Update dependency moon to v2.5.4

[renovate]

This PR contains the following updates:

Package	Update	Change
moon	minor	=2.4.2 → 2.5.4

---

Release Notes

moonrepo/moon (moon)

v2.5.4

Compare Source

🐞 Fixes

• Fixed an issue where SetupEnvironment (and other plugin driven commands) would attempt to locate
  the executables of every toolchain declared in the workspace, and fail when one of them had not
  been installed. For example, moon docker setup for a Python only project would fail on a
  declared but unused Node.js toolchain. Toolchain executable paths are now only inherited for
  toolchains that have actually been setup.
• Fixed an issue where globbing would unnecessarily traverse into directories that were negated,
  resulting in reduced performance. Globbing is now about 10% faster for these cases.
• Fixed an issue where globbing would exhaust the internal thread pool, resulting in no results
  being returned. When the thread pool is now busy, we'll attempt to retry on the main thread.

⚙️ Internal

• Updated Rust to v1.98.0.
• Updated dependencies.

v2.5.3

Compare Source

🧰 Toolchains

• Bun
  • Updated the embedded bun tool to support Windows arm64 (Bun v1.3.10+) and musl based Linux
    (Bun v1.1.35+).
• Go
  • Test binary pseudo-packages are no longer inferred as relationships. go list -deps -test
    reports a synthetic pkg.test package for each tested package; its .test suffix kept it from
    matching the package under test, so it resolved to whatever ancestor project it nested under
    (typically the module root) as a phantom development edge. It is now reduced to the real package
    path and recognised as ownership.
  • go.sum is now reported as a project-graph input alongside the module's go.mod. As the lock
    file pinning resolved dependency versions, a change there (a dependency added, upgraded, or
    dropped) can alter what go list resolves for relationship inference, so reporting it keeps a
    locally cached graph from going stale. Only reported when present, since a module with no
    dependencies has no go.sum.
• JavaScript
  • Updated Bun support for the v1.4 release:
    • Dependencies are now installed with bun ci in CI when a bun.lock exists (v1.2.20+), as Bun
      does not enable frozen lockfiles in CI automatically.
    • Dependencies are now deduped with bun dedupe when the dedupeOnLockfileChange setting is
      enabled (v1.4+).
    • Focused installs now include workspace dependencies, by passing ... dependency relations to
      --filter (v1.4+).

🐞 Fixes

• Fixed an issue where a task dependency using the task-tag scope (~:#tag) was silently dropped
  when the depending task was defined in an inherited .moon/tasks/* config. Tag scoped
  dependencies are now preserved, since workspace.inheritedTasks exclude/rename filters can only
  match tasks by ID (#​2687).

v2.5.2

Compare Source

🚀 Updates

• Increased the storage upload timeout from 60 seconds to 300 seconds (5 minutes) to allow more time
  for background operations to complete.
• Updated CI task runs to respect the outputStyle task option. Locally, we'll still stream the
  output for primary targets, ignoring that option. We will be revisiting this in v2.6.
• Updated versionConstraint in .moon/workspace.* to use a range instead of a requirement, which
  allows for more flexible version constraints.

🐞 Fixes

• Fixed an issue where commands executed by toolchain plugins at the workspace root would receive a
  PWD environment variable with a trailing slash (an artifact of virtual path conversion). Shells
  that validate PWD on startup, like nushell, refused to run, failing the command (#​2676).
• Fixed an issue where combining --force with --affected would not pass affected files to the
  affectedFiles task option, as arguments or the MOON_AFFECTED_FILES environment variable.
  Forcing now only bypasses the affected selection filter (so unaffected tasks still run), while
  affected files continue to be tracked and passed to the command.
• Fixed an issue where a dependent action could be dispatched (and run to completion) after one of
  its required dependencies had failed and aborted the pipeline. For example, InstallDependencies
  could still run its install command after SetupEnvironment failed. The pipeline now aborts
  before the failed action is marked as completed, and queued actions no longer start once the
  pipeline has been aborted or cancelled.
• Fixed an issue where setting a task's env variable to null would also prevent that variable
  from being inherited from an env file (envFile). A null value now only ignores the variable
  from the system/shell environment, while still allowing an env file to provide a value.
• Fixed an issue where default --summary for moon ci was not being respected.
• Fixed an issue where resolved lockfile versions were not extracted for a toolchain when a
  range/requirement was defined for the toolchain version.

v2.5.1

Compare Source

🐞 Fixes

• Fixed an issue where --affected with --include-relations (-g) would not select a target
  whose dependency (or dependent) was the task actually affected by the changed files. Only the
  requested targets were being tracked, but a target is marked through a relation when the task on
  the other side of it is marked, and that task is quite often not one that was requested.
• Fixed an issue where a project that isn't part of a toolchain's dependencies workspace (not the
  root, and not a member) would provision its own environment. Since the package manager resolves
  upwards to the same root, this would clobber the workspace's environment, and could fail the
  pipeline when both ran at the same time. Such projects now only setup the toolchain, so that its
  binaries are available on PATH.

v2.5.0

Compare Source

💥 Breaking

• WASM API
  • Reworked the VirtualPath type from the ground up. Is no longer an enum, but instead a newtype
    wrapper around PathBuf.
    • This allows for better interoperability with the Rust ecosystem, and makes it easier to work
      with virtual paths in general.
    • Additionally, because of this change, VirtualPath now has access to all PathBuf methods,
      which was not possible before.
  • Removed the from_virtual_path and to_virtual_path extism host functions, into_real_path
    and into_virtual_path wrapper functions, and real_path! and virtual_path! macros. Use the
    conversion utils instead (below).

🚀 Updates

• Action graph
  • Added a new mechanism where toolchains can specify requirements (other toolchains to be setup)
    for the setup environment action.
• CLI
  • Added OpenTelemetry (OTEL) support, for exporting traces, metrics, and logs over OTLP.
    • Added a --otel global option (MOON_OTEL), for exporting traces and metrics.
    • Added a --otel-logs global option (MOON_OTEL_LOGS), for exporting log events as OTLP logs.
    • Added a --otel-service-name global option (MOON_OTEL_SERVICE_NAME), for the reported
      service name.
    • The destination and transport are configured with the standard OTEL_EXPORTER_OTLP_*
      environment variables.
  • Updated the moon setup action to also setup the toolchain environment, if their dependency
    root is the same as the workspace root. Nested dependency roots will not be setup, as they are
    expected to be setup by their parent project.
  • Updated the moon exec (and related pipeline commands) to display action failures in the
    summary at the bottom, instead of interleaved within all actions.
• Config
  • Added an unstable cache.unstable_sharedWorktreeCache setting to .moon/workspace.*, which
    shares the CAS cache between all VCS worktrees on the same machine. Only blobs and manifests are
    shared, as they are portable, while hashes, locks, and states remain worktree-specific. The
    cache is stored in the base checkout's .moon/cache directory, or ~/.moon/cache/shared when
    the repository root has no checkout (bare clones). Requires the casOutputsCache experiment.
  • Added environment variable support for cache settings: MOON_CACHE_CAS_MAX_SIZE,
    MOON_CACHE_CAS_VERIFY_INTEGRITY, and MOON_CACHE_SHARED_WORKTREE_CACHE.
  • Added an env setting to .moon/tasks/**/* configs. These environment variables are inherited
    by all matching projects, and are merged into each project's env setting, with project-level
    variables taking precedence.
  • Added a workspace.mergeStrategies setting to moon.* config, which controls how project
    settings are merged with inherited workspace-level settings. Currently supports env and
    fileGroups, using the same merge strategies as task merging (append, prepend, preserve,
    and replace).
  • Project globs can now be configured with a trailing file, allowing more precise project
    matching. For example, apps/*/package.json will only find Node.js projects, and
    src/**/*.csproj will only find .NET projects. The path without file name will be used as the
    project identifier (if not defined).
    • This change does not apply to root-level projects. Use a . glob or target a moon
      configuration file.
• Daemon
  • Added task output archiving and hydrating to the daemon. All of these heavy file system
    operations will now be offloaded into the background via the daemon. Because of this, you'll
    need to inspect the daemon server logs to understand when something fails during archiving or
    hydrating, as the main process will no longer block on these operations.
• Docker
  • Improved the scaffolding and pruning workflows, by better handling edge cases, and ensuring its
    more reliable.
• Experiments
  • The asyncAffectedTracking, asyncGraphBuilding, and nativeFileHashing experiments are now
    enabled by default. If you run into issues, please report it, and then disable the experiment to
    continue.
• Project graph
  • Reworked the project graph to validate cycles per dependency scope partition. Production scoped
    dependencies (production, peer) and development scoped dependencies (development, build,
    root) are now tracked as separate internal graphs, so relationships that cross the boundary no
    longer fail with a cycle error, or silently drop dependency edges.
• WASM API
  • Added a RealPath type, which is a newtype wrapper around PathBuf that represents a real path
    on the host file system. This is a sibling to the VirtualPath type, which represents a virtual
    path in the guest WASM environment.
  • Added convert_to_virtual_path and convert_to_real_path helper functions for converting
    between real and virtual paths, using a list of host-to-guest path mappings.
    • Can also use VirtualPathExt::to_real_path and RealPathExt::to_virtual_path extension
      traits for the same functionality.
  • Added DefineRequirementsOutput.for_setup_environment and for_setup_toolchain fields, which
    allow toolchains to specify requirements for the setup environment and setup toolchain actions,
    respectively.
  • Added PruneDockerInput.project_dependencies field, which allows the toolchain to know about
    other projects that the focused project(s) depends on, so it can prune their dependencies as
    well.
  • Updated DefineRequirementsInput.toolchain_config to inherit the project-level settings when
    applicable.

🧰 Toolchains

• Go
  • The force option for bins entries is now respected, and will always install the binary.
  • Fixed configured bins not being reinstalled when their binaries were uninstalled or deleted
    outside of moon.
  • Reworked relationship inference to match package import paths instead of module paths. Each
    project now resolves a canonical import path (nearest go.mod module path plus the project's
    relative directory), and go list -deps results are matched against those by longest prefix.
    This makes relationships resolvable in repositories that share a single go.mod across all
    projects.
  • Sibling modules required by version without a go.work no longer create project relationships,
    since those builds consume the published module rather than the local source. When the go
    binary is unavailable, projects with their own go.mod under a workspace go.work fall back to
    resolving relationships from their direct requires.
  • replace directives keep their meaning in the new model: a require replaced by a local
    directory always links to the project at that location (it consumes local source even without a
    go.work), while a require replaced by another module never links.
  • Imports within a project's own import path are treated as ownership rather than dependencies.
    go list -deps ./... enumerates packages belonging to projects nested inside the scanned
    project, which previously inferred an edge from the parent to every nested child — forming a
    cycle whenever a child declared dependsOn on its parent.
• JavaScript
  • Added unstable support for Nub as a package manager:
    • Natively uses nub.lock (pnpm lockfile format), but will locate dependency roots using other
      package manager lockfiles that nub can operate on.
    • Reads workspace members and catalogs from pnpm-workspace.yaml when present, otherwise from
      package.json.
    • Does not require the Node.js toolchain, as nub is a standalone binary.
  • Fixed bun.lock parsing failing on Git/GitHub dependencies that include both package metadata
    (dependencies, bin, etc) and an integrity hash.
• Node
  • Deprecated the syncVersionManagerConfig setting (it never worked correctly).
• Python
  • Ensures that package manager toolchains are installed before setting up the environment.
  • Added support to the Docker pruning workflow where we remove .venv directories for non-focused
    projects (those that were not explicitly scaffolded).
• Rust
  • Fixed an issue where Docker scaffolding would leave behind empty lib.rs or main.rs files.
  • Fixed configured bins not being reinstalled when their binaries were uninstalled or deleted
    outside of moon. Only missing binaries are now installed.

🐞 Fixes

• Fixed an issue where the --stack and --source options of moon query projects displayed each
  other's help text. The filtering behavior itself was correct.
• Fixed an issue where toolchain executable paths were not properly applied to all child processes.
• Fixed an issue where project and task graph node lookups could resolve the wrong entry, or fail
  entirely, after building a partial graph (a subset of projects), as internal node identifiers were
  not re-synced when placeholder nodes were removed.
• Fixed an issue where the async graph builder would fail with "unknown target" when a task
  dependency referenced a project by its alias.
• Fixed an issue where the async graph builder would produce differently ordered graphs across runs,
  as projects were inserted in completion order instead of a stable order. This could cause unstable
  hashes and --dot/--json output.
• Fixed an issue where a task with runDepsInParallel: false would not be linked to all of its
  dependencies when a serial ordering edge was skipped to avoid a cycle, allowing the task to run
  before a dependency had finished.
• Fixed an issue where moon would abort on startup with "Failed to load Git submodules" in
  repositories without a .gitmodules file, when the git object database was incomplete or
  unreachable (e.g. partial clones, or --reference clones whose alternates are inaccessible).
  Submodule detection is now skipped entirely when no .gitmodules file exists.
• Fixed an issue where the synchronous affected tracker (experiments.asyncAffectedTracking
  disabled) would silently skip transitive dependent tasks when running with --downstream and
  --include-relations, and could even schedule fewer tasks when the change set grew, as affected
  marks were accumulated lazily in target iteration order. Affected status is now tracked up front,
  mirroring the asynchronous tracker.
• Fixed an issue on Windows where path variables ($workspaceRoot, $workingDir, $projectRoot)
  expanded using the Windows path format (C:\path) based on the shell moon was executed from,
  instead of the shell the task runs in. When the windowsShell task option is bash, they now
  expand using the Unix path format (/c/path) that bash expects.
• Fixed an issue where --downstream deep would also expand the dependents of upstream
  dependencies, running tasks that are not dependents of the requested targets (with a deep enough
  graph, the entire connected component). Downstream expansion now only flows from the requested
  targets through their dependent chains, matching how --downstream direct already behaved.
• Fixed an issue where a failed proto installation would not abort the pipeline nor surface its
  error. Dependent toolchain actions would run in the broken environment and fail with misleading
  errors (like a missing proto-shim binary) that masked the root cause. Setup proto and setup
  environment failures now abort the pipeline immediately, and when multiple actions fail, the first
  failure is reported instead of the last.

⚙️ Internal

• Renamed the TaskMergeStrategy type to MergeStrategy in @moonrepo/types, as it's no longer
  exclusive to tasks.
• Updated proto to v0.60.2 from 0.58.2.
• Updated Rust to v1.97.0.
• Updated dependencies.

v2.4.6

Compare Source

🚀 Updates

• Updated MOON_BASE and MOON_HEAD to no longer require also passing --affected.

🐞 Fixes

• Fixed an issue in GitLab CI where the wrong HEAD would be used for merge request pipelines.

v2.4.5

Compare Source

🐞 Fixes

• Fixed an issue where HTTP remote cache would deserialize manifests into the wrong shape, resulting
  in failed caching.
• Fixed an issue where dependency deduping would run on fresh/initial installs.

v2.4.4

Compare Source

🐞 Fixes

• Fixed remote caching against backends that validate the Bazel RE contract (like Depot), where
  every upload was rejected with "client should not populate stdout_raw during upload" or "action
  digest not found in CAS", leaving the cache permanently empty.
• Fixed cache hits replaying no task output when a remote server returns a stdout/stderr digest
  without also inlining the raw bytes.
• Fixed an issue where gRPC remote cache uploads would fail with "Failed to store blob" when the
  server returned a RESOURCE_EXHAUSTED error, because a blob was too large. We now set the max
  size to 4MB (the gRPC limit).
• Fixed an issue where HTTP remote cache was not respecting the
  unstable_remote.cache.localReadOnly setting.

v2.4.3

Compare Source

🚀 Updates

• Added Renovate support. View the official guide for more
  information.
• Updated BitBucket codeowners to use the
  new syntax & file location.
  If you are using the old syntax, you can use bitbucket-legacy instead.

🐞 Fixes

• Fixed an issue where runDepsInParallel: false would only serialize direct dependencies, allowing
  a dependency's own dependencies (grandchildren) to run in parallel with earlier serial
  dependencies. The entire dependency subtree is now ordered.
• Fixed moon ci failing in certain CI provider pull request builds, where the base branch is
  provided as a fully-qualified refs/heads/<branch> ref that couldn't be resolved in a detached
  HEAD checkout.
• Fixed task binaries failing with "command not found" in CI providers like CircleCI, where an
  export PATH=... in the $BASH_ENV file would overwrite the PATH that moon injects for tasks.
  BASH_ENV is no longer passed to bash wrapped child processes, unless explicitly set with the
  task env option.
• Fixed an issue where task outputStyle was being applied to the primary target. It will only
  apply to transitive targets.
• Fixed an issue where captured task output containing non-UTF-8 bytes (for example, Windows
  codepage output from Python) was discarded entirely, resulting in empty stdout.log/stderr.log
  state files, cache hits replaying no output, and missing output in run reports. Invalid bytes are
  now replaced with � instead.
• Fixed an issue where a task's dependents would not run when requested with a downstream scope
  (moon ci, --dependents, --downstream), if the task was first added to the action graph as a
  dependency of another target. For example, moon run app:build lib:build --dependents would skip
  the dependents of lib:build when app:build depends on it.
• Fixed tasks that emit read-only outputs (e.g. 0444 files) failing on every cache hit with a
  "Permission denied" error when the casOutputsCache experiment is enabled. Caches that already
  contain read-only objects are healed automatically.
• Fixed an issue where moon query changed-files would include uncommitted changes from the local
  index (git status) even when an explicit --head revision was provided, causing false positives
  when comparing 2 revisions. This also applies to affected detection with an explicit head, e.g.
  the MOON_HEAD environment variable or --affected base:head. Additionally, MOON_BASE and
  MOON_HEAD environment variables that are set but empty are now ignored.
• Fixed an issue where synced VCS hooks were always written to .moon/hooks, even when the
  workspace configuration lived in .config/moon. Hooks are now placed alongside the config, in
  .config/moon/hooks.
• Fixed an issue where a failing task would always exit moon with code 1, instead of propagating
  the task's actual exit code.

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • At any time (no schedule defined)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.