
- `mikefarah/yq v4.53.6@c14f446382944492701b16c1ddb48bb9dbe683e3`
- `mikefarah/yq v4.53.6@c14f446382944492701b16c1ddb48bb9dbe683e3`
- `helm/chart-releaser-action v1.7.0@cae68fefc6b5f367a0275617c9f83181ba54714f`
- `helm v3.21.4` → [Updates: `v3.22.0`, `v4.3.0`]

.github/workflows/main.yml (29)

- `actions/checkout v6.0.3@df4cb1c069e1874edd31b4311f1884172cec0e10` → [Updates: `v6.1.0`, `v7.0.1`]
- `pnpm/action-setup v6.0.9@0ebf47130e4866e96fce0953f49152a61190b271` → [Updates: `v6.1.0`]
- `actions/setup-node v6.4.0@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e` → [Updates: `v6.5.0`, `v7.0.0`]
- `actions/checkout v6.0.3@df4cb1c069e1874edd31b4311f1884172cec0e10` → [Updates: `v6.1.0`, `v7.0.1`]
- `actions-rust-lang/setup-rust-toolchain v1.16.1@46268bd060767258de96ed93c1251119784f2ab6` → [Updates: `v1.17.0`, `v2.0.0`]
- `actions/checkout v6.0.3@df4cb1c069e1874edd31b4311f1884172cec0e10` → [Updates: `v6.1.0`, `v7.0.1`]
- `zizmorcore/zizmor-action v0.5.7@192e21d79ab29983730a13d1382995c2307fbcaa` → [Updates: `v0.6.4`]
- `actions/checkout v6.0.3@df4cb1c069e1874edd31b4311f1884172cec0e10` → [Updates: `v6.1.0`, `v7.0.1`]
- `pnpm/action-setup v6.0.9@0ebf47130e4866e96fce0953f49152a61190b271` → [Updates: `v6.1.0`]
- `actions/setup-node v6.4.0@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e` → [Updates: `v6.5.0`, `v7.0.0`]
- `actions/checkout v6.0.3@df4cb1c069e1874edd31b4311f1884172cec0e10` → [Updates: `v6.1.0`, `v7.0.1`]
- `pnpm/action-setup v6.0.9@0ebf47130e4866e96fce0953f49152a61190b271` → [Updates: `v6.1.0`]
- `actions/setup-node v6.4.0@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e` → [Updates: `v6.5.0`, `v7.0.0`]
- `actions/checkout v6.0.3@df4cb1c069e1874edd31b4311f1884172cec0e10` → [Updates: `v6.1.0`, `v7.0.1`]
- `pnpm/action-setup v6.0.9@0ebf47130e4866e96fce0953f49152a61190b271` → [Updates: `v6.1.0`]
- `actions/setup-node v6.4.0@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e` → [Updates: `v6.5.0`, `v7.0.0`]
- `actions-rust-lang/setup-rust-toolchain v1.16.1@46268bd060767258de96ed93c1251119784f2ab6` → [Updates: `v1.17.0`, `v2.0.0`]
- `Swatinem/rust-cache v2@e18b497796c12c097a38f9edb9d0641fb99eee32` → [Updates: `v2`]
- `actions/checkout v6.0.3@df4cb1c069e1874edd31b4311f1884172cec0e10` → [Updates: `v6.1.0`, `v7.0.1`]
- `pnpm/action-setup v6.0.9@0ebf47130e4866e96fce0953f49152a61190b271` → [Updates: `v6.1.0`]
- `actions/setup-node v6.4.0@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e` → [Updates: `v6.5.0`, `v7.0.0`]
- `actions-rust-lang/setup-rust-toolchain v1.16.1@46268bd060767258de96ed93c1251119784f2ab6` → [Updates: `v1.17.0`, `v2.0.0`]
- `Swatinem/rust-cache v2@e18b497796c12c097a38f9edb9d0641fb99eee32` → [Updates: `v2`]
- `rust stable`
- `ubuntu 24.04` → [Updates: `26.04`]
- `ubuntu 24.04` → [Updates: `26.04`]
- `rust stable`
- `ubuntu 24.04` → [Updates: `26.04`]
- `rust stable`

.github/workflows/newsfile.yml (3)

- `actions/checkout v6@d23441a48e516b6c34aea4fa41551a30e30af803` → [Updates: `v7`]
- `actions/setup-python v6@ece7cb06caefa5fff74198d8649806c4678c61a1` → [Updates: `v7`]
- `python 3.14`

.github/workflows/release.yml (1)

- `actions/checkout v6@d23441a48e516b6c34aea4fa41551a30e30af803` → [Updates: `v7`]

.github/workflows/sign-off.yml (1)

- `matrix-org/backend-meta v2@18beaf3c8e536108bd04d18e6c3dc40ba3931e28`

.github/workflows/storybook-build.yml (4)

- `actions/checkout v6.0.3@df4cb1c069e1874edd31b4311f1884172cec0e10` → [Updates: `v6.1.0`, `v7.0.1`]
- `pnpm/action-setup v6.0.9@0ebf47130e4866e96fce0953f49152a61190b271` → [Updates: `v6.1.0`]
- `actions/setup-node v6.4.0@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e` → [Updates: `v6.5.0`, `v7.0.0`]
- `actions/upload-artifact v4.6.2@ea165f8d65b6e75b540449e92b4886f43607fa02` → [Updates: `v7.0.1`]

.github/workflows/triage-incoming.yml (1)

- `matrix-org/backend-meta v2@18beaf3c8e536108bd04d18e6c3dc40ba3931e28`

helm-values (1)

helm/hookshot/values.yaml

nodenv (1)

.node-version (1)

- `node 22` → [Updates: `24`]

npm (3)

modules/openproject/element-web/package.json (8)

- `@element-hq/element-web-module-api 2.0.0` → [Updates: `2.1.0`]
- `@element-hq/element-web-shared-utils 0.1.0`
- `@types/react ^19` → [Updates: `^19`]
- `@vitejs/plugin-react ^5.0.4` → [Updates: `^6.0.0`]
- `react ^19.2.7` → [Updates: `^19.2.7`]
- `react-dom ^19.2.7` → [Updates: `^19.2.7`]
- `rollup-plugin-external-globals ^0.13.0`
- `styled-components ^6.1.18`

package.json (83)

- `@alloc/quick-lru ^5.2.0` → [Updates: `^5.2.0`]
- `@octokit/auth-app ^6.0.2` → [Updates: `^8.0.0`]
- `@octokit/auth-token ^4.0.0` → [Updates: `^6.0.0`]
- `@octokit/rest ^20.0.2` → [Updates: `^22.0.0`]
- `@octokit/webhooks ^12.0.10` → [Updates: `^14.0.0`]
- `@sentry/node ^7.52.1` → [Updates: `^10.0.0`]
- `ajv ^8.11.0`
- `axios ^1.12.0` → [Updates: `^1.12.0`]
- `clsx ^2.1.1`
- `cors ^2.8.5`
- `date-fns ^4.1.0`
- `express ^4.21.2` → [Updates: `^4.21.2`, `^5.0.0`]
- `figma-js ^1.16.1-0`
- `helmet ^8.0.0` → [Updates: `^8.0.0`]
- `http-status-codes ^2.2.0`
- `ioredis ^5.6.1` → [Updates: `^6.0.0`]
- `jira-client ^8.2.2`
- `markdown-it ^14.0.0` → [Updates: `^14.0.0`, `^15.0.0`]
- `matrix-appservice-bridge ^11.2.0` → [Updates: `^12.0.0`]
- `matrix-bot-sdk 0.8.0-element.3`
- `matrix-widget-api ^1.10.0` → [Updates: `^1.10.0`]
- `micromatch ^4.0.8`
- `mime ^4.0.4`
- `node-emoji ^2.1.3`
- `parse-duration ^2.1.3`
- `preact-render-to-string ^6.3.1`
- `prom-client ^15.1.0`
- `quickjs-emscripten ^0.32.0`
- `reflect-metadata ^0.2.2`
- `source-map-support ^0.5.21`
- `string-argv ^0.3.1`
- `ts-node ^10.9.2`
- `tiny-typed-emitter ^2.1.0`
- `url-join ^5.0.0`
- `vite-plugin-magical-svg ^1.1.1` → [Updates: `^1.1.1`]
- `winston ^3.11.0`
- `xml2js ^0.6.2`
- `yaml ^2.3.4` → [Updates: `^2.3.4`]
- `@babel/core ^7.26.9` → [Updates: `^8.0.0`]
- `@codemirror/lang-javascript ^6.0.2`
- `@eslint/eslintrc ^3.2.0`
- `@eslint/js ^9.15.0` → [Updates: `^9.15.0`, `^10.0.0`]
- `@fontsource/inter ^5.1.0` → [Updates: `^5.1.0`]
- `@napi-rs/cli ^3` → [Updates: `^3`]
- `@octokit/webhooks-types ^7.6.1`
- `@preact/preset-vite ^2.9.1`
- `@rollup/plugin-alias ^6.0.0`
- `@storybook/addon-a11y ^10.6.0`
- `@storybook/addon-docs ^10.6.0`
- `@storybook/react-vite ^10.6.0`
- `@testcontainers/redis ^10.25.0` → [Updates: `^12.0.0`]
- `@tsconfig/node22 ^22` → [Updates: `^24.0.0`]
- `@types/ajv ^1.0.0`
- `@types/busboy ^1.5.4`
- `@types/chai ^4.2.22` → [Updates: `^5.0.0`]
- `@types/cors ^2.8.12`
- `@types/express ^4.17.23` → [Updates: `^5.0.0`]
- `@types/jira-client ^7.1.0`
- `@types/markdown-it ^13.0.7` → [Updates: `^14.0.0`]
- `@types/micromatch ^4.0.1`
- `@types/mime ^3.0.4` → [Updates: `^4.0.0`]
- `@types/react ^19` → [Updates: `^19`]
- `@types/react-dom ^19` → [Updates: `^19`]
- `@types/xml2js ^0.4.11`
- `@uiw/react-codemirror ^4.12.3`
- `busboy ^1.6.0`
- `classnames ^2.5.1`
- `eslint ^9.15.0` → [Updates: `^9.15.0`, `^10.0.0`]
- `eslint-plugin-react ^7.37.2`
- `preact ^10.26.2`
- `prettier ^3.5.3` → [Updates: `^3.5.3`]
- `react ^19.2.7` → [Updates: `^19.2.7`]
- `react-dom ^19.2.7` → [Updates: `^19.2.7`]
- `rimraf 6.1.3`
- `sass ^1.81.0` → [Updates: `^1.81.0`]
- `storybook ^10.6.0`
- `testcontainers ^10.25.0` → [Updates: `^12.0.0`]
- `typescript-eslint ^8.16.0` → [Updates: `^8.16.0`]
- `@vitest/coverage-v8 ^4.1.8` → [Updates: `^4.1.8`, `^5.0.0`]
- `@octokit/types ^16.0.0` → [Updates: `^18.0.0`]
- `@octokit/openapi-types ^27.0.0` → [Updates: `^29.0.0`]
- `@octokit/request-error ^7.1.0`
- `node >=22`

pnpm-workspace.yaml (6)

- `@types/node ^22` → [Updates: `^22`, `^24.0.0`]
- `@vector-im/compound-design-tokens ^10.2.2` → [Updates: `^11.0.0`]
- `@vector-im/compound-web ^9.4.1` → [Updates: `^9.4.1`, `^10.0.0`]
- `typescript ^5.7.2` → [Updates: `^7.0.0`]
- `vite ^7.0.0` → [Updates: `^8.0.0`]
- `vitest ^4.1.8` → [Updates: `^4.1.8`, `^5.0.0`]

regex (1)

tsconfig.json (1)

- `@tsconfig/node22 22` → [Updates: `24`]

---

- [ ] Check this box to trigger a request for Renovate to run again on this repository

Start with the linked Dependency Dashboard documentation, then inspect Cargo.toml, Dockerfile, and the listed .github/workflows files to understand the available updates. The issue contains many independent dependency changes and existing PRs, so completion would require selecting a specific update and verifying the relevant checks pass.

Written by the indexing model from the issue text.