chore(deps): update moon to v1.41.7

[renovate]

This PR contains the following updates:

Package	Change	Age	Confidence	Type	Update
@moonrepo/cli (source)	1.26.7 -> 1.41.7			devDependencies	minor
moonrepo/moon	1.26.7 -> 1.41.7				minor

---

Release Notes

moonrepo/moon (@​moonrepo/cli)

v1.41.7

Compare Source

🚀 Updates

• Added --upstream (dependencies) and --downstream (dependents) options to moon ci to control
  the graph depth for affected tracking.

🐞 Fixes

• Fixed an issue where a task mutex would not be respected, and tasks would still run in parallel.
• Fixed an issue where toolchain dependency install/dedupe would consistently run, because the
  underlying lockfile timestamp kept changing.

v1.41.6

Compare Source

🐞 Fixes

• Fixed an affected tracking issue where dependencies of already marked projects/tasks were not
  being traversed correctly.
• Fixed an issue where unstable toolchains would be installed even when
  MOON_TOOLCHAIN_FORCE_GLOBALS has been set.

v1.41.5

Compare Source

🚀 Updates

• Added an optional parameter to task glob outputs.
• WASM API
  • Added ParseManifestInput.root and ParseLockInput.root fields.

🧰 Toolchains

• JavaScript
  • Added support for Bun v1.3 package.json catalogs.
  • Updated parse_manifest to resolve versions from applicable catalogs.

🐞 Fixes

• Fixed an issue where interactive tasks would constantly print the "running for" message.
• Fixed an issue where touched files that were not staged would not be included in the
  affected/hashing calculation in CI.

v1.41.4

Compare Source

🐞 Fixes

• Fixed another issue where deleting a tool from proto's store would not trigger a re-install within
  moon.
• Fixed another issue where configuration extends did not support query strings in URLs.
• Fixed an issue where project input types were not being included in the task hash, resulting in
  re-runs not working.

v1.41.3

Compare Source

🐞 Fixes

• Fixed an issue where deleting a tool from proto's store would not trigger a re-install within
  moon.
• Fixed an issue where configuration extends did not support query strings in URLs.
• Fixed an issue where stale VCS hooks would not be removed.

⚙️ Internal

• Updated proto to v0.53.2 (from 0.53.0).

v1.41.2

Compare Source

🐞 Fixes

• Fixed a regression that didn't allow identifiers to start with a non-alphanumeric character.
• Fixed a parsing error when loading the projectsBuildData.json cache state.

🧰 Toolchains

• JavaScript
  • Fixed some version parsing issues that contain ".x" and other variants.

v1.41.1

Compare Source

🚀 Updates

• Updated remote service to disable itself if it cannot connect to the host, instead of failing the
  entire pipeline.

🐞 Fixes

• Fixed an issue where locating projects with **/moon.yml and a root-level moon.yml existed,
  would trigger an invalid identifier error.

v1.41.0

Compare Source

💥 Breaking

• WASM API
  • Removed ParseLockOutput.packages field.

🚀 Updates

• Added a new
  Deno toolchain implementation,
  powered entirely by our new WASM plugin system. It can be enabled with the unstable_deno
  identifier.
  • Supports tiers 1, 2, and 3!
  • Parses deno.json and deno.jsonc manifest files.
  • Parses deno.lock lock files.
  • Will install dependencies with deno install.
  • Pairs with the unstable_javascript toolchain.
  • And much more!
• Added a new task input type that allows you to depend on changes to a project's files directly,
  instead of depending on a project's task.
  • Added URI support: project://<id>
  • Added object support: project: '<id>'
  • Can filter with globs or by file group.
  • Can reference all project dependencies with ^.
• Added a new task input type for referencing file groups within the owning project.
  • Added URI support: group://<name>
  • Added object support: group: '<name>'
  • This is similar to the @files, @globs, etc, token functions.
• Added URI and object support for task output types, similar to inputs.
  • file://<path> and file: '<path>'
  • glob://<pattern> and glob: '<pattern>'
  • Added optional support to file outputs.
• Added new values to the runInCI task option:
  • only - Only run the task in CI, and not locally, when affected.
  • skip - Skip running in CI but run locally and allow task relationships to be valid.

🧰 Toolchains

• JavaScript
  • Added Deno support. Can customize packageManager with deno.
  • Added workspace member caching to reduce fs operations.
  • Updated install_dependencies and setup_environment to take project toolchain configuration
    into account.

🧩 Plugins

• WASM API
  • Added ManifestDependencyConfig.reference field.
  • Added SyncProjectInput.toolchain_workspace_config field.

⚙️ Internal

• Updated proto to v0.53.0 (from 0.52.3).
• Updated Rust to v1.90.0.
• Updated dependencies.

v1.40.5

Compare Source

🧰 Toolchains

• Go
  • Fixed go.mod parsing failures when tool is a list.
• Python
  • Potential fix for Windows path escaping issues when running uv venv.

v1.40.4

Compare Source

🐞 Fixes

• Fixed an issue where proto wouldn't be installed for legacy toolchains in certain conditions.

⚙️ Internal

• Updated dependencies.

v1.40.3

Compare Source

🚀 Updates

• When running a task, we now set MOON_TASK_RETRY_ATTEMPT and MOON_TASK_RETRY_TOTAL environment
  variables, which can be accessed in child processes.
• Updated VCS hook scripts to set environment variables for each argument passed to the hook, in the
  format of ARG<n> (1-index based).

🐞 Fixes

• Fixed an issue where VCS hooks would not be created if they were removed but the cache still
  existed.
• Fixed an issue where commands executed by a toolchain would sometimes not inherit the PATH
  correctly.

v1.40.2

Compare Source

🧰 Toolchains

• JavaScript
  • Fixed some pnpm-lock.yaml parsing issues when using pnpm as a package manager.

⚙️ Internal

• Updated dependencies.

v1.40.1

Compare Source

🐞 Fixes

• Fixed an issue where a task would try to execute with proto, but proto hasn't been fully installed
  yet.
• Fixed an issue where task PATHs may not always be injected correctly.

🧰 Toolchains

• JavaScript
  • Fixed some package.json dependency version parsing issues.

⚙️ Internal

• Updated dependencies.

v1.40.0

Compare Source

💥 Breaking

• The legacy toolchains (bun, node, python, etc) will no longer automatically enable if there's a
  version defined in .prototools, as there's no way to differentiate between the legacy and modern
  toolchains.
• Updated moon query touched-files to default to comparing against remote branches when in CI, and
  local when not in CI. This aligns with the other moon query commands.
  • This can be overridden with the --local and --remote flags.

🚀 Updates

• Added new JavaScript ecosystem toolchain WASM plugins. This was a large feature that required
  extensive work, as the JavaScript ecosystem is quite unique. The following plugins are being
  introduced:
  • unstable_javascript
    • A new JavaScript specific plugin that is a superset of all JavaScript runtimes (Bun & Node,
      with Deno coming soon).
    • Implements tier 1 and 2 features, and is now in charge of defining the package manager,
      installing dependencies, extending the project graph (aliases and tasks), parsing
      lockfiles/manifests, and much more.
    • Supports multiple lockfiles for each package manager.
  • unstable_bun and unstable_node
    • The JavaScript runtimes only implement tier 1 and 3 features, and only exist for installing
      the tool into the proto toolchain. Most functionality is now in the unstable_javascript
      plugin.
    • Supports settings for Bun/Node execution.
  • unstable_npm, unstable_pnpm, and unstable_yarn
    • The JavaScript package managers only implement tier 1 and 3 features, and only exist for
      installing the tool into the proto toolchain. Most functionality is now in the
      unstable_javascript plugin.
    • Supports settings for package installation.
    • npm now supports npm-shrinkwrap.json.
    • Is no longer configured within node, and is now configured at the top-level within
      .moon/toolchain.yml.
• Added new values to the task cache option, alongside the existing boolean.
  • local to only use the local cache.
  • remote to only use the remote cache.
• Added a new unstable_remote.cache.localReadOnly setting, which turns local development caching
  into a read-only mode (only downloads, doesn't upload).
• Updated task commands (child processes) to utilize toolchain executables directly, instead of
  relying entirely on proto shims. It achieves this by locating the executables, and prepending
  their directory onto PATH.
• Updated moon task command to include all PATHs that are injected when running the task.
• Deprecated the moon run --profile option.
  • This option was only used by Node.js, and is now a configuration setting for the unstable_node
    toolchain.
• When running a task, we now set a MOON_TASK_HASH environment variable for the current hash,
  which can be read from child processes.
• Published the moon VS Code extension to Open VSX:
  https://open-vsx.org/extension/moonrepo/moon-console

🐞 Fixes

• Fixed an issue where proto shim/bin directories were always included in task command PATH, even
  when proto is not required.
• Fixed an issue with task options affectedFiles and runFromWorkspaceRoot generating invalid
  paths.
• Fixed moon docker file generating invalid Dockerfiles after the recent proto install changes.
• Fixed an issue where xz/liblzma was dynamically linked, instead of statically.

🧰 Toolchains

• Go
  • Fixed an issue with bins when installing multiple packages from different modules in parallel.
• Python
  • When running uv venv, we now include the --no-managed-python flag when the python.version
    setting is defined. This should ensure that moon/proto's Python managed version is used.
  • When running uv sync, we now include the --no-managed-python flag unless the
    python.uv.syncArgs setting is defined.
• Rust
  • Updated manifest parsing to extract path and git values from dependencies.
• TypeScript
  • When includeSharedTypes and syncProjectReferences are both enabled, and the shared types
    folder contains a tsconfig.json, it will also be synced as a project reference.

🧩 Plugins

• WASM API
  • Added a new define_requirements plugin API for tier 2.
  • Added DefineRequirementsInput and DefineRequirementsOutput types.
  • Added MoonContext.get_project_root and get_project_root_from_source methods.
  • Added ExtendProjectGraphInput.toolchain_config field.
  • Added ExtendTaskCommandInput.toolchain_config and project fields.
  • Added ExtendTaskScriptInput.toolchain_config and project fields.
  • Added load_toolchain_config and load_project_toolchain_config functions.
  • Added load_toolchain_config_by_id host function.

⚙️ Internal

• Updated proto to v0.52.2 (from 0.51.4).
• Updated Rust to v1.89.0.

v1.39.4

Compare Source

🐞 Fixes

• Fixed an issue with moon setup failing when proto is not available.
• Fixed task input inferrence to not include the $HOME, $USER, and $PWD environment variables.
• Fixed some arg/shell quoting issues.

v1.39.3

Compare Source

🐞 Fixes

• Fixed a regression where an unknown/unconfigured layer would trigger a violation error.

v1.39.2

Compare Source

🐞 Fixes

• Fixed a glob input parsing issue when the pattern contained a ? and wasn't in URI format.
• Fixed JSON schemas not including property aliases (project type for layer, etc).

⚙️ Internal

• Updated dependencies.

v1.39.1

Compare Source

🐞 Fixes

• Fixed a path error for @moonrepo/cli package.

v1.39.0

Compare Source

🚀 Updates

• The automatic proto install has moved into a new SetupProto action, which is now part of the
  action graph, and does not run on every command. It's also a bit smarter and will only install
  when a toolchain requires it.
• Added support for new task input formats based on the RFC:
  #​1985
  • Added URI support for files (file://) and globs (glob://).
  • Added object support for files and globs.
• Updated task input files:
  • Added a optional param, which allows the file to be optional (missing) during hashing.
    Defaults to true.
  • Added a content param, which will match against the file's contents to determine affected
    state.
• Updated task input globs:
  • Added a cache param, which controls whether the glob results should be cached or not.
• Updated the @moonrepo/cli npm package to no longer rely on postinstall scripts.
• Improved argument quoting for commands and scripts.
• Renamed project type to layer, as it better reflects what it does, a layer of access within
  the project stack. For backwards compatibility, the type name will still be supported until
  v2. The following changes have been made:
  • type -> layer in moon.yml
  • --type -> --layer in moon query projects
  • projectType -> projectLayer for MQL
  • $projectType -> $projectLayer for task tokens
  • enforceProjectTypeRelationships -> enforceLayerRelationships in .moon/workspace.yml

🐞 Fixes

• Fixed moon query touched-files --defaultBranch requiring a "true" or "false" explicit value.

⚙️ Internal

• Added telemetry for toolchain usage.
• Added unstable support for bubbling up logs from WASM plugins.
• Updated Rust to v1.88.0.
• Updated proto to v0.51.4 (from 0.50.1).
• Updated dependencies.

v1.38.6

Compare Source

🧰 Toolchains

• Go
  • Fixed go.* parsing failures when there was no trailing newline.

⚙️ Internal

• Updated proto to v0.50.5 (from 0.50.1)
  to resolve an "unknown field spec" error. This is triggered when the global proto binary is
  using v0.51, and moon is using proto < v0.50.5.

v1.38.5

Compare Source

🚀 Updates

• Updated project locating to log the glob results for debugging purposes.

🐞 Fixes

• Fixed a bun.lock parsing error.

v1.38.4

Compare Source

🚀 Updates

• Updated MCP (Model Context Protocol) implementation to use protocol version 2025-06-18 from
  2025-03-26 - in turn, allowing Claude Code to use the MCP.
  • Updated sync_projects tool to sync all projects if no IDs provided.

📚 Documentation

• Added Claude Code to MCP documentation.

v1.38.3

Compare Source

🐞 Fixes

• Fixed the duplicate nodes in the action graph.

v1.38.2

Compare Source

🚀 Updates

• More plugin pre-loading improvements.

🐞 Fixes

• Potential fix for duplicate nodes in the action graph.
• Potential fix for the node platform panicing for a missing package manager.
• Potential fix for a fs rename error when installing proto.
• Fixed a panic that would occur during moon ci job calculation.

v1.38.1

Compare Source

🚀 Updates

• Added a new setting for toolchain plugins, versionFromPrototools, which controls how we inherit
  a version from the root .prototools file. By default this is enabled, but can be configured with
  a string if the IDs don't match.
• Added support for toolchain plugins to replace/wrap a task script in the extend_task_script WASM
  API.
• Updated toolchain setup to preload the proto WASM plugin. This should help to alleviate network
  race conditions.
• Updated moon setup to also install toolchain plugins.

🐞 Fixes

• Fixed an issue where toolchain plugins do not inherit versions from .prototools.
• Fixed an issue where a file lock would be created for proto installation, even when it didn't need
  to be installed.
• Fixed an issue where moon docker prune would force install all toolchains. If you were relying
  on this functionality, run moon docker setup instead.

🧩 Plugins

• WASM API
  • Added ExtendTaskScriptOutput.script field.

v1.38.0

Compare Source

💥 Breaking

• WASM API
  • Renamed RegisterToolchainOutput.lock_file_name to RegisterToolchainOutput.lock_file_names
    and its type to Vec<String>.
  • Renamed RegisterToolchainOutput.manifest_file_name to
    RegisterToolchainOutput.manifest_file_names and its type to Vec<String>.

🚀 Updates

• Added a new
  Go toolchain implementation,
  powered entirely by our new WASM plugin system. It can be enabled with the unstable_go
  identifier.
  • Supports tiers 1, 2, and 3!
  • Supports Go workspaces via go.work files.
  • Extracts project dependencies and relationships from go.mod files.
  • Extracts version and lockfile information from go.sum and go.work.sum files.
  • Basic vendor support (go mod vendor) during Docker prune.
• Added new tools for moon mcp.
  • get_touched_files - Gets touched files between base and head.
  • sync_projects - Runs the SyncProject action for one or many projects.
  • sync_workspace - Runs the SyncWorkspace action.
• Added new moon toolchain command and sub-commands.
  • Add a toolchain to .moon/toolchain.yml with moon toolchain add.
  • View information about a toolchain plugin with moon toolchain info.
• Added support for terminal desktop notifications. Can be enabled with the new
  notifier.terminalNotifications setting in .moon/workspace.yml.
• Added a notifier.webhookAcknowledge setting, that ensures webhooks resolve with a 2xx status
  code.
• Updated project graph invalidation to take manifests from toolchain plugins into account.

🐞 Fixes

• Fixed an issue with task output hydration that would sometimes fail with a permission denied error
  when cleaning stale files.

🧩 Plugins

• Updated rust_toolchain to v0.2.0.
  • Cached the globals bin directory when extending task commands/scripts.
  • Task hashing now includes the host OS, arch, and libc.
• WASM API
  • Added LocateDependenciesRootInput.toolchain_config field.
  • Added PruneDockerInput.toolchain_config field.
  • Added ScaffoldDockerInput.toolchain_config field.

⚙️ Internal

• Updated proto to v0.50.1 (from 0.49.4).

v1.37.3

Compare Source

🐞 Fixes

• Fixed an issue where git:// based code generation couldn't checkout a specific commit.
• Fixed incorrect casing for the moon migrate --skipTouchedFilesCheck option.

v1.37.2

Compare Source

🚀 Updates

• Updated moon ci to always run the sync workspace action, even when no tasks are affected.

🐞 Fixes

• Fixed an issue where git commands would attempt to execute, even when no git binary was found.
• Fixed an issue where moon docker scaffold would over scaffold the same project multiple times.
• Fixed an issue where proto would be installed when MOON_TOOLCHAIN_FORCE_GLOBALS is set.
• Reworked the git commands that are executed for git:// based code generation.

⚙️ Internal

• Updated dependencies.

v1.37.1

Compare Source

📚 Documentation

• Updated the MCP documentation.
  • Added Zed support.
  • Added an llms.txt file to our website.
  • Updated code examples to include the MOON_WORKSPACE_ROOT environment variable.

🐞 Fixes

• Fixed environment variable inheritance for config settings not always working correctly.

🧩 Plugins

• Updated rust_toolchain to v0.1.2.
  • Fixed cargo-binstall failing in CI when the binary already exists.
• WASM API
  • Added SetupEnvironmentInput.globals_dir field.

⚙️ Internal

• Updated dependencies.

v1.37.0

Compare Source

🔖 RFCs

• Task input additions and enhancements: #​1985

🚀 Updates

• Added a new
  Rust toolchain implementation,
  powered entirely by our new WASM plugin system. Since toolchain plugins are new and unstable, this
  Rust toolchain can be enabled with the unstable_rust identifier (instead of rust).
  • Supports multiple Cargo workspaces, and workspaces can exist at any depth.
  • More accurate project relationship detection.
  • New addMsrvConstraint setting.
  • Better Docker prune implementation.
  • Improved manifest/lockfile parsing.
  • Cargo/rustup commands are now hashed and cached.
• Added an unstable moon mcp command, which starts an MCP (model context protocol) stdio server
  that responds to AI agent requests.
  • Supports the following tools: get_project, get_projects, get_task, get_tasks.
  • We will be expanding this with more functionality over time, like run_task, etc.
• Updated webhook events.
  • Added environment.initializing and environment.initialized events.
  • Added root and toolchain fields to dependencies.installing and dependencies.installed
    events.
  • Deprecated the runtime field in all events. Will be removed once toolchain plugins are
    complete.

🧩 Plugins

• Added test utilities for testing toolchain plugin functions.
• Improved cache handling and invalidation for SetupEnvironment and InstallDependencies actions.
• WASM
  • Reworked all virtual path fields in "output" structs to greatly reduce the JSON payload.
  • Reworked the ManifestDependency type to be an enum instead of a struct.
  • Added ProjectDependency.via field.

⚙️ Internal

• Updated proto to v0.49.4 (from 0.49.1).
• Updated dependencies.

v1.36.3

Compare Source

🐞 Fixes

• Fixed an issue where environment variables with default/fallback values (${VAR:+default}) were
  not parsed correctly.

⚙️ Internal

• Updated dependencies.

v1.36.2

Compare Source

🚀 Updates

• Added support for shell-specific environment variable namespaces when scanning and substituting
  values. Supports the following:
  • $E: - Elvish
  • $env:: - Ion
  • $ENV. - Murex
  • $env. - Nu
  • $env: - PowerShell
• Updated all identifiers to support unicode alpha-numeric characters instead of just ASCII.

🐞 Fixes

• Fixed some issues where MOON_TOOLCHAIN_FORCE_GLOBALS wasn't respected for Python and Rust
  toolchains.

v1.36.1

Compare Source

🐞 Fixes

• Fixed an issue where tasks would not substitute environment variables when executing, because it
  did not run in a shell.

⚙️ Internal

• Updated dependencies.

v1.36.0

Compare Source

🚀 Updates

• Added more unstable support for toolchain plugins.
  • In the project graph:
    • Extend projects with dependencies, tasks, and an alias.
  • In the action pipeline:
    • Added SetupEnvironment action that executes the setup_environment WASM API.
    • Added InstallDependencies action that executes the install_dependencies WASM API.
  • When running tasks:
    • Extend the command/script with additional parameters before executing.
    • Inject dependency and lock information into the hash.
  • With Docker:
    • Updated docker prune to utilize the new WASM APIs for toolchain plugins.
• Added --host and --port options to moon action-graph, moon task-graph, and
  moon project-graph.
• Added --stdin option to moon ci and moon run, which will allow touched files to be passed
  via stdin, instead of running VCS commands to determine them.
  • This is a follow-up fix to the revert in a previous version. This functionality is now opt-in
    instead of the default, to avoid problematic edge cases.
• Updated and improved remote caching:
  • Added an unstable_remote.cache.verifyIntegrity setting, that will verify the digest of
    downloaded blobs to ensure they aren't corrupted or incomplete. Will degrade performance but
    ensure reliability.
  • Added a file rollback mechanic to that will be triggered when hydration fails part way and
    written files need to be removed.
  • Updated blob existence checks to be batched and parallelized.
  • Can now be enabled entirely through environment variables.
• Updated and improved code generation:
  • Added support for array and object variable types in template.yml. The values must be JSON
    compatible.
  • Updated generator.templates to support https:// URLs that point to an archive that can be
    unpacked.
• Removed the restriction around moon.{yml,pkl} not being allowed as a task input. However, will
  not be included when using **/*.

🐞 Fixes

• Fixed an issue where terminal prompt validation would not trigger.
• Fixed an issue with remote cache hydration where multiple files with the same blob hash would fail
  to write them all.
• Fixed an issue where changing args or env of a task dependency would not invalidate its cache.
• Fixed an issue where environment variables passed on the command line would not overwrite task
  env.
• Fixed tag-based task dependencies not creating implicit project dependencies.
• Fixed some task/command argument quoting issues.

🧩 Plugins

• Added new toolchain WASM APIs.
  • extend_project_graph - Extend projects with toolchain specific info.
  • extend_task_command - Extend the command child process with parameters.
  • extend_task_script - Extend the script child process with parameters.
  • locate_dependencies_root - Locate the package dependencies workspace root.
  • parse_manifest - Parse a manifest file to extract dependencies.
  • parse_lock - Parse a lock file to extract resolved dependencies.
• WASM
  • Added InstallDependenciesInput.packages and production fields.
  • Added InstallDependenciesOutput.operations field.
  • Added PruneDockerInput.projects and root fields.
  • Added PruneDockerOutput.
  • Added SetupEnvironmentOutput.operations field.
  • Added SetupToolchainOutput.operations field.
  • Added SyncWorkspaceInput.toolchain_config field.
  • Added TeardownToolchainInput.version field.

⚙️ Internal

• Updated Rust to v1.87.0.
• Updated proto to v0.49.1 (from 0.47.11).
• Updated dependencies.

v1.35.7

Compare Source

🐞 Fixes

• Reverted moon ci and moon run accepting touched files via stdin, as it's causing issues in CI
  environments. Will revisit for the next release.

v1.35.6

Compare Source

🚀 Updates

• Updated moon run to support passing touched files via stdin.
• Updated commands that wait for stdin to continue after 10 seconds if nothing was received.

🐞 Fixes

• Fixed an issue where Git v2 would error loading submodules that haven't been checked out yet.
• Fixed an issue with remote cache hydration that would leave around stale artifacts.
• Fixed an issue where parallel persistent tasks wouldn't prefix output.

v1.35.5

Compare Source

🐞 Fixes

• Potential fix for affected dependencies in the action pipeline not running and failing with a
  "missing hash" error.
• Potential fix for "Bun" and "Node with Bun as a package manager" both installing dependencies in
  parallel and colliding.
• Fixed an issue where downloading an invalid remote cache would not abort the hydrate process.

v1.35.4

Compare Source

🚀 Updates

• Updated remote caching to error if an output file is a symlink to a file outside of the workspace.

🐞 Fixes

• Fixed an issue with priority tasks where dependencies of the task may sometimes not run in the
  correct order in the pipeline.
• Fixed an issue where task affectedFiles and runFromWorkspaceRoot would pass invalid relative
  file paths.
• Fixed an issue where running tasks for custom plugins would trigger a panic.

v1.35.3

Compare Source

🚀 Updates

• Updated remote uploads/downloads to abort when receiving a ctrl+c.

🐞 Fixes

• Fixed an issue where interrupting (ctrl+c) a task that exits with a 0 code would treat is as
  succesful, resulting in an invalid cache.

v1.35.2

Compare Source

🚀 Updates

• Improved bare repository support for Git v2.
• Updated moon ci to support passing touched files via stdin.

🐞 Fixes

• Fixed the faster/new glob implementation not filtering out hidden directories. This should now
  work like the old implementation.
• Fixed the new Git v2 not working correctly for synced hooks and worktrees.

v1.35.1

Compare Source

🚀 Updates

• Added locks to workspace graph building to avoid duplicate graphs.
• Enabled TCP keep alive for remote service connections.
• Tweaked the remote cache file size threshold.

🐞 Fixes

• Fixed a scenario where task outputs would be partially hydrated from remote cache.

v1.35.0

Compare Source

🚀 Updates

• Rewrote the action graph to support plugins. The following changes have been made.
  • Is now async compatible. In the future, we'll update it to also support concurrency, so that the
    graph can be built in parallel across threads.
  • Reduced the amount of edges (relationships) being created between nodes (actions).
  • Added a new InstallDependencies action for WASM plugins.
    • The dependencies root is now dynamically located by traversing the file system, unlike the
      previous implementation that assumed everything was in the workspace root.
  • Added a new SetupEnvironment action for WASM plugins.
    • This runs after SetupToolchain but before InstallDependencies.
    • Can be used to setup the workspace or project environment. For example, initializing Python
      venv, or making manifest/lockfile changes.
  • Updated RunTask to setup toolchains and install dependencies for each toolchain that has
    been configured, instead of just the 1st one (work in progress).
  • Updated SyncProject to no longer depend on SetupToolchain, and not be grouped by
    language/toolchain, and instead encompass all of them applicable to the project.
• Added a new task option, cacheKey, which can be used to seed the hash, and invalidate local and
  remote caches.
• Added a new task option, priority, that controls the position in the pipeline queue.
  • Supports critical, high, normal (default), or low.
• Added a --log=verbose level, which includes span information on top of the trace level.
• Added a light terminal theme. Can be enabled with --theme=light or MOON_THEME=light.
  • This is still a work in progress. Open to feedback on color/contrast choices.
• Added 2 new webhooks, toolchain.installing and toolchain.installed, which emit when a
  toolchain WASM plugin is installing a tool (via proto).
• Enabled the experiments.fasterGlobWalk and experiments.gitV2 experiments.

🧩 Plugins

• Added tier 3 support (tier 2 still a work in progress).
  • This utilizes the same APIs as proto: https://moonrepo.dev/docs/proto/wasm-plugin
• Added new toolchain WASM APIs.
  • locate_dependencies_root - Locates the dependencies root (workspace).
  • setup_environment - Runs operations to setup an environment for a project/workspace before
    installing dependencies and running tasks.
  • install_dependencies - Defines commands to install/dedupe dependencies.
  • setup_toolchain - Runs operations after the tool has been installed.
  • teardown_toolchain - Runs operations before the tool will be uninstalled.

🐞 Fixes

• Fixed the error handling of remote service uploads and downloads.
• Fixed a timed out task displaying a generic and unhelpful error message.

⚙️ Internal

• Linux binaries are now built on Ubuntu v22 instead of v20.
• Rewrote our testing utilities and updated all tests.
• Updated proto to v0.47.11 (from
  0.47.7).
• Updated Rust to v1.86.0.

v1.34.3

Compare Source

🐞 Fixes

• Attempted fix for the "plugin typescript already exists" error.
• Fixed an issue where negated glob task inputs wouldn't filter the file list when hashing.

⚙️ Internal

• Updated dependencies.

v1.34.2

Compare Source

🚀 Updates

• Minor change to remote caching up/download batching to increase performance.
• Reworked remote caching error handling.

🐞 Fixes

• Fixed an issue where remote caching would fail to upload multiple blobs if the sum of their sizes
  exceed the max upload size.
• Fixed an issue where the same plugin could be loaded multiple times.
• Fixed an issue when parsing config/template files that contain a byte-order mark (BOM).

⚙️ Internal

• Updated dependencies.

v1.34.1

Compare Source

🐞 Fixes

• Fixed a compilation error when moon is installed through Cargo.
• Fixed the version missing in --version and --help.
• Fixed text wrapping issues when rendering tables in the terminal.

v1.34.0

Compare Source

💥 Breaking

• We have sunset our moonbase service and removed its integration from
  moon. If you were using moonbase's remote caching, we suggest using
  Depot or self-hosting instead.

🚀 Updates

• Integrated a new console rendering system with new terminal styles, prompts, and output.
  • Updated all applicable commands.
  • Updated moon templates to render a list of data.
  • Updated moon query projects and moon query tasks to render a table of data.
• Added new settings to pipeline (formerly runner) in .moon/workspace.yml to control which
  kinds of action nodes exist in the action graph when running tasks.
  • syncWorkspace setting toggles the root SyncWorkspace action.
  • syncProjects setting toggles the SyncProject actions, and can be scoped to project IDs.
  • syncProjectDependencies setting toggles whether to recursively link SyncProject actions
    based on project dependencies.
  • installDependencies setting toggles the InstallWorkspaceDeps and InstallProjectDeps
    actions, and can be scoped to toolchain IDs.
• Added an experiments.fasterGlobWalk setting to .moon/workspace.yml, that will use a better
  glob walker implementation. Do note that this is experimental and may be buggy!
  • In our benchmarks, it's on average 1.5-2x faster.
  • We also attempt to cache the results, which occurs quite often when running tasks.
  • Globs are now logged to better debug performance issues.
• Added an experiments.gitV2 setting to .moon/workspace.yml, that uses a new Git implementation.
  • Has better support for submodules, subtrees, and worktrees.
  • Parallelizes processes when applicable.
  • Covers edge cases the v1 implementation did not support.
• Added a --no-actions flag to moon run, that will run the task without including the other
  actions, like SyncProject, SetupToolchain, etc.
• Added a --json flag to moon templates.
• Deprecated the pipeline.archivableTargets setting. All tasks are now automatically cached if
  using Bazel Remote Caching.
• Improved the performance of environment variable substitution.
• Improved toolchain plugin loading to be on-demand.
• Improved sync cache invalidation for codeowners, config schemas, and VCS hooks.
• Updated moon docker file to inherit the default Docker image from any applicable toolchain
  plugins.
• Updated moon sync to no longer be deprecated, and instead sync the workspace and all projects.
• WASM API
  • Added DefineDockerMetadataOutput.default_image field.
  • Added SettingPrompt.description field.

⚙️ Internal

• Updated Rust to v1.85.1.
• Updated dependencies.

v1.33.3

Compare Source

🐞 Fixes

• Fixed an issue where npx @​moonrepo/cli would no longer work.
• Fixed an issue where toolchain.typescript = true in moon.yml would not inherit it as a
  toolchain.

⚙️ Internal

• Updated proto to v0.47.7 (from 0.47.4).
• Updated dependencies.

v1.33.2

Compare Source

🚀 Updates

• Added MOON_REMOTE_* environment variables for many unstable_remote settings.

🐞 Fixes

• Fixed an issue where project toolchain detection would not take the toolchain disabled state in
  moon.yml into account.

⚙️ Internal

• Updated dependencies.

v1.33.1

Compare Source

🐞 Fixes

• Fixed an issue where internal tasks could be ran when using the "run in closest project"
  shorthand.
• Fixed an issue where the task preset would sometimes not be inherited when using extends.

🧩 Plugins

• Updated typescript_toolchain to v0.1.3.
  • Will no longer error if a file in extends is missing during task hashing.

v1.33.0

Compare Source

💥 Breaking

• Changed the way to disable the TypeScript toolchain in moon.yml.

  # Before
  toolchain:
    typescript:
      disable: true
  # After
  toolchain:
    typescript: false # or null

• Removed the --include option from moon docker scaffold (it's been long deprecated). Use the
  docker settings instead.

🚀 Updates

• The TypeScript toolchain is now powered by a
  WASM plugin. This is our
  first step in supporting plugins in core. We chose TypeScript as our 1st plugin because it was the
  simplest of all the toolchains, and primarily was used for project syncing.
  • Plugins must be downloaded from the internet, so a connection is required on the first run. The
    plugin is then cached locally.
  • Most of the code had to be rewritten but we tried to keep as much parity as possible. Please
    report an issues or differences you encounter.
  • Because TypeScript is now a "true" toolchain, it will appear in the toolchains list for projects
    and tasks. This is required since it runs operations in the context of the plugin.
  • All typescript settings in .moon/toolchain.yml can now be defined as overrides in
    moon.yml.
• Added new toolchain plugin integrations for specific features.
  • Integrated into the SyncWorkspace and SyncProject actions.
  • Integrated into all moon docker commands.
  • Integrated into the task hashing process.
• Added a new moonx executable, which is a shorthand for moon run.
  • Right now the implementation uses Bash/PowerShell shims, but will be migrated to a true binary
    executable once we rework our release process.
  • The shims are dynamically created the first time moon runs, relative to the executed moon
    binary.
• Added support for moon run ~:build, which will run the build task in the closest project
  (traversing upwards).
• Added $XDG_DATA_HOME support when detecting the moon store. Will be used if $MOON_HOME is not
  set, and will fallback to $HOME/.moon.
• Added elapsed/timing information to child processes and WASM calls within logs.
• Improved the handling of CTRL-C, CTRL-BREAK, and other signals on Windows.
• Updated moon init with toolchain plugin support.
• Updated toolchain.default in moon.yml to support a list of IDs.
• Updated unstable_remote.auth.headers to support environment variable interpolation.
• Updated generated JSON schemas at .moon/cache/schemas to dynamically include toolchain plugin
  configuration.
• Updated file hashing (via git hash-object) to continously pipe stdin to avoid hanging processes.
• Deprecated hasher.batchSize in .moon/workspace.yml.

🧩 Plugins

• Added new toolchain WASM APIs.
  • register_toolchain - Registers the toolchain and provide metadata for detection and other
    purposes.
  • initialize_toolchain - Provides prompts to use during moon init to gather settings values.
  • define_toolchain_config - Defines a configuration schema for use within JSON schemas.
  • define_docker_metadata - Defines metadata related to docker commands.
  • hash_task_contents - Injects content into the task hashing process.
  • prune_docker - Custom operations to run during docker prune.
  • scaffold_docker - Custom operations to run during docker scaffold.
  • sync_project - Runs syncing operations per project (during the SyncProject action).
  • sync_workspace - Runs syncing operations at the workspace root (during the SyncWorkspace
    action).
• Updated download_extension to v0.0.9.
• Updated migrate_nx_extension to v0.0.9.
  • Will no longer remove Nx configs. Pass --cleanup to remove them.
• Updated migrate_turborepo_extension to v0.1.6.
  • Will no longer remove Turborepo configs. Pass --cleanup to remove them.

🐞 Fixes

• Fixed an issue where file hashing (git hash-object) would hang when there are too many files
  being hashed.

⚙️ Internal

• Updated proto to v0.47.4 (from 0.45.2).
• Updated Rust to v1.85.
• Updated dependencies.
• Removed JSON schemas from the GitHub release.

v1.32.9

Compare Source

🐞 Fixes

• Reverted "Fixed an issue where task output wasn't captured for the "review" section in a run
  summary." as it caused a regression.

v1.32.8

Compare Source

🐞 Fixes

• Fixed an issue where task output wasn't captured for the "review" section in a run summary.
• Fixed an issue where a task with a script would always be forced to the "system" toolchain.

v1.32.7

Compare Source

🚀 Updates

• Updated moon task-graph, moon-project-graph, and moon action-graph to request a port
  dynamically, instead of defaulting to 8000.

🐞 Fixes

• Fixed an issue where moon *-graph commands could not be CTRL+C'd.
• Fixed an issue where Git based template locations would fail if the initial git clone failed.

v1.32.6

Compare Source

🐞 Fixes

• Fixed an issue where aliases would not be inherited for some toolchains.
• Fixed some token variable interpolation for paths on Windows.

v1.32.5

Compare Source

🚀 Updates

• Updated Python uv with new features:
  • Project aliases are inferred from project.name in pyproject.toml.
  • Implicit project dependencies are inferred from project.dependencies in pyproject.toml.
    • Requires a bare identifier with no version/url/origin markers.
    • Currently does not support tool.uv or workspaces.

🐞 Fixes

• Fixed an issue where no touched files would be found when pushing commits on the default branch.
• Fixed an issue where pyproject.toml or uv.lock would sometimes not be parsed.

v1.32.4

Compare Source

🐞 Fixes

• Fixed an issue where a project could be inserted into the project graph multiple times.
• Fixed an issue where touched files would sometimes not be available outside of affected scopes.

v1.32.3

Compare Source

🐞 Fixes

• Fixed an issue where moon setup wouldn't load configuration.
• Fixed an issue where moon docker scaffold would unexpectedly install the toolchain languages.
• Fixed an issue where moon docker scaffold would not copy uv.toml and uv.lock files.
• Fixed an issue where changing python.version wouldn't regenerate the Python virtual environment.

v1.32.2

Compare Source

🐞 Fixes

• Fixed an issue where NO_COLOR or FORCE_COLOR would be overwritten for task child processes.

⚙️ Internal

• Updated proto to v0.45.2 (from 0.45.1).
• Updated dependencies.

v1.32.1

Compare Source

🚀 Updates

• Added a runner.killProcessThreshold setting to control the threshold in which to force kill
  child processes when a signal is received. Defaults to 2 seconds.

🐞 Fixes

• Fixed an issue where bash and batch project language's would not inherit tasks.
• Fixed some bun.lock parsing issues.

v1.32.0

Compare Source

🚀 Updates

• Added unstable support for multiple package workspaces when installing dependencies and resolving
  lockfiles.
  • For example, you can now have multiple yarn.lock files throughout the repository, allowing for
    multiple Yarn/Node workspaces.
• Updated Pkl (.pkl) based configuration to always be enabled, and is no longer hidden behind an
  experimental flag.
  • Added official documentation: https://moonrepo.dev/docs/guides/pkl-config
• Updated our unstable remote service (Bazel RE API) with new functionality:
  • You can now use http(s) protocols for gRPC servers, instead of just grpc(s).
  • Added an unstable_remote.api setting, which can be used to inform the server's API format.
    Defaults to grpc.
  • Added an unstable_remote.auth setting, which can be used for HTTP Bearer/token Authorization
    based endpoints. Can also be used to set headers for all requests.
  • Added support for Depot cloud-based caching: https://depot.dev/docs/cache/overview
  • Added support for the HTTP protocol: https://bazel.build/remote/caching#http-caching
  • Added support for the ByteStream API.
  • Added timeout and concurrency limit to clients.
  • Added a MOON_DEBUG_REMOTE environment

---

Configuration

📅 Schedule: Branch creation - At any time (no schedule defined), Automerge - At any time (no schedule defined).

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about these updates again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

[renovate]

⚠️ Artifact update problem

Renovate failed to update an artifact related to this branch. You probably do not want to merge this PR as-is.

♻ Renovate will retry this branch, including artifacts, only when one of the following happens:

• any of the package files in this branch needs updating, or
• the branch becomes conflicted, or
• you click the rebase/retry checkbox if found above, or
• you rename this PR's title to start with "rebase!" to trigger it manually

The artifact failure details are included below:

File name: pnpm-lock.yaml

Scope: all 2 workspace projects
Progress: resolved 1, reused 0, downloaded 0, added 0
.                                        |  WARN  Package name mismatch found while reading {"tarball":"https://codeload.github.com/actions/github-script/tar.gz/ed597411d8f924073f98dfc5c65a23a2325f34cd"} from the store.
 ERR_PNPM_UNEXPECTED_PKG_CONTENT_IN_STORE  The lockfile is broken! A full installation will be performed in an attempt to fix it.
Progress: resolved 48, reused 0, downloaded 0, added 0
 ERR_PNPM_UNEXPECTED_PKG_CONTENT_IN_STORE  Package name mismatch found while reading {"tarball":"https://codeload.github.com/actions/github-script/tar.gz/ed597411d8f924073f98dfc5c65a23a2325f34cd"} from the store.

This error happened while installing a direct dependency of /tmp/renovate/repos/github/astrolicious/dotdev

This means that either the lockfile is broken or the package metadata (name and version) inside the package's package.json file doesn't match the metadata in the registry. Expected package: github-script@undefined. Actual package in the store with the given integrity: @actions/[email protected].

If you want to ignore this issue, set the strict-store-pkg-content-check to false.