Hey @PeterDaveHello, Thank you for the contribution.

This looks good to me, I'll leave the release page for version for reference 20.19.2

Notable Changes

(CVE-2025-23166) fix error handling on async crypto operation
(CVE-2025-23167) (SEMVER-MAJOR) update llhttp to 9.2.0
(CVE-2025-23165) add missing call to uv_fs_req_cleanup

We might want to look out for that update to llhttp

Ah, we usually use Renovate for this but it got disabled when we moved to the RooCodeInc organization. I just turned it back on - let's see if that version bump comes through in there as well.

This just came through from Renovate #4159

Thank you @PeterDaveHello !

It seems PR #4159 is not as comprehensive as this one. The workflows under https://github.com/RooCodeInc/Roo-Code/tree/main/.github/workflows are still using the older version. It feels especially questionable to replace an existing, more complete PR with a newer one that does the same thing but is less thorough.

With all due respect, Roo Code is a fantastic project. However, if the maintainers currently have limited bandwidth and tend to prioritize PRs that appear more appealing at first glance, such as automated dependency updates from bots (which often lack thorough validation), bots copying commits from downstream, or adding new LLM models, contributors might feel discouraged from investing effort into carefully addressing bug fixes (e.g., #2303, #3958) or improving dependency security.

I fully understand that not all my PRs will or should be accepted. I'm open to further discussion and would appreciate any feedback on how I can better align my contributions with the project's goals.

It seems PR #4159 is not as comprehensive as this one. The workflows under https://github.com/RooCodeInc/Roo-Code/tree/main/.github/workflows are still using the older version. It feels especially questionable to replace an existing, more complete PR with a newer one that does the same thing but is less thorough.

Sorry about that! I do think that we should have an automated dependency checker like Renovate since it's hard to count on people to be on top of all of the important changes, but this is a great example of why there's no substitute for human judgement. Really appreciate your contribution and your keeping us honest. I just included your commit in #4212.

With all due respect, Roo Code is a fantastic project. However, if the maintainers currently have limited bandwidth and tend to prioritize PRs that appear more appealing at first glance, such as automated dependency updates from bots (which often lack thorough validation), bots copying commits from downstream, or adding new LLM models, contributors might feel discouraged from investing effort into carefully addressing bug fixes (e.g., #2303, #3958) or improving dependency security.

I fully understand that not all my PRs will or should be accepted. I'm open to further discussion and would appreciate any feedback on how I can better align my contributions with the project's goals.

We've been moving toward an Issue-First model in hopes that it helps with alignment of PRs with project goals. Would love to discuss if you have any feedback on that approach. Thank you for all of your contributions!

I apologize as well, I assumed that renovate would also update what this PR did.

Thank you for letting us know about the mistake.

I'll pay more attention to the contributions.

Thank you @mrubens and @daniel-lxs for the thoughtful handling and explanation!

I appreciate that the more comprehensive solution was ultimately adopted through #4212. I completely understand the complexities of project maintenance and the challenge of balancing automated tools with human review.

Regarding the Issue-First approach, that's a good direction. For future security updates like this, I'll consider opening an issue first to discuss scope and approach. I initially submitted this directly due to the security nature, similar to how automated tools like Renovate typically handle security patches, but I'm happy to adapt to the project's preferred workflow.

Thanks again for your time and patience. I'm happy to continue contributing to this fantastic project and will work to better align with the project goals going forward.