chore(deps): update all non-major dependencies

[renovate]

This PR contains the following updates:

Package	Change	Age	Confidence	Type	Update	Pending
@harperfast/skills (source)	1.11.0 → 1.11.1			devDependencies	patch	1.12.0
@types/react (source)	19.2.17 → 19.2.18			devDependencies	patch
conventional-commits-parser (source)	7.1.0 → 7.1.1			devDependencies	patch	7.1.2
create-harper (source)	1.10.12 → 1.11.2			devDependencies	minor
node (source)	24.18.0 → 24.18.1				patch
oxfmt (source)	^0.60.0 → ^0.61.0			devDependencies	minor	0.62.0
oxlint (source)	1.75.0 → 1.76.0			devDependencies	minor	1.77.0

---

Release Notes

HarperFast/skills (@​harperfast/skills)

v1.11.1

Compare Source

Bug Fixes

• release: consolidate release config so all commit types surface in notes (c71a709)

conventional-changelog/conventional-changelog (conventional-commits-parser)

v7.1.1

Compare Source

Bug Fixes

• do not treat indented lines as footers (#​1513) (c01c3c4), closes #​1512

HarperFast/create-harper (create-harper)

v1.11.2

Compare Source

Bug Fixes

• release: consolidate release config and pin conventionalcommits preset to v9 (6afaa65)

v1.11.1

Compare Source

v1.11.0

Compare Source

Bug Fixes

• templates: address Next.js review feedback (age 0, useTransition) (597fae8)
• templates: deploy Next.js prebuilt to survive multi-thread clusters (ebed32a)
• templates: don't import 'harper' in Next.js server code (1fd5c48)
• templates: make Next.js templates install + lint under pnpm and yarn (d1587db)
• templates: mark Next.js templates as SSR in the catalog (ssr: true) (4a79097)
• templates: pre-approve pnpm builds via pnpm-workspace.yaml allowBuilds (4c248a2)
• templates: ship Next.js prebuilt — on-cluster build fails (nextjs#​57/#​58) (ded2190), closes #​52 #​52
• templates: use Harper's atomic addTo for the counter increment (6a89ea3)

Features

• templates: add Next.js templates (JavaScript + TypeScript) (e490c29)

v1.10.15

Compare Source

v1.10.14

Compare Source

v1.10.13

Compare Source

nodejs/node (node)

v24.18.1: 2026-07-29, Version 24.18.1 'Krypton' (LTS), @​juanarbol

Compare Source

This is a security release.

Notable Changes

• (CVE-2026-56846) http2: retain header memory in session accounting (Matteo Collina) – High
• (CVE-2026-56848) http2: defer rst stream while in scope (Matteo Collina) – High
• (CVE-2026-58043) permission: avoid granting radix split nodes (RafaelGSS) – High
• (CVE-2026-56850) https: distinguish PFX object-array agent keys (RafaelGSS) – Medium
• (CVE-2026-58040) https: bind identity checks to session reuse (Matteo Collina) – Medium
• (CVE-2026-58041) sqlite: invalidate tag store iterators on statement reset (Matteo Collina) – Medium
• (CVE-2026-58042) dns: handle large resolveAny address replies (RafaelGSS) – Medium
• (CVE-2026-58045) zlib: throw on out-of-bounds write buffers (RafaelGSS) – Medium
• (CVE-2026-56847) permission: enforce fs write permission for trace events (RafaelGSS) – Low
• (CVE-2026-58039) permission: check final report output path (RafaelGSS) – Low
• (CVE-2026-58044) http: reject requests exceeding max header count (Matteo Collina) – Low
• deps: update llhttp to 9.4.3 (Paolo Insogna)
• deps: update undici to 7.29.0 (Node.js GitHub Bot)

Commits

• [6cb0475751] - deps: update llhttp to 9.4.3 (Paolo Insogna) nodejs-private/node-private#935
• [bcfe21d3dc] - deps: update undici to 7.29.0 (Node.js GitHub Bot) #​64713
• [9d0d36cffd] - (CVE-2026-58042) dns: handle large resolveAny address replies (RafaelGSS) nodejs-private/node-private#929
• [8a008fb523] - (CVE-2026-58044) http: reject requests exceeding max header count (Matteo Collina) nodejs-private/node-private#922
• [a77c7f7354] - (CVE-2026-56848) http2: defer rst stream while in scope (Matteo Collina) nodejs-private/node-private#921
• [34ed88a069] - (CVE-2026-56846) http2: retain header memory in session accounting (Matteo Collina) #​63752
• [95ba2cfde7] - (CVE-2026-58040) https: bind identity checks to session reuse (Matteo Collina) nodejs-private/node-private#904
• [fcbdbe47ea] - (CVE-2026-56850) https: distinguish PFX object-array agent keys (RafaelGSS) nodejs-private/node-private#930
• [ea26c12b56] - (CVE-2026-58043) permission: avoid granting radix split nodes (RafaelGSS) nodejs-private/node-private#911
• [9a6b7e343a] - (CVE-2026-58039) permission: check final report output path (RafaelGSS) nodejs-private/node-private#926
• [6c0c990880] - (CVE-2026-56847) permission: enforce fs write permission for trace events (RafaelGSS) nodejs-private/node-private#927
• [af9ff0490c] - (CVE-2026-58041) sqlite: invalidate tag store iterators on statement reset (Matteo Collina) nodejs-private/node-private#896
• [05f541b5c0] - (CVE-2026-58045) zlib: throw on out-of-bounds write buffers (RafaelGSS) nodejs-private/node-private#931

oxc-project/oxc (oxfmt)

v0.61.0

Compare Source

oxc-project/oxc (oxlint)

v1.76.0

Compare Source

🚀 Features

• 8d31dfa linter: Verify eslint/no-restricted-globals config schema (#​24598) (vigneshwar)
• 7069621 linter: Verify jest/vitest prefer-lowercase-title config schema (#​24724) (Bartok)
• 016cf2a linter/oxc: Add bad-match-all-arg rule (#​24900) (camc314)
• cdc941e linter/n: Implement exports-style rule (#​24087) (Mikhail Baev)
• 1ad6f6c linter/eslint: Implement id-denylist rule (#​24632) (Mikhail Baev)

📚 Documentation

• 3ff2e0e linter: Clarify config extends types (#​24936) (Boshen)

---

Configuration

📅 Schedule: (in timezone America/New_York)

• Branch creation
  • "before 9am on Monday"
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Enabled.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.