chore(deps): update dependency npminstall to v8

[renovate]

This PR contains the following updates:

Package	Change	Age	Confidence
npminstall	^7.12.0 → ^8.0.0

---

Release Notes

cnpm/npminstall (npminstall)

v8.0.1

Compare Source

• fix: use urllib v4 (#​482) (fef57f7), closes #​482 hi#level
• chore: Configure Renovate (#​483) (6d126a6), closes #​483
• chore(deps): update actions/checkout action to v6 (#​485) (0bb0fd3), closes #​485
• chore(deps): update microsoft/setup-msbuild action to v1.3.3 (#​484) (284b919), closes #​484

v8.0.0

Compare Source

• feat: enable auto release (#​481) (8fed5a6), closes #​481 hi#level
• feat!: npminstall v8 (#​479) (d213d25), closes #​479 hi#level

BREAKING CHANGE

• Node.js >= 20

---

Configuration

📅 Schedule: Branch creation - At any time (no schedule defined), Automerge - At any time (no schedule defined).

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

[renovate]

⚠️ Artifact update problem

Renovate failed to update an artifact related to this branch. You probably do not want to merge this PR as-is.

♻ Renovate will retry this branch, including artifacts, only when one of the following happens:

• any of the package files in this branch needs updating, or
• the branch becomes conflicted, or
• you click the rebase/retry checkbox if found above, or
• you rename this PR's title to start with "rebase!" to trigger it manually

The artifact failure details are included below:

File name: pnpm-lock.yaml

Scope: all 73 workspace projects
.                                        |  WARN  There are cyclic workspace dependencies: /tmp/renovate/repos/github/eggjs/egg/packages/cluster, /tmp/renovate/repos/github/eggjs/egg/plugins/mock, /tmp/renovate/repos/github/eggjs/egg/packages/egg; /tmp/renovate/repos/github/eggjs/egg/tegg/core/runtime, /tmp/renovate/repos/github/eggjs/egg/tegg/core/test-util
Progress: resolved 1, reused 0, downloaded 0, added 0
/tmp/renovate/repos/github/eggjs/egg/tools/egg-bin:
 ERR_PNPM_NO_MATURE_MATCHING_VERSION  Version 8.0.1 (released 21 hours ago) of npminstall does not meet the minimumReleaseAge constraint

This error happened while installing a direct dependency of /tmp/renovate/repos/github/eggjs/egg/tools/egg-bin

The latest release of npminstall is "8.0.1". Published at 1/20/2026 1:58:17 PM

Other releases are:
  * latest-2: 2.31.0 published at 5/24/2019
  * latest-1: 1.16.0 published at 5/24/2019
  * latest-4: 4.11.0 published at 3/26/2021
  * latest-3: 3.28.1 published at 11/28/2021
  * latest-5: 5.8.1 published at 4/21/2022
  * beta: 7.7.0 published at 5/2/2023
  * latest-6: 6.8.0 published at 12/18/2023

If you need the full list of all 270 published versions run "$ pnpm view npminstall versions".

If you want to install the matched version ignoring the time it was published, you can add the package name to the minimumReleaseAgeExclude setting. Read more about it: https://pnpm.io/settings#minimumreleaseageexclude
Progress: resolved 2, reused 0, downloaded 0, added 0

[coderabbitai]

Important

Review skipped

Bot user detected.

To trigger a single review, invoke the @coderabbitai review command.

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

---

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

[socket-security]

Warning

Review the following alerts detected in dependencies.

According to your organization's Security Policy, it is recommended to resolve "Warn" alerts. Learn more about Socket for GitHub.

Action	Severity	Alert  (click "▶" to expand/collapse)
Warn		Obfuscated code: npm safer-buffer is 94.0% likely obfuscated Confidence: 0.94 Location: Package overview From: ? → npm/safer-buffer@2.1.2 ℹ Read more on: This package | This alert | What is obfuscated code? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev. Suggestion: Packages should not obfuscate their code. Consider not using packages with obfuscated code. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/safer-buffer@2.1.2. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

View full report

[cloudflare-workers-and-pages]

Deploying egg with    Cloudflare Pages

Latest commit:	ccd5646
Status:	🚫  Build failed.

View logs

[cloudflare-workers-and-pages]

Deploying egg-v3 with    Cloudflare Pages

Latest commit:	ccd5646
Status:	🚫  Build failed.

View logs