chore(deps): update non-major dependencies

[renovate]

This PR contains the following updates:

Package	Change	Age	Confidence	Type	Update
@datadog/browser-rum (source)	6.25.1 → 6.25.2			dependencies	patch
@dotenvx/dotenvx	1.51.2 → 1.51.4			dependencies	patch
@kong/kongponents (source)	9.48.6 → 9.49.2			dependencies	minor
@kong/spec-renderer	1.102.2 → 1.103.2			dependencies	minor
algoliasearch (source)	5.46.1 → 5.46.2			dependencies	patch
liquid-c (source)	4.0.1 → 4.2.0				minor
nokogiri	1.18.10 → 1.19.0				minor
pry	0.15.2 → 0.16.0				minor
rouge (source, changelog)	4.6.1 → 4.7.0				minor
rubocop (source, changelog)	1.82.0 → 1.82.1				patch
ruby (source)	3.4.4 → 3.4.8				patch
shiki (source)	3.20.0 → 3.21.0			dependencies	minor
undici (source)	7.16.0 → 7.18.2			dependencies	minor
vite-plugin-ruby (source)	5.1.1 → 5.1.2			devDependencies	patch
vue-instantsearch	4.22.6 → 4.22.8			dependencies	patch

---

Warning

Some dependencies could not be looked up. Check the Dependency Dashboard for more information.

---

Release Notes

DataDog/browser-sdk (@​datadog/browser-rum)

v6.25.2

Compare Source

Public Changes:

• 🐛 Fix profiling <-> long task association regression (#​4045) [RUM] [RUM-REACT] [RUM-SLIM]
• 🐛 Fix flaky long task <-> action correlation (#​4050) [RUM] [RUM-REACT] [RUM-SLIM]

Internal Changes:

• ✨[PANA-5288] Update rum-events-format to pull in BrowserChangeRecord (#​4035) [FLAGGING] [LOGS] [RUM] [RUM-REACT] [RUM-SLIM] [WORKER]
• Revert "👷 disable deploy-prod-canary during the freeze (#​4053)" (#​4058)
• 👷 disable deploy-prod-canary during the freeze (#​4053)
• 👷 update the token to AWS after renewing it (#​4048)
• 🎨 [PANA-5260] Consolidate recorder object id tracking code (#​4049) [RUM]
• 🔊 add debug logs to npm publishing command (#​4047)

dotenvx/dotenvx (@​dotenvx/dotenvx)

v1.51.4

Compare Source

Changed

• Change description of dotenvx-ops to better reflect its tooling as operational primitives on top of dotenvx for production use cases. (#​721)

v1.51.3

Compare Source

Added

• Add hint on .env.keys for dotenvx ops backup. Dotenvx Ops Backup lets you back up your private keys securely with just a single command. It's a convenient alterantive to manually copy/pasting them in and out of 1Password. (#​718)

Kong/kongponents (@​kong/kongponents)

v9.49.2

Compare Source

Bug Fixes

• ktreelist: loosen tree list item interface (#​3046) (fbb5a04)

v9.49.1

Compare Source

Bug Fixes

• deps: bump @​vue/tsconfig and vue-tsc (#​3042) (1edfda3)

v9.49.0

Compare Source

Features

• kslider: make step labels clickable [KHCP-19044] (#​3038) (a603868)

9.48.9 (2026-01-06)

Bug Fixes

• deps: update all non-major dependencies with stable versions (#​3035) (418fe4b)

9.48.8 (2025-12-26)

Bug Fixes

• deps: update all non-major dependencies with stable versions (#​3028) (6af0b03)

9.48.7 (2025-12-24)

Bug Fixes

• deps: update all non-major dependencies with stable versions (#​3033) (631c403)

9.48.6 (2025-12-17)

Bug Fixes

• ktextarea: fix mixin inclusion to prevent invalid css (#​3026) (5a4aaf6)

9.48.5 (2025-12-16)

Bug Fixes

• kcodeblock: ssr types check (#​3027) (3a72b7a)

9.48.4 (2025-12-12)

Bug Fixes

• kdatetimepicker: time inputs on same line (#​3023) (1c671e9)

9.48.3 (2025-12-08)

Bug Fixes

• kalert: link style (#​3018) (f0799a0)

9.48.2 (2025-12-08)

Bug Fixes

• deps: update dependency @​kong/icons to ^1.41.0 (#​3010) (d45871e)

9.48.1 (2025-12-04)

Bug Fixes

• ktoaster: revert prevent creating duplicate containers [KHCP-18535] (#​3015) (6d54c42)

v9.48.9

Compare Source

Bug Fixes

• deps: update all non-major dependencies with stable versions (#​3035) (418fe4b)

v9.48.8

Compare Source

Bug Fixes

• deps: update all non-major dependencies with stable versions (#​3028) (6af0b03)

v9.48.7

Compare Source

Bug Fixes

• deps: update all non-major dependencies with stable versions (#​3033) (631c403)

Kong/spec-renderer (@​kong/spec-renderer)

v1.103.2

Compare Source

Bug Fixes

• hide customer reference from extension documentation (#​774) (db9080f)

v1.103.1

Compare Source

Bug Fixes

• no cache for token when token not returned [TDC-7260] (#​773) (536e532)

v1.103.0

Compare Source

Bug Fixes

• deps: update all non-major dependencies with stable versions (#​754) (0848e21)
• deps: update all non-major dependencies with stable versions (#​755) (95b18b1)
• deps: update dependency @​kong/icons to ^1.41.0 (#​757) (09a6e72)
• deps: update qs to resolve vulnerabilities (#​772) (8cafd5b)
• trigger pr-audit on PR labeling (#​753) (b40fefc)

Features

• support for x-kong-client-credentials-config extension [TDX-7964] (#​767) (8527517)

1.102.2 (2026-01-05)

Bug Fixes

• deps: update all non-major dependencies with stable versions (#​754) (0848e21)
• deps: update all non-major dependencies with stable versions (#​755) (95b18b1)
• deps: update dependency @​kong/icons to ^1.41.0 (#​757) (09a6e72)
• deps: update qs to resolve vulnerabilities (#​772) (8cafd5b)
• trigger pr-audit on PR labeling (#​753) (b40fefc)

1.102.2 (2026-01-02)

Bug Fixes

• deps: update all non-major dependencies with stable versions (#​754) (0848e21)
• deps: update all non-major dependencies with stable versions (#​755) (95b18b1)
• deps: update dependency @​kong/icons to ^1.41.0 (#​757) (09a6e72)
• trigger pr-audit on PR labeling (#​753) (b40fefc)

1.102.2 (2026-01-02)

Bug Fixes

• deps: update all non-major dependencies with stable versions (#​754) (0848e21)
• deps: update all non-major dependencies with stable versions (#​755) (95b18b1)
• deps: update dependency @​kong/icons to ^1.41.0 (#​757) (09a6e72)
• trigger pr-audit on PR labeling (#​753) (b40fefc)

1.102.2 (2025-12-31)

Bug Fixes

• deps: update all non-major dependencies with stable versions (#​754) (0848e21)
• deps: update dependency @​kong/icons to ^1.41.0 (#​757) (09a6e72)
• trigger pr-audit on PR labeling (#​753) (b40fefc)

1.102.2 (2025-12-30)

Bug Fixes

• deps: update all non-major dependencies with stable versions (#​754) (0848e21)
• deps: update dependency @​kong/icons to ^1.41.0 (#​757) (09a6e72)
• trigger pr-audit on PR labeling (#​753) (b40fefc)

1.102.2 (2025-12-30)

Bug Fixes

• deps: update all non-major dependencies with stable versions (#​754) (0848e21)
• deps: update dependency @​kong/icons to ^1.41.0 (#​757) (09a6e72)
• trigger pr-audit on PR labeling (#​753) (b40fefc)

1.102.2 (2025-12-29)

Bug Fixes

• deps: update all non-major dependencies with stable versions (#​754) (0848e21)
• deps: update dependency @​kong/icons to ^1.41.0 (#​757) (09a6e72)
• trigger pr-audit on PR labeling (#​753) (b40fefc)

1.102.2 (2025-12-22)

Bug Fixes

• deps: update dependency @​kong/icons to ^1.41.0 (#​757) (09a6e72)
• trigger pr-audit on PR labeling (#​753) (b40fefc)

1.102.2 (2025-12-17)

Bug Fixes

• deps: update dependency @​kong/icons to ^1.41.0 (#​757) (09a6e72)
• trigger pr-audit on PR labeling (#​753) (b40fefc)

1.102.2 (2025-12-04)

Bug Fixes

• deps: update dependency @​kong/icons to ^1.41.0 (#​757) (09a6e72)
• trigger pr-audit on PR labeling (#​753) (b40fefc)

1.102.2 (2025-12-03)

Bug Fixes

• deps: update dependency @​kong/icons to ^1.41.0 (#​757) (09a6e72)
• trigger pr-audit on PR labeling (#​753) (b40fefc)

1.102.2 (2025-12-02)

Bug Fixes

• deps: update dependency @​kong/icons to ^1.41.0 (#​757) (09a6e72)
• trigger pr-audit on PR labeling (#​753) (b40fefc)

1.102.2 (2025-11-28)

Bug Fixes

• trigger pr-audit on PR labeling (#​753) (b40fefc)

1.102.1 (2025-11-25)

Bug Fixes

• back to publishing using semantic-release [KHCP-17673] (#​748) (0aeb96f)

algolia/algoliasearch-client-javascript (algoliasearch)

v5.46.2

Compare Source

• c88b505d6 chore: migrate lerna config (#​5772) by @​shortcuts
• 005aa6524 chore(deps): dependencies 2025-12-22 (#​5775) by @​algolia-bot

rouge-ruby/rouge (rouge)

v4.7.0

Compare Source

Comparison with the previous version

• General
  • Bump actions/checkout to v5 (#​2166 by Tan Le)
• COBOL Lexer
  • feat: add support for highlight .cpy and .cpb files as COBOL (#​2186 by simon)
• Gjs and Gts Lexer (NEW)
  • Created lexers for gjs and gts (used by Ember projects) (#​2165 by Isaac Lee)
• Go Lexer
  • support underscore in numbers in go (#​2167 by Joris Clement)
• PHP Lexer
  • php: Support enum definition (#​2171 by nsfisis)
  • php: Support typed class constants (#​2174 by nsfisis)
  • php: Support asymmetric visibility (#​2173 by nsfisis)
  • php: Support alternative notation of octal number literal (0o prefix) (#​2170 by nsfisis)
  • php: Update built-in functions (rake builtins:php) (#​2175 by nsfisis)
• Python Lexer
  • Add Python 3.14+ template strings (#​2162 by Bart Broere)
• Terraform Lexer
  • Support .tofu for Terraform lexing (#​2180 by Asherah Connor)

rubocop/rubocop (rubocop)

v1.82.1

Compare Source

Bug fixes

• #​14736: Fix an error for Style/TrailingCommaInArguments when EnforcedStyleForMultiline is consistent_comma and keyword arguments use a trailing comma. ([@​koic][])
• #​14737: Fix crash in Layout/RedundantLineBreak when Layout/LineLength is disabled. ([@​ydakuka][])
• #​14719: Fix crash on long lines when Layout/LineLength is disabled. ([@​floriandejonckheere][])
• #​14743: Fix false positives for Layout/MultilineMethodCallIndentation when multiline method chain with block has expected indent width and the method is preceded by splat or double splat. ([@​koic][])
• #​12297: Fix false negative in Layout/IndentationWidth for multiline method chain blocks. ([@​rscq][])
• #​14730: Fix the cache implementation to use consistent cache keys across workers. ([@​byroot][])
• #​14559: Fix false positives for Lint/UselessAssignment when a variable is assigned in loop body and used in loop condition. ([@​ydakuka][])

shikijs/shiki (shiki)

v3.21.0

Compare Source

   🚀 Features

• Update grammar  -  by @​antfu (6d109)
• core: Preserve HAST data and properties in codeToHast  -  by @​AmanCrafts in #​1204 (747ea)

   🐞 Bug Fixes

• vitepress-twoslash: Fix scroll blocking on mobile viewports  -  by @​dahlia in #​1235 (8e931)

    View changes on GitHub

nodejs/undici (undici)

v7.18.2

Compare Source

What's Changed

• fix(decompress): limit Content-Encoding chain to 5 to prevent resourc… by @​mcollina in #​4729

Full Changelog: nodejs/undici@v7.18.1...v7.18.2

v7.18.1

Compare Source

v7.18.0

Compare Source

What's Changed

Full Changelog: nodejs/undici@v7.17.0...v7.18.0

v7.17.0

Compare Source

What's Changed

• chore: extract infra and encoding methods by @​Uzlopak in #​4523
• ci: remove h2 by @​Uzlopak in #​4534
• ci: make nodejs-shared wf reusable, install binaryen for wasm-opt, test on node-nightly by @​Uzlopak in #​4535
• ci: fix nightly shared library case by @​Uzlopak in #​4543
• test: consume bodies of fetch responses to fix failing macos 20 ci by @​Uzlopak in #​4528
• docs: add Cache Interceptor example to README by @​tawseefnabi in #​4393
• test: remove node20 version check by @​Uzlopak in #​4544
• types: use MessagePort instance type in MessageEvent by @​Renegade334 in #​4546
• ci: set write permissions on job level by @​Uzlopak in #​4537
• lint: activate n/no-process-exit by @​Uzlopak in #​4548
• ci: run benchmarks on pull_requests and by pushing on specific branches only by @​Uzlopak in #​4536
• chore: activate n/prefer-node-protocol to enforce 'node:' prefix for requiring node built-ins by @​Uzlopak in #​4547
• feat(H2): correct CONNECT behaviour by @​metcoder95 in #​4541
• test: fix plans by @​Uzlopak in #​4550
• feat: add runtime feature "detection" by @​Uzlopak in #​4545
• perf: use less promises in extractBody by @​Uzlopak in #​4458
• fix(proxy-agent): add missing return after callback-call by @​Uzlopak in #​4553
• fix: remove redundant line in retry-handler by @​Uzlopak in #​4554
• ci: add no-wasm-simd option by @​Uzlopak in #​4533
• fix: use lazyloaders for runtime feature detection by @​Uzlopak in #​4557
• fix: minor changes in dispatcher-base.js and types for Dispatcher by @​Uzlopak in #​4556
• http2: refactor and split tests of http2.js into multiple files by @​Uzlopak in #​4561
• fix: dns-interceptor test should await plan to complete by @​Uzlopak in #​4560
• chore: remove istanbul instructions by @​Uzlopak in #​4559
• fix: keep promise chains intact by @​Uzlopak in #​4558
• build(deps): bump wait-on from 8.0.5 to 9.0.1 in /benchmarks by @​dependabot[bot] in #​4567
• chore: remove tspl from eventsource by @​Uzlopak in #​4569
• chore: remove tspl from fetch by @​Uzlopak in #​4570
• feat: add getUpstream() method to BalancedPool by @​mcollina in #​4586
• fetch: handle invalid priority values properly by @​Uzlopak in #​4522
• ci: fix test coverage for codecov by @​Uzlopak in #​4520
• types: optional status in Response.redirect by @​gineika in #​4591
• docs: unix socket add-on by @​FelixVaughan in #​4587
• build(deps): bump codecov/codecov-action from 5.5.0 to 5.5.1 by @​dependabot[bot] in #​4601
• build(deps): bump hendrikmuhs/ccache-action from 1.2.18 to 1.2.19 by @​dependabot[bot] in #​4600
• build(deps): bump ossf/scorecard-action from 2.4.2 to 2.4.3 by @​dependabot[bot] in #​4603
• build(deps): bump actions/setup-node from 4.0.2 to 5.0.0 by @​dependabot[bot] in #​4604
• build(deps): bump actions/github-script from 7.0.1 to 8.0.0 by @​dependabot[bot] in #​4602
• build(deps): bump step-security/harden-runner from 2.13.0 to 2.13.1 by @​dependabot[bot] in #​4598
• build(deps): bump github/codeql-action from 3.30.0 to 3.30.5 by @​dependabot[bot] in #​4599
• build(deps): bump actions/dependency-review-action from 4.7.3 to 4.8.0 by @​dependabot[bot] in #​4597
• fix: cacheStores types and usage in README by @​lucalooz in #​4605
• Feat dns interceptor storage by @​SuperOleg39 in #​4589
• docs: add crawling best practices by @​Uzlopak in #​4590
• fix: 304 not modified reply upon revalidation did not update cache. by @​daan944 in #​4617
• chore: use testcontext for test:infra by @​Uzlopak in #​4579
• fetch: improve regexes in data-uri.js by @​Uzlopak in #​4483
• perf: optimize validate http token by @​PandaWorker in #​4608
• test: improve long-lived-abort-controller test by @​Uzlopak in #​4621
• ci: add node.js 25 to test matrix by @​shivarm in #​4626
• chore: use testcontext for test/utils tests by @​Uzlopak in #​4577
• chore: remove tspl from websocket by @​Uzlopak in #​4568
• fix(ws) onSocketClose being called multiple times by @​KhafraDev in #​4632
• fix: prevent duplicate debug logs when multiple undici instances exist by @​mcollina in #​4630
• chore: use testcontext for busboy tests by @​Uzlopak in #​4572
• test: fix flaky http2-dispatcher test by @​mcollina in #​4633
• build(deps): bump uWebSockets.js from v20.52.0 to v20.54.0 in /benchmarks by @​dependabot[bot] in #​4635
• Run the gc() in long-lived-abort-controller test by @​mcollina in #​4638
• Do not destroy the HTTP2 stream twice in tests by @​mcollina in #​4637
• Fix http2-dispatcher test by @​mcollina in #​4640
• fix: fetch blob with range off-by-one error by @​platypii in #​4643
• fix: ensure HTTP/2 sends Content-Length for empty POST requests by @​mcollina in #​4613
• build(deps): bump uWebSockets.js from v20.54.0 to v20.55.0 in /benchmarks by @​dependabot[bot] in #​4645
• feat(#​2458): WebSocket through HTTP/2 by @​metcoder95 in #​4540
• docs(README): correct the example code for the consumption of respons… by @​tenkirin in #​4658
• build(deps): bump github/codeql-action from 3.30.5 to 4.31.2 by @​dependabot[bot] in #​4653
• build(deps): bump fastify/github-action-merge-dependabot from 3.11.1 to 3.11.2 by @​dependabot[bot] in #​4655
• build(deps): bump actions/setup-node from 5.0.0 to 6.0.0 by @​dependabot[bot] in #​4652
• build(deps): bump actions/upload-artifact from 4.6.2 to 5.0.0 by @​dependabot[bot] in #​4651
• build(deps): bump actions/dependency-review-action from 4.8.0 to 4.8.1 by @​dependabot[bot] in #​4654
• don't freeze urlList for opaque filtered responses by @​KhafraDev in #​4656
• fix fd parsing unquoted attribute values by @​KhafraDev in #​4662
• build(deps): bump uWebSockets.js from v20.55.0 to v20.56.0 in /benchmarks by @​dependabot[bot] in #​4665
• feat(dispatcher/proxy-agent): new diagnostics event 'undici:proxy:connected' by @​SuperOleg39 in #​4659
• Feat/round robin pool by @​FelixVaughan in #​4650
• Formdata ignore epilogue preamble by @​KhafraDev in #​4672
• build(deps): bump actions/checkout from 5.0.0 to 6.0.0 by @​dependabot[bot] in #​4682
• fix: snapshot url exclusion by @​FelixVaughan in #​4670
• feat: support h2c over unix domain sockets by @​chrros95 in #​4690
• fix(docs): remove unused TypeScript example code block by @​kerolloz in #​4701
• feat: add deduplicate interceptor for request deduplication by @​mcollina in #​4679
• chore: use testcontext for mock tests by @​Uzlopak in #​4582
• fix(test): remove hardcoded folder name in client-error-stack-trace test by @​mcollina in #​4707

New Contributors

• @​gineika made their first contribution in #​4591
• @​lucalooz made their first contribution in #​4605
• @​SuperOleg39 made their first contribution in #​4589
• @​daan944 made their first contribution in #​4617
• @​PandaWorker made their first contribution in #​4608
• @​platypii made their first contribution in #​4643
• @​tenkirin made their first contribution in #​4658
• @​kerolloz made their first contribution in #​4701

Full Changelog: nodejs/undici@v7.16.0...v7.17.0

ElMassimo/vite_ruby (vite-plugin-ruby)

v5.1.2

Compare Source

algolia/instantsearch (vue-instantsearch)

v4.22.8

Compare Source

Note: Version bump only for package vue-instantsearch

v4.22.7

Compare Source

Note: Version bump only for package vue-instantsearch

---

Configuration

📅 Schedule: Branch creation - "every weekend" (UTC), Automerge - At any time (no schedule defined).

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

[netlify]

❌ Deploy Preview for kongdeveloper failed.

Name	Link
🔨 Latest commit	6dcf426
🔍 Latest deploy log	https://app.netlify.com/projects/kongdeveloper/deploys/695fea1b768ab20008272d00