chore(deps): dependencies 2026-05-15

.agents/skills/renovate/SKILL.md

@@ -56,7 +56,31 @@ For each PR:
 
 **Step 4.1** — Read the PR body: `gh pr view <number> --json body -q '.body'`
 
-**Step 4.2 — Breaking change detection gate.** Run ALL three checks below on the PR body. If **ANY** check triggers, the PR has breaking changes.
+**Step 4.2 — Minimum release age gate (3 days).**
+
+Check the **actual publish date** of the new package version on its registry. Do NOT use the PR creation date — Renovate may open PRs days or weeks after the release.
+
+Parse the package name and new version from the PR title or body table, then query the appropriate registry:
+
+| Datasource | API |
+| --- | --- |
+| npm | `curl -s https://registry.npmjs.org/<package> \| jq '.time["<version>"]'` |
+| PyPI | `curl -s https://pypi.org/pypi/<package>/<version>/json \| jq '.urls[0].upload_time_iso_8601'` |
+| Maven (Java/Kotlin/Scala) | `curl -s 'https://search.maven.org/solrsearch/select?q=g:<group>+AND+a:<artifact>+AND+v:<version>&rows=1&wt=json' \| jq '.response.docs[0].timestamp'` (timestamp is epoch ms) |
+| NuGet (C#) | `curl -s https://api.nuget.org/v3/registration5-gz-semver2/<package-lowercase>/index.json \| jq` then find the matching version's `catalogEntry.published` |
+| RubyGems | `curl -s https://rubygems.org/api/v2/rubygems/<gem>/versions/<version>.json \| jq '.created_at'` |
+| pub.dev (Dart) | `curl -s https://pub.dev/api/packages/<package> \| jq '.versions[] \| select(.version=="<ver>") \| .published'` |
+| Go proxy | `curl -s https://proxy.golang.org/<module>/@v/<version>.info \| jq '.Time'` |
+| GitHub releases/tags | `gh api repos/<owner>/<repo>/releases/tags/<tag> --jq '.published_at'` |
+| Docker images | Use `gh api` or `curl` against the container registry; varies by registry |
+
+For language runtime version updates (dart, golang, ruby, python, php, swift) managed via `custom.regex` with `github-tags` or `*-version` datasources, use the GitHub releases API with the repository from `renovate.json` (e.g., `php/php-src`, `swiftlang/swift`).
+
+If the version was published less than 3 days ago → **TOO RECENT**. Do not merge. Skip all remaining checks for this PR and add it to the "🕐 Too recent (awaiting 3-day minimum age)" report list with the actual publish date and eligible date.
+
+If the publish date cannot be determined (API unavailable, non-standard registry) → skip this check and proceed.
+
+**Step 4.3 — Breaking change detection gate.** Run ALL three checks below on the PR body. If **ANY** check triggers, the PR has breaking changes.
 
 - **Check A — Package table (major version bump):** Renovate PRs include a package table. Two formats exist:
   - Format A: `| Package | Type | Update | Change |` — the "Update" column contains `major`, `minor`, or `patch`
@@ -76,15 +100,17 @@ For each PR:
   - `| major |` text
   - If **ANY** signal is found → **BREAKING**.
 
-**Step 4.3 — Template-vs-generated file detection.**
+**Step 4.4 — Template-vs-generated file detection.**
 
 Get the list of changed files: `gh pr view <number> --json files -q '.files[].path'`
 
 Check if ANY changed file is under `clients/` AND is NOT one of these lock files:
 
 - `yarn.lock`, `poetry.lock`, `Gemfile.lock`, `go.sum`, `composer.lock`, `pubspec.lock`, `Package.resolved`
 
-If such files exist AND no files under `templates/` were changed in the same PR → **TEMPLATE ISSUE**.
+Before flagging, verify the file is actually generated by checking `config/generation.config.mjs`. Files matching patterns prefixed with `!` are **hand-written** and managed directly — these are NOT template issues. For example, `!clients/**/.github/workflows/release.yml` means all `release.yml` files under `clients/` are hand-written. Renovate may legitimately update hand-written files via its custom regex managers (see `renovate.json`).
+
+If generated (non-`!`) client files were changed AND no files under `templates/` were changed in the same PR → **TEMPLATE ISSUE**.
 
 When a template issue is detected, map each affected generated file to its likely template source:
 
@@ -100,7 +126,7 @@ When a template issue is detected, map each affected generated file to its likel
 
 > **Symlink awareness:** Many per-language template files (e.g. `templates/{lang}/issue.yml`) are symlinks to a shared source (e.g. `templates/issue.yml`). When reporting a template issue, resolve symlinks with `ls -la` and report the single source file — not all 11 copies. The `.github/workflows/issue.yml` files across all client repos are generated from `templates/issue.yml`; the per-language copies in `templates/{lang}/issue.yml` are all symlinks to `../issue.yml`.
 
-**Step 4.4 — Scala version fix.**
+**Step 4.5 — Scala version fix.**
 
 If the PR updates the Scala version in `clients/algoliasearch-client-scala/build.sbt`, the Scala client supports both v2 and v3 via `crossScalaVersions`. The `scalaVersion` property MUST stay on the 2.x line (it is the default/primary version). Renovate may incorrectly bump `scalaVersion` to a 3.x version.
 
@@ -116,25 +142,26 @@ If the PR changes the `scalaVersion` line:
 
 If the PR only updates the `crossScalaVersions` 3.x entry or the 2.x `scalaVersion`, no fix is needed — proceed normally.
 
-**Step 4.5 — Known blocked updates.**
+**Step 4.6 — Known blocked updates.**
 
 Close (do not merge) PRs that update these packages, and add them to the "Abandoned" report list with a note:
 
 - **Dart `json_serializable`**: Updating `json_serializable` requires updating `json_annotation`, which in turn requires bumping the minimum Dart SDK version. This is a breaking change for customers on older Dart versions. Close the PR.
 - **`@redocly/cli` beyond v2.27.0**: v2.27.1 introduces breaking changes (renaming components) that break our spec bundling. Pinned at v2.27.0 for now. Close the PR.
 
-**Step 4.6 — Dart caret versioning.**
+**Step 4.7 — Dart caret versioning.**
 
 Dart dependencies in `clients/algoliasearch-client-dart/packages/client_core/pubspec.yaml` MUST use caret (`^`) versioning (e.g., `archive: ^4.0.9`, not `archive: 4.0.9`). Renovate may strip the caret when bumping versions. If a Dart PR changes a dependency version and the caret is missing, checkout the branch, restore the `^` prefix, commit, and push before merging.
 
-**Step 4.7 — Decision:**
+**Step 4.8 — Decision:**
 
+- If **too recent** (step 4.2) → do **NOT** merge. Add to "🕐 Too recent (awaiting 3-day minimum age)" list.
 - If **ANY** breaking change check (A, B, or C) triggered → do **NOT** merge. Add to "⚠️ Breaking changes (needs human review)" list with a note of what was found (e.g., "major version bump", "Release Notes contain `### Breaking Changes`", "Release Notes contain `💥`").
 - If **template issue** detected → do **NOT** merge. Add to "🔧 Template fix needed (needs human review)" list with the generated→template file mapping.
 - If a PR triggers **both** → add to both lists, do **NOT** merge.
 - If **NEITHER** triggered → merge: `gh pr merge <number> --squash --delete-branch`
 
-**Step 4.8** — After each merge, re-check remaining PRs for new conflicts.
+**Step 4.9** — After each merge, re-check remaining PRs for new conflicts.
 
 > ⚠️ A minor or patch version bump does NOT mean there are no breaking changes. Always check the Release Notes content inside `<details>` blocks.
 
@@ -298,6 +325,10 @@ If the parent PR body is empty, write the report as the entire body. Omit any se
 
 - #<number> — <title>
 
+### 🕐 Too recent (awaiting 3-day minimum age)
+
+- #<number> — <title> — Created: <date>, eligible: <date>
+
 ### ⚠️ Breaking changes (needs human review)
 
 - #<number> — <title> — <what was found>

.github/actions/setup/action.yml

@@ -193,7 +193,7 @@ runs:
       if: ${{ inputs.language == 'swift' }}
       id: swiftformat-version
       shell: bash
-      run: echo "SWIFTFORMAT_VERSION=0.58.7" >> $GITHUB_OUTPUT
+      run: echo "SWIFTFORMAT_VERSION=0.61.1" >> $GITHUB_OUTPUT
 
     - name: Checkout swiftformat
       if: ${{ inputs.language == 'swift' }}

.github/workflows/check.yml

@@ -711,7 +711,7 @@ jobs:
           GITHUB_TOKEN: ${{ secrets.ALGOLIA_BOT_TOKEN }}
 
       - name: notify failures
-        uses: slackapi/slack-github-action@v3.0.2
+        uses: slackapi/slack-github-action@v3.0.3
         if: ${{ steps.waitForAllReleases.outputs.FAILED_RELEASES != '' }}
         with:
           method: chat.postMessage

.github/workflows/qc-events-cron.yml

@@ -38,7 +38,7 @@ jobs:
         run: yarn runScript index-maintenance/query-categorization/generateEvents.ts
 
       - name: notify slack on failure
-        uses: slackapi/slack-github-action@v3.0.1
+        uses: slackapi/slack-github-action@v3.0.3
         if: failure()
         with:
           method: chat.postMessage

.yarnrc.yml

@@ -4,6 +4,8 @@ enableGlobalCache: false
 
 nodeLinker: node-modules
 
+npmMinimalAgeGate: "3d"
+
 yarnPath: .yarn/releases/yarn-4.10.3.cjs
 
 # esbuild use native binaries, we need both to work locally and on the CI.

clients/algoliasearch-client-csharp/.config/dotnet-tools.json

@@ -3,7 +3,7 @@
   "isRoot": true,
   "tools": {
     "csharpier": {
-      "version": "1.2.1",
+      "version": "1.2.6",
       "commands": [
         "csharpier"
       ]

clients/algoliasearch-client-java/build.gradle

@@ -3,6 +3,6 @@ buildscript {
     mavenCentral()
   }
   dependencies {
-    classpath 'com.vanniktech:gradle-maven-publish-plugin:0.35.0'
+    classpath 'com.vanniktech:gradle-maven-publish-plugin:0.36.0'
   }
 }

clients/algoliasearch-client-java/gradle/wrapper/gradle-wrapper.properties

@@ -1,6 +1,6 @@
 distributionBase=GRADLE_USER_HOME
 distributionPath=wrapper/dists
-distributionUrl=https\://services.gradle.org/distributions/gradle-8.14.4-bin.zip
+distributionUrl=https\://services.gradle.org/distributions/gradle-8.14.5-bin.zip
 networkTimeout=10000
 validateDistributionUrl=true
 zipStoreBase=GRADLE_USER_HOME

clients/algoliasearch-client-javascript/.yarnrc.yml

@@ -4,4 +4,6 @@ enableGlobalCache: false
 
 nodeLinker: node-modules
 
+npmMinimalAgeGate: "3d"
+
 yarnPath: .yarn/releases/yarn-4.10.3.cjs

clients/algoliasearch-client-javascript/package.json

@@ -20,7 +20,7 @@
     "bundlewatch": "0.4.2",
     "execa": "9.6.1",
     "lerna": "9.0.7",
-    "rollup": "4.59.0",
+    "rollup": "4.60.3",
     "typescript": "5.9.3"
   },
   "bundlewatch": {
@@ -80,7 +80,7 @@
     ]
   },
   "resolutions": {
-    "axios": "^1.15.0",
+    "axios": "^1.16.0",
     "follow-redirects": "^1.16.0"
   },
   "engines": {

clients/algoliasearch-client-javascript/packages/abtesting/package.json

@@ -62,8 +62,8 @@
   "devDependencies": {
     "@arethetypeswrong/cli": "0.18.2",
     "@types/node": "25.1.0",
-    "publint": "0.3.18",
-    "rollup": "4.59.0",
+    "publint": "0.3.20",
+    "rollup": "4.60.3",
     "tsup": "8.5.1",
     "typescript": "5.9.3"
   },

clients/algoliasearch-client-javascript/packages/advanced-personalization/package.json

@@ -62,8 +62,8 @@
   "devDependencies": {
     "@arethetypeswrong/cli": "0.18.2",
     "@types/node": "25.1.0",
-    "publint": "0.3.18",
-    "rollup": "4.59.0",
+    "publint": "0.3.20",
+    "rollup": "4.60.3",
     "tsup": "8.5.1",
     "typescript": "5.9.3"
   },

clients/algoliasearch-client-javascript/packages/algoliasearch/package.json

@@ -106,7 +106,7 @@
     "@cloudflare/workers-types": "4.20251115.0",
     "@types/node": "25.1.0",
     "jsdom": "29.0.2",
-    "publint": "0.3.18",
+    "publint": "0.3.20",
     "rollup": "4.59.0",
     "tsup": "8.5.1",
     "typescript": "5.9.3",

clients/algoliasearch-client-javascript/packages/client-abtesting/package.json

@@ -62,7 +62,7 @@
   "devDependencies": {
     "@arethetypeswrong/cli": "0.18.2",
     "@types/node": "25.1.0",
-    "publint": "0.3.18",
+    "publint": "0.3.20",
     "rollup": "4.59.0",
     "tsup": "8.5.1",
     "typescript": "5.9.3"

clients/algoliasearch-client-javascript/packages/client-analytics/package.json

@@ -62,7 +62,7 @@
   "devDependencies": {
     "@arethetypeswrong/cli": "0.18.2",
     "@types/node": "25.1.0",
-    "publint": "0.3.18",
+    "publint": "0.3.20",
     "rollup": "4.59.0",
     "tsup": "8.5.1",
     "typescript": "5.9.3"

clients/algoliasearch-client-javascript/packages/client-common/package.json

@@ -37,12 +37,12 @@
   "devDependencies": {
     "@arethetypeswrong/cli": "0.18.2",
     "@types/node": "24.12.2",
-    "jsdom": "29.0.2",
-    "publint": "0.3.18",
+    "jsdom": "29.1.1",
+    "publint": "0.3.20",
     "ts-node": "10.9.2",
     "tsup": "8.5.1",
     "typescript": "5.9.3",
-    "vitest": "4.1.5"
+    "vitest": "4.1.6"
   },
   "engines": {
     "node": ">= 14.0.0"

clients/algoliasearch-client-javascript/packages/client-insights/package.json

@@ -62,7 +62,7 @@
   "devDependencies": {
     "@arethetypeswrong/cli": "0.18.2",
     "@types/node": "25.1.0",
-    "publint": "0.3.18",
+    "publint": "0.3.20",
     "rollup": "4.59.0",
     "tsup": "8.5.1",
     "typescript": "5.9.3"

clients/algoliasearch-client-javascript/packages/client-personalization/package.json

@@ -62,7 +62,7 @@
   "devDependencies": {
     "@arethetypeswrong/cli": "0.18.2",
     "@types/node": "25.1.0",
-    "publint": "0.3.18",
+    "publint": "0.3.20",
     "rollup": "4.59.0",
     "tsup": "8.5.1",
     "typescript": "5.9.3"

clients/algoliasearch-client-javascript/packages/client-query-suggestions/package.json

@@ -62,7 +62,7 @@
   "devDependencies": {
     "@arethetypeswrong/cli": "0.18.2",
     "@types/node": "25.1.0",
-    "publint": "0.3.18",
+    "publint": "0.3.20",
     "rollup": "4.59.0",
     "tsup": "8.5.1",
     "typescript": "5.9.3"

clients/algoliasearch-client-javascript/packages/client-search/package.json

@@ -62,7 +62,7 @@
   "devDependencies": {
     "@arethetypeswrong/cli": "0.18.2",
     "@types/node": "25.1.0",
-    "publint": "0.3.18",
+    "publint": "0.3.20",
     "rollup": "4.59.0",
     "tsup": "8.5.1",
     "typescript": "5.9.3"

clients/algoliasearch-client-javascript/packages/composition/package.json

@@ -62,8 +62,8 @@
   "devDependencies": {
     "@arethetypeswrong/cli": "0.18.2",
     "@types/node": "25.1.0",
-    "publint": "0.3.18",
-    "rollup": "4.59.0",
+    "publint": "0.3.20",
+    "rollup": "4.60.3",
     "tsup": "8.5.1",
     "typescript": "5.9.3"
   },

clients/algoliasearch-client-javascript/packages/ingestion/package.json

@@ -62,7 +62,7 @@
   "devDependencies": {
     "@arethetypeswrong/cli": "0.18.2",
     "@types/node": "25.1.0",
-    "publint": "0.3.18",
+    "publint": "0.3.20",
     "rollup": "4.59.0",
     "tsup": "8.5.1",
     "typescript": "5.9.3"

clients/algoliasearch-client-javascript/packages/logger-console/package.json

@@ -37,12 +37,12 @@
   "devDependencies": {
     "@arethetypeswrong/cli": "0.18.2",
     "@types/node": "24.12.2",
-    "jsdom": "29.0.2",
-    "publint": "0.3.18",
+    "jsdom": "29.1.1",
+    "publint": "0.3.20",
     "ts-node": "10.9.2",
     "tsup": "8.5.1",
     "typescript": "5.9.3",
-    "vitest": "4.1.5"
+    "vitest": "4.1.6"
   },
   "dependencies": {
     "@algolia/client-common": "5.52.1"

clients/algoliasearch-client-javascript/packages/monitoring/package.json

@@ -62,7 +62,7 @@
   "devDependencies": {
     "@arethetypeswrong/cli": "0.18.2",
     "@types/node": "25.1.0",
-    "publint": "0.3.18",
+    "publint": "0.3.20",
     "rollup": "4.59.0",
     "tsup": "8.5.1",
     "typescript": "5.9.3"

clients/algoliasearch-client-javascript/packages/recommend/package.json

@@ -62,7 +62,7 @@
   "devDependencies": {
     "@arethetypeswrong/cli": "0.18.2",
     "@types/node": "25.1.0",
-    "publint": "0.3.18",
+    "publint": "0.3.20",
     "rollup": "4.59.0",
     "tsup": "8.5.1",
     "typescript": "5.9.3"

clients/algoliasearch-client-javascript/packages/requester-browser-xhr/package.json

@@ -37,11 +37,11 @@
   "devDependencies": {
     "@arethetypeswrong/cli": "0.18.2",
     "@types/node": "24.12.2",
-    "jsdom": "29.0.2",
-    "publint": "0.3.18",
+    "jsdom": "29.1.1",
+    "publint": "0.3.20",
     "tsup": "8.5.1",
     "typescript": "5.9.3",
-    "vitest": "4.1.5",
+    "vitest": "4.1.6",
     "xhr-mock": "2.5.1"
   },
   "engines": {

clients/algoliasearch-client-javascript/packages/requester-fetch/package.json

@@ -54,11 +54,11 @@
     "@arethetypeswrong/cli": "0.18.2",
     "@types/node": "24.12.2",
     "cross-fetch": "4.1.0",
-    "nock": "14.0.14",
-    "publint": "0.3.18",
+    "nock": "14.0.15",
+    "publint": "0.3.20",
     "tsup": "8.5.1",
     "typescript": "5.9.3",
-    "vitest": "4.1.5"
+    "vitest": "4.1.6"
   },
   "engines": {
     "node": ">= 14.0.0"

clients/algoliasearch-client-javascript/packages/requester-node-http/package.json

@@ -40,11 +40,11 @@
   "devDependencies": {
     "@arethetypeswrong/cli": "0.18.2",
     "@types/node": "24.12.2",
-    "nock": "14.0.14",
-    "publint": "0.3.18",
+    "nock": "14.0.15",
+    "publint": "0.3.20",
     "tsup": "8.5.1",
     "typescript": "5.9.3",
-    "vitest": "4.1.5"
+    "vitest": "4.1.6"
   },
   "engines": {
     "node": ">= 14.0.0"

clients/algoliasearch-client-javascript/packages/requester-testing/package.json

@@ -51,7 +51,7 @@
   "devDependencies": {
     "@arethetypeswrong/cli": "0.18.2",
     "@types/node": "24.12.2",
-    "publint": "0.3.18",
+    "publint": "0.3.20",
     "tsup": "8.5.1",
     "typescript": "5.9.3"
   },