fix(deps): update external fixes

[renovate]

This PR contains the following updates:

Package	Type	Update	Change	Pending	Age	Confidence
actions/checkout (changelog)	action	digest	9c091bb → 3d3c42e
express-rate-limit	dependencies	patch	8.6.0 → 8.6.2	8.7.0
fs-extra	dependencies	minor	11.3.6 → 11.4.0
isomorphic-git (source)	dependencies	minor	1.38.7 → 1.41.5	1.41.9 (+2)
jose	dependencies	patch	6.2.3 → 6.2.9	6.2.10
node	uses-with	minor	24.18.0 → 24.19.0	24.20.0
open	dependencies	patch	11.0.0 → 11.0.1	11.0.2
yargs (source)	dependencies	minor	18.0.0 → 18.1.0

---

Release Notes

express-rate-limit/express-rate-limit (express-rate-limit)

v8.6.2

Compare Source

You can view the changelog here.

v8.6.1

Compare Source

You can view the changelog here.

jprichardson/node-fs-extra (fs-extra)

v11.4.0

Compare Source

• Proper EEXIST error when trying to create a symlink and the dest already exists as a broken symlink (#​925, #​1076)

isomorphic-git/isomorphic-git (isomorphic-git)

v1.41.5

Compare Source

Bug Fixes

• include file mode changes in filepath log (#​2413) (07c6fe7)

v1.41.4

Compare Source

Bug Fixes

• restore checkout filepaths from the index (#​2409) (25dc739)

v1.41.3

Compare Source

Bug Fixes

• don't split a CRLF that straddles two chunks in splitLines (#​2397) (aa6812c)

v1.41.2

Compare Source

Bug Fixes

• expose internal git lock for tests (#​2404) (0d7c8e0)

v1.41.1

Compare Source

Bug Fixes

• read url credentials with the WHATWG parser (#​2399) (435278f)

v1.41.0

Compare Source

Features

• http: support custom fetchOptions in built-in HTTP clients (#​2369) (4492cf9), closes #​1246

v1.40.8

Compare Source

Bug Fixes

• recursive mkdir (#​2402) (d27f143)

v1.40.7

Compare Source

Bug Fixes

• recognize the scp-like syntax with a user other than git (#​2400) (332c66d)

v1.40.6

Compare Source

Bug Fixes

• global acquire lock (#​2401) (5767a6f)

v1.40.5

Compare Source

Bug Fixes

• don't crash on a peeled tag whose tag the prefix filtered out (#​2398) (7276b1c)

v1.40.4

Compare Source

Bug Fixes

• ci: stop passing the string 'undefined' to bundlewatch (#​2396) (da73fff), closes #​2208

v1.40.3

Compare Source

Bug Fixes

• honour core.autocrlf when status hashes the working copy (#​2395) (b31efe2), closes #​1275 #​1275

v1.40.2

Compare Source

Bug Fixes

• apply .gitignore only to files that are not tracked (#​2394) (f8bf9db), closes #​765 #​765

v1.40.1

Compare Source

Bug Fixes

• exclude git system files when expanding a ref (#​2393) (268d9e9), closes #​767 #​709 #​767

v1.40.0

Compare Source

Features

• log: include changed file object ids (#​2385) (5aff8af)

v1.39.0

Compare Source

Features

• commit: add disallowEmpty option (#​2384) (bb1c7c2)

v1.38.10

Compare Source

Bug Fixes

• statusMatrix: do not traverse symlinks in GitWalkerFs (#​1215) (#​2382) (90ea101)

v1.38.9

Compare Source

Bug Fixes

• Preserve binary files when writing conflicted working tree (#​2380) (b41b1ab)

v1.38.8

Compare Source

Bug Fixes

• unsafe symlink from cherry pick (#​2377) (4664c8e)

panva/jose (jose)

v6.2.9

Compare Source

Fixes

• reject a JWE whose generated Key Management Parameters collide (6ed19a6)
• types: undeprecate PBES2 p2c parameter (33bf832)

v6.2.8

Compare Source

Fixes

• enforce a single recipient when decrypting dir and ECDH-ES (505c383)
• reject a non-string "alg" in EmbeddedJWK (714f870)

Refactor

• index the JWS and JWE registries without a wrapper (925f3bb)
• name the "alg" source in unsupported algorithm failures (1500459)

v6.2.7

Compare Source

Fixes

• require own JOSE properties for presence checks (90ab09c)

Refactor

• reduce bundle size (767d7f1)

v6.2.6

Compare Source

Fixes

• types: accept host CryptoKey declarations (b48a15b)

v6.2.5

Compare Source

Fixes

• compare claim values for falsy validation options (eb86956)
• forward key management parameters for a single JWE recipient (2d4f801)
• handle a zero-length JWE additional authenticated data (16ca398)
• reject a generateKeyPair crv option the algorithm does not imply (76364e9)
• reject an unencoded payload in the JWS Compact Serialization (01d053f)
• reject characters outside the Base64URL alphabet (0ebb971), references #​879
• reject duplicate "crit" values when producing (31d60e1)
• reject invalid UTF-8 in JOSE Headers and JWT Claims Sets (5df3fed)
• reject truncated ASN.1 key data (7a16c66)
• surface non-ASCII token segments as JOSE errors (194fe11)
• types: correct JWK and CryptoKey types (62a196d)
• types: correct key resolver and JWT header types (e95f8c4)
• validate the clockTolerance and currentDate options are finite (ab2f18d)

Documentation

• correct subpaths and API documentation (2daec38)
• document consumer-supplied type parameters (9e9f66c)
• stop claiming the JWK "use" parameter is used during import (47a07b2)
• update CHANGELOG.md (fc51bf5)

Refactor

• assert key shape and type from the entry (971057e)
• avoid 32-bit truncation of the AES-CBC-HMAC AAD bit length (1c8c6e9)
• correct swapped JWE unprotected header type error messages (894c498)
• describe each JWS algorithm once (7375028)
• discriminate a key once (0b59a69)
• fold single-consumer modules into their consumers (c2f0ca3)
• generate and import keys from the entry (da69b68)
• keep JWE out of the JWKS and embedded-JWK paths (241dd48)
• keep JWS and JWE out of each other's bundles (2a98564)
• parse a Protected Header in one place (30f72af)
• resolve the content encryption algorithm once (98b50ab)
• tighten key property checks (fe0dc3b)
• types: add discriminated JOSE error types (f7f764e)
• types: add JOSE identifier unions and JWK narrowing (2a20f49)
• types: improve key and result inference (cb25e77)
• types: trim published declaration comments (544f179)
• unify base64 decode errors (3a91833)
• validate each token once rather than once per layer (bbdae09)
• write each algorithm identifier once (73d83b5)

v6.2.4

Compare Source

Documentation

• update README.md and SECURITY.md to reflect passed EOL dates (2a84032)

Refactor

• normalize JWK export members from runtime quirks (386a3eb)

actions/node-versions (node)

v24.19.0: 24.19.0

Compare Source

Node.js 24.19.0

v24.18.1: 24.18.1

Compare Source

Node.js 24.18.1

sindresorhus/open (open)

v11.0.1

Compare Source

• Fix WSL failure when the working directory is unreachable from Windows 6ac3fe4

---

yargs/yargs (yargs)

v18.1.0

Compare Source

Features

• ignore bun when getting bin name (b77831c)

Bug Fixes

• lang: 'count' for de locale (#​2476) (971e351)
• local prototype pollution vulnerability in apply-extends (437f3a4)
• locale: add Georgian translation (#​2474) (086aeaa)

---

Configuration

📅 Schedule: (in timezone Europe/Zurich)

• Branch creation
  • "after 2pm on Monday"
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Enabled.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

[github-actions]

This PR will trigger a patch release when merged.

[tripodsan]

🎉 This PR is included in version 16.21.14 🎉

The release is available on:

• npm package (@latest dist-tag)
• GitHub release

Your semantic-release bot 📦🚀