chore(deps): update hermit tools

[renovate]

This PR contains the following updates:

Package	Update	Change
node	minor	24.12.0 → 24.13.0
pnpm	minor	10.27.0 → 10.28.2
task	minor	3.46.4 → 3.48.0

---

Release Notes

nodejs/node (node)

v24.13.0: 2026-01-13, Version 24.13.0 'Krypton' (LTS), @​marco-ippolito

Compare Source

This is a security release.

Notable Changes

lib:

• (CVE-2025-59465) add TLSSocket default error handler (RafaelGSS) nodejs-private/node-private#797
• (CVE-2025-55132) disable futimes when permission model is enabled (RafaelGSS) nodejs-private/node-private#748
  lib,permission:
• (CVE-2025-55130) require full read and write to symlink APIs (RafaelGSS) nodejs-private/node-private#760
  src:
• (CVE-2025-59466) rethrow stack overflow exceptions in async_hooks (Matteo Collina) nodejs-private/node-private#773
  src,lib:
• (CVE-2025-55131) refactor unsafe buffer creation to remove zero-fill toggle (Сковорода Никита Андреевич) nodejs-private/node-private#759
  tls:
• (CVE-2026-21637) route callback exceptions through error handlers (Matteo Collina) nodejs-private/node-private#796

Commits

• [2092785d01] - deps: update c-ares to v1.34.6 (Node.js GitHub Bot) #​60997
• [3e58b7f2af] - deps: update undici to 7.18.2 (Node.js GitHub Bot) #​61283
• [4ba536a5a6] - (CVE-2025-59465) lib: add TLSSocket default error handler (RafaelGSS) nodejs-private/node-private#797
• [89adaa21fd] - (CVE-2025-55132) lib: disable futimes when permission model is enabled (RafaelGSS) nodejs-private/node-private#748
• [7302b4dae1] - (CVE-2025-55130) lib,permission: require full read and write to symlink APIs (RafaelGSS) nodejs-private/node-private#760
• [ac030753c4] - (CVE-2025-59466) src: rethrow stack overflow exceptions in async_hooks (Matteo Collina) nodejs-private/node-private#773
• [20075692fe] - (CVE-2025-55131) src,lib: refactor unsafe buffer creation to remove zero-fill toggle (Сковорода Никита Андреевич) nodejs-private/node-private#759
• [20591b0618] - (CVE-2026-21637) tls: route callback exceptions through error handlers (Matteo Collina) nodejs-private/node-private#796

pnpm/pnpm (pnpm)

v10.28.2: pnpm 10.28.2

Compare Source

Patch Changes

• Security fix: prevent path traversal in directories.bin field.

• When pnpm installs a file: or git: dependency, it now validates that symlinks point within the package directory. Symlinks to paths outside the package root are skipped to prevent local data from being leaked into node_modules.

  This fixes a security issue where a malicious package could create symlinks to sensitive files (e.g., /etc/passwd, ~/.ssh/id_rsa) and have their contents copied when the package is installed.

  Note: This only affects file: and git: dependencies. Registry packages (npm) have symlinks stripped during publish and are not affected.

• Fixed optional dependencies to request full metadata from the registry to get the libc field, which is required for proper platform compatibility checks #​9950.

Platinum Sponsors

Gold Sponsors

v10.28.1: pnpm 10.28.1

Compare Source

Patch Changes

• Fixed installation of config dependencies from private registries.

  Added support for object type in configDependencies when the tarball URL returned from package metadata differs from the computed URL #​10431.

• Fix path traversal vulnerability in binary fetcher ZIP extraction

  • Validate ZIP entry paths before extraction to prevent writing files outside target directory
  • Validate BinaryResolution.prefix (basename) to prevent directory escape via crafted prefix
  • Both attack vectors now throw ERR_PNPM_PATH_TRAVERSAL error

• Support plain http:// and https:// URLs ending with .git as git repository dependencies.

  Previously, URLs like https://gitea.example.org/user/repo.git#commit were not recognized as git repositories because they lacked the git+ prefix (e.g., git+https://). This caused issues when installing dependencies from self-hosted git servers like Gitea or Forgejo that don't provide tarball downloads.

  Changes:

  • The git resolver now runs before the tarball resolver, ensuring git URLs are handled by the correct resolver
  • The git resolver now recognizes plain http:// and https:// URLs ending in .git as git repositories
  • Removed the isRepository check from the tarball resolver since it's no longer needed with the new resolver order

  Fixes #​10468

• pnpm run -r and pnpm run --filter now fail with a non-zero exit code when no packages have the specified script. Previously, this only failed when all packages were selected. Use --if-present to suppress this error #​6844.

• Fixed a path traversal vulnerability in tarball extraction on Windows. The path normalization was only checking for ./ but not .\. Since backslashes are directory separators on Windows, malicious packages could use paths like foo\..\..\.npmrc to write files outside the package directory.

• When running "pnpm exec" from a subdirectory of a project, don't change the current working directory to the root of the project #​5759.

• Fixed a path traversal vulnerability in pnpm's bin linking. Bin names starting with @ bypassed validation, and after scope normalization, path traversal sequences like ../../ remained intact.

• Revert Try to avoid making network calls with preferOffline #​10334.

• Fix --save-peer to write valid semver ranges to peerDependencies for protocol-based installs (e.g. jsr:) by deriving from resolved versions when available and falling back to * if none is available #​10417.

• Do not exclude the root workspace project, when it is explicitly selected via a filter #​10465.

Platinum Sponsors

Gold Sponsors

v10.28.0: pnpm 10.28

Compare Source

Minor Changes

• Add support for a hook called beforePacking that can be used to customize the package.json contents at publish time #​3816.
• In some cases, a filtered install (i.e. pnpm install --filter ...) was slower than running pnpm install without any filter arguments. This performance regression is now fixed. Filtered installs should be as fast or faster than a full install #​10408.

Patch Changes

• Do not add a symlink to the project into the store's project registry if the store is in a subdirectory of the project #​10411.
• It should be possible to declare the requiredScripts setting in pnpm-workspace.yaml #​10261.

Platinum Sponsors

Gold Sponsors

go-task/task (task)

v3.48.0

• Fixed if: conditions when using to check dynamic variables. Also, skip
  variable prompt if task would be skipped by if: (#​2658, #​2660 by @​vmaerten).
• Fixed ROOT_TASKFILE variable pointing to directory instead of the actual
  Taskfile path when no explicit -t flag is provided (#​2635, #​1706 by
  @​trulede).
• Included Taskfiles with silent: true now properly propagate silence to their
  tasks, while still allowing individual tasks to override with silent: false
  (#​2640, #​1319 by @​trulede).
• Added TLS certificate options for Remote Taskfiles: use --cacert for
  self-signed certificates and --cert/--cert-key for mTLS authentication
  (#​2537, #​2242 by @​vmaerten).

v3.47.0

• Fixed remote git Taskfiles: cloning now works without explicit ref, and
  directory includes are properly resolved (#​2602 by @​vmaerten).
• For output: prefixed, print prefix: if set instead of task name (#​1566,
  #​2633 by @​trulede).
• Ensure no ANSI sequences are printed for --color=false (#​2560, #​2584 by
  @​trulede).
• Task aliases can now contain wildcards and will match accordingly (e.g., s-*
  as alias for start-*) (#​1900, #​2234 by @​vmaerten).
• Added conditional execution with the if field: skip tasks, commands, or task
  calls based on shell exit codes or template expressions like
  {{ eq .ENV "prod" }} (#​2564, #​608 by @​vmaerten).
• Task can now interactively prompt for missing required variables when running
  in a TTY, with support for enum selection menus. Enable with --interactive
  flag or interactive: true in .taskrc.yml (#​2579, #​2079 by @​vmaerten).

---

Configuration

📅 Schedule: Branch creation - "after 10pm every weekday,before 6am every weekday,every weekend" (UTC), Automerge - At any time (no schedule defined).

🚦 Automerge: Enabled.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

[renovate]

Branch automerge failure

This PR was configured for branch automerge. However, this is not possible, so it has been raised as a PR instead.