chore(deps): update dependency moonrepo/moon to v2

[renovate]

This PR contains the following updates:

Package	Type	Update	Change
moonrepo/moon	devDependencies	major	1.41.8 → 2.3.4

---

Warning

Some dependencies could not be looked up. Check the Dependency Dashboard for more information.

---

Release Notes

moonrepo/moon (moonrepo/moon)

v2.3.4

Compare Source

🐞 Fixes

• Fixed an issue where projects with the same name/ID as their underlying toolchain package would cause issues when pruning within Docker.
• Fixed an issue where remote caching wasn't being updated unless the casOutputsCache experiment was enabled.

🧰 Toolchains

• Python
  • Updated uv sync to use --no-dev when installing production only dependencies.
• Rust
  • Updated cargo-binstall installation to use --locked.

v2.3.3

Compare Source

🛡️ Security

• Fixed a security issue where task outputs being hydrated from the remote cache can overwrite files
  outside the output list, if the manifest in the remote cache has been compromised.

🧰 Toolchains

• Go
  • Fixed a go.mod parsing regression that failed to parse tool ().

v2.3.2

Compare Source

🚀 Updates

• Added panic handling to the daemon server, to capture and log unexpected panics.
• Updated the pipeline to continue if the daemon client cannot connect, instead of failing the whole
  pipeline.

🐞 Fixes

• Potential fix for the daemon client connection refused error. If this problem persists,
  temporarily disable the daemon and report an issue.
• Fixed an issue with project:^ inputs where resolved files would be excluded when project sources
  overlap.

🧰 Toolchains

• Go
  • Added an inferRelationshipsPackages setting to customize the package patterns passed to
    go list --deps.
  • Updated go list --deps relationship inference to scan all packages (./...) by default, so
    dependencies imported only from subdirectories (internal/, pkg/, ...) are now inferred.

v2.3.1

Compare Source

🚀 Updates

• Added in-memory caching to certain toolchain operations, primarily around locating executables.
• Improved daemon startup performance by loading the workspace graph in the background after the
  server is ready.
• Updated plugin distribution to use ghcr.io instead of raw URLs, which should improve reliability
  and performance of plugin downloads.

🐞 Fixes

• Reworked the daemon connect/ready logic to possibly fix some Windows connection issues.
• Fixed an issue where the task dependency cacheStrategy inferrence was not working correctly
  based on what experiments are enabled.
• Fixed an issue where locks created at .moon/cache/locks would not be cleaned up.

⚙️ Internal

• Updated proto to v0.57.4 from 0.57.3.

v2.3.0

Compare Source

🚀 Updates

• Cache
  • Added a new experiment that stores task outputs in a local content-addressable storage (CAS)
    cache, sharing the same format used by the remote cache. Enables deduplicated storage across
    tasks and a unified cache shape locally and remotely.
    • Enable with the experiments.casOutputsCache setting in .moon/workspace.*.
  • Added a new top-level cache setting in .moon/workspace.* for tuning the content-addressable
    storage (CAS) cache.
• Daemon
  • When pipeline.autoCleanCache is enabled (by default), the auto-clean will now run in the
    daemon, instead of at the tail-end of the main process.
  • When utilizing webhooks, the requests will now be made from the daemon, instead of the main
    process.
• Git
  • Added SHA256 support for commit hashes. This is in preparation for Git's transition to SHA256 as
    the default hash algorithm.
• Hash
  • Added a new experiment that replaces the VCS/Git based file hashing mechanism with a custom
    native implementation that runs within our task pool. This can improve performance by 10-50%.
    • Enable with the experiments.nativeFileHashing setting in .moon/workspace.*.
• MCP
  • Added get_template and get_templates tools so AI coding assistants can discover templates
    and inspect their variable schemas before calling generate.
• Tasks
  • Added tags support to tasks through new tags and options.mergeTags settings.
    • Added taskTag field support to MQL.
    • Added --tags option support to moon query tasks.
    • Updated targets to support the # tag syntax in the task scope, allowing you to reference
      tasks by their tags. For example: app:#quality.
  • Added a cacheStrategy field to task dependencies that controls how a dependency's changes
    invalidate the current task's cache. Supports hash, ignored, and outputs — the latter
    mixes in the dependency's output files instead of its hash, so build tasks are only invalidated
    when upstream outputs change, not when upstream inputs change.
    • Behavior change: when cacheStrategy is omitted, the default is now hash if the
      dependency declares outputs and ignored if it doesn't, instead of always hash. Tasks that
      depend on output-less tasks (e.g. lint, test) will see fewer cache invalidations. Set
      cacheStrategy: 'hash' explicitly to restore the previous behavior for a given dependency.
• Performance
  • Reduced task target memory footprint by 50-100%.

🧰 Toolchains

• JavaScript
  • Added support for Deno v2.8.
    • Will use deno ci for installs in CI when deno.lock exists and the configured Deno version
      is >= v2.8.
    • Will pass --prod to deno install for production installs when the configured Deno version
      is >= v2.8.
    • Will resolve catalog: references in package.json files using catalogs declared in a root
      deno.json.
• Python
  • Added unstable support for uv pip.
    • Can be configured using unstable_python.packageManager: 'uv-pip' in .moon/toolchains.*.
    • Will inherit install arguments from unstable_pip.installArgs.
    • Will inherit sync arguments from unstable_uv.syncArgs.
    • Will inherit venv arguments from unstable_uv.venvArgs.

🐞 Fixes

• Fixed a glob regression where unbounded walks could be up to 10x slower.

⚙️ Internal

• Updated proto to v0.57.3 from 0.56.4.
• Updated Rust to v1.96.0.
• Updated dependencies.

v2.2.6

Compare Source

🐞 Fixes

• Fixed an issue where the InstallDependencies action would scan manifests within the vendor
  directory, which could cause issues with some package managers.

🧰 Toolchains

• Go
  • Added support for Go v1.24 ignore in go.mod and go.work.

v2.2.5

Compare Source

🐞 Fixes

• Fixed an issue where dot folders would be ignored during globs. The .git folder is still always
  ignored.
• Fixed an issue where nested node_modules folders would be ignored during globs. The
  node_modules folder at the glob target root is still always ignored.
• Fixed an issue where toolchain specific fields, like versionFromPrototools, were missing from
  the generated JSON schemas.
• Fixed an issue where commands executed during toolchain actions (like setup environment) may
  trigger a file system deadlock.

🧰 Toolchains

• Python
  • Updated venv commands to be skipped during environment setup if the directory already exists.
    Configure --clear to force re-initializing.

v2.2.4

Compare Source

🐞 Fixes

• Fixed an issue where proto's auto-clean would remove tools installed by moon as they weren't
  marked as used.
• Fixed a regression where moon would fail with Failed to execute git and capture output when
  .gitmodules referenced a submodule that hadn't been checked out (e.g. update = none).
  Uninitialized submodules are now skipped, matching the v1 behavior.
• Fixed an issue where toolchain dependency installation would be skipped even when the vendor
  directory does not exist.
• Fixed an issue where failing actions would not re-run again because their hash would be persisted,
  even on failure.
• Fixed an issue where WouldBlock errors would trigger when attempting to flush buffered output to
  the console.
• Fixed an issue where --upstream=none would error for missing dependencies.

🧰 Toolchains

• Python
  • Fixed an issue where the wrong arguments were passed to uv sync depending on whether proto is
    managing the Python version.
  • Fixed an issue where venv paths were not available to commands run through the toolchain, like
    uv sync.

⚙️ Internal

• Updated dependencies.

v2.2.3

Compare Source

🐞 Fixes

• Fixed a potential deadlock in the action pipeline when running many sync heavy operations.

v2.2.2

Compare Source

🚀 Updates

• Updated the VS Code extension to point to the v2 JSON schemas. If you are still using moon v1,
  you'll need to pin to an older VS Code extension version until you upgrade to moon v2.

🐞 Fixes

• Fixed a regression in plugin loading that reduced performance of graph operations.
• Fixed an issue where the unpack extension would trigger a missing plugin locator error.

🧰 Toolchains

• Python
  • Fixed the Python toolchain depending on pip/uv, when it should be reversed.

⚙️ Internal

• Updated proto to v0.56.4 from 0.56.3.
• Updated dependencies.

v2.2.1

Compare Source

🚀 Updates

• Added request retry support (via proto), that will retry up to 3 times with exponential backoff
  for transient errors (network issues, rate limits, etc).
• Improved async affected tracking by another 5-10%.
• Updated PowerShell commands to use -EncodedCommand instead of -Command to avoid
  quoting/escaping issues. Let us know if you run into any issues with this change.

🐞 Fixes

• Fixed --summary not being respected in moon ci.
• Fixed issues with graph visualizer commands failing with a JavaScript error after the v2.2 graph
  changes.
• Fixed an issue where checking the remote cache for an entry before the task execution could
  cause the task to fail if the remote cache check errored. We now treat remote cache errors as
  cache misses, and allow the task to execute.
• Fixed an issue where filtered graphs would point to the wrong data because indexes changed.

🧰 Toolchains

• JavaScript
  • Fixed pnpm-lock.yaml parsing for pnpm v10's multi-document lockfiles, which are written when
    managePackageManagerVersions is enabled (the default).
• TypeScript
  • Updated project references to start with ./ in preparation for the removal of baseUrl in
    TypeScript v7.

⚙️ Internal

• Updated proto to v0.56.3 from 0.56.1.
• Updated Rust to v1.95.0.
• Updated dependencies.

v2.2.0

Compare Source

💥 Breaking

• The --json output for moon action-graph, moon project-graph, and moon task-graph commands
  has changed. The graph nodes are now integers instead of objects, and the node data is instead
  stored in a separate data object.

🚀 Updates

• Temporarily brought back x86_64-apple-darwin (Apple Intel) as a supported operating system.
• Affected
  • Added an experimental asynchronous version of the affected tracker, that is 100-150% faster.
    • Enable with the experiments.asyncAffectedTracking setting in .moon/workspace.*.
• Config
  • Added MOON_PIPELINE_AUTO_CLEAN_CACHE environment variable support for the
    pipeline.autoCleanCache setting.
  • Added MOON_PIPELINE_CACHE_LIFETIME environment variable support for the
    pipeline.cacheLifetime setting.
  • Added MOON_PIPELINE_KILL_PROCESS_THRESHOLD environment variable support for the
    pipeline.killProcessThreshold setting.
• 🆕 Daemon
  • Added an unstable daemon that will run in the background and process heavy operations. To start,
    it runs a file watcher on the workspace and invalidates caches.
  • Added a moon daemon command with start, stop, and more subcommands to manage the daemon.
  • Added an unstable_daemon setting to .moon/workspace.*.
• Graphs
  • Improved performance of taskToolchains and taskType fields when querying the project graph.
  • Greatly reduced memory footprint of the action, project, and task graphs. Nodes in the graph are
    now integers instead of objects.
• Plugin registry
  • Improved performance and memory consumption when loading plugins.
• Task runner
  • Improved performance of task output archiving, by no longer blocking the main thread pool.
• Toolchains
  • Updated the system toolchain to be built-in instead of an external WASM plugin that needs to be
    downloaded.
• 🆕 Workspace
  • Added an experimental asynchronous version of the project and task graph builders, that utilizes
    a background thread pool per project to build the graph. This can improve performance by
    100-170% in large workspaces.
    • Enable with the experiments.asyncGraphBuilding setting in .moon/workspace.*.
    • Unlike the sync version, the async version does not support cycles, and will not cut edges
      automatically to avoid cycles.

🐞 Fixes

• Fixed an issue with VCS hooks generation that could leave around stale hooks.
• Fixed an issue where toolchains not managed by proto directly (like Rust) would consistently
  re-install itself.
• Fixed an issue where OS based tasks would error while executing if they defined outputs, and
  you're on a different OS.
• Fixed an issue where proto would be installed even when toolchains were disabled with
  MOON_TOOLCHAIN_FORCE_GLOBALS.

⚙️ Internal

• Updated proto to v0.56.1 from 0.55.4.
• Updated dependencies.

v2.1.4

Compare Source

🚀 Updates

• Added moon toolchain download and moon extension download commands that will download all
  configured toolchain/extension plugins. This allows you to prime the download cache.

🐞 Fixes

• Fixed an "unrecognized subcommand moon" error that can occur when global and local moon binaries
  exist.
• Fixed an EPIPE error in streaming child processes.
• Fixed trailing -- in task commands being stripped.
• Potential fix for graph visualizer commands failing with a JavaScript error.

🧰 Toolchains

• Go
  • Updated go list to not require go.mod file to run.

v2.1.3

Compare Source

🧰 Toolchains

• Go
  • Fixed an issue where go list was not running in the project root.
  • Fixed an issue where go list would add a project dependency to itself.
• JavaScript
  • Will now remove node_modules during Docker prune, as some package managers don't do this
    automatically.
  • Removed *.config.* files from the Docker scaffold process.
• npm/pnpm/yarn
  • Updated to always include the "shared globals" directory.
• Python
  • Fixed install/venv args being passed incorrectly in some situations.

v2.1.2

Compare Source

🚀 Updates

• Updated the affected tracker to mark project/tasks as affected on-demand, instead of everything up
  front. This allows us to short-circuit early, improving performance for very large repos.
• Updated many commands and call sites to load projects/tasks without expansion, slightly improving
  performance and memory usage.

🧰 Toolchains

• Go
  • Added inferRelationships and inferRelationshipsFromTests settings to control
    go list --deps usage.
• JavaScript
  • Updated deno.lock and yarn.lock parsing dependencies.
• Python
  • Fixed an issue where install commands didn't have access to venv bins.
  • Fixed an issue where project dependencies were not being inferred correctly when the dependency
    contains extras metadata.
• Rust
  • Updated Cargo.lock parsing dependencies.
• TypeScript
  • Added TypeScript v6 support.

⚙️ Internal

• Updated dependencies.

v2.1.1

Compare Source

🐞 Fixes

• Fixed an issue with remote caching where the batching max size and limit were not being applied
  correctly.
• Fixed an issue where exclude/rename for task inheritance applied to tasks other than those in the
  current project.
• Fixed an issue where toolchains that loaded project/workspace toolchain configuration would not be
  merged correctly.
• Fixed an issue where task console output may appear out of order.
• Fixed an issue with Git file hashing by temporarily re-enabling Git locks.

v2.1.0

Compare Source

🚀 Updates

• Environment
  • Improved our local and remote detection logic. We now also check for common remote devboxes
    (GitHub Codespaces, Gitpod, etc) in addition to CI environments.
• Projects
  • Updated duplicate aliases to no longer be a hard error, and instead will apply to the first
    encountered project. Duplicates are possible when multiple toolchains all use the same package
    name (Go, Rust, Node, etc).
• Tasks
  • Added 3 new settings to the affectedFiles option when using the object syntax:
    • filter - A list of glob patterns to filter the affected files list before passing to the
      task.
    • ignoreProjectBoundary - When matching affected files, ignore the project boundary and
      include workspace relative files. Otherwise, only files within the project are matched.
    • passDotWhenNoResults - When there are no affected files after matching and filtering, use
      . instead of an empty value.
  • Added a new option, runInSyncPhase, that will run the task during moon sync commands.
• Toolchains
  • Added inheritAliases (default true) setting for each toolchain. Can toggle whether to
    inherit aliases for projects while extending the project graph.
  • Added installDependencies (default true) setting for each toolchain. Can toggle whether to
    install dependencies (via the InstallDependencies action) when running a task.

🧰 Toolchains

• Go
  • Will now run go list --deps to determine project relationships while extending the project
    graph.
• Python
  • Normalized package/dependency names to PEP 503 during graph extending.
  • Fixed an issue where package manager toolchain settings were not being inherited correctly.
• TypeScript
  • Added a pruneProjectReferences setting that prunes non-moon managed project references when
    syncing.

🐞 Fixes

• Fixed invalid JSON schema in MCP generate tool.
• Fixed $projectTitle and $projectAliases tokens not being substituted.
• Fixed an issue where bash may not be available (falls back to sh).
• Fixed an issue where a task command could not end with --.
• Fixed some issues where .config/moon was not respected.
• Potential fix for tail-end console output not being written.

⚙️ Internal

• Updated dependencies.

v2.0.4

Compare Source

🧰 Toolchains

• JavaScript
  • Added support for * versions when determining project relationships.
  • Reworked pnpm dedupe and yarn dedupe detection logic.
• Python
  • Will now read pyproject.toml dependencies to determine project relationships.

⚙️ Internal

• Updated proto to v0.55.4 from 0.55.2.
• Updated Rust to v1.94.0.
• Updated dependencies.

v2.0.3

Compare Source

This is a re-release as the v2.0.0 release workflow failed.

v2.0.1

Compare Source

🚀 Updates

• Updated moon upgrade to upgrade via proto if we detect that moon is managed by proto. This will
  run proto install moon latest.

🐞 Fixes

• Fixed some WASM serialization errors.
• Fixed the moon upgrade command not handling the new v2 distribution format correctly. If you are
  on moon v2.0.0, the upgrade command will still be broken until you upgrade to this patch.

v2.0.0

Compare Source

💥 Breaking

View the migration guide for a full list of breaking
changes and how to easily migrate!

• Renamed "touched files" to "changed files".

• CLI

  • Removed canary and nightly releases.
  • Removed commands: moon node, moon migrate from-package-json, moon query hash,
    moon query hash-diff
  • Renamed all options and flags to kebab-case instead of camelCase.
  • Reworked many commands and their arguments. Refer to the migration guide for details.
  • Reworked console output handling. Updated --summary with different levels.
  • Reworked release distribution to use archives instead of direct executables.

• Configuration

  • Renamed, removed, or changed many settings. Refer to the migration guide for details.
  • Renamed .moon/toolchain.yml to .moon/toolchains.yml (plural).

• MCP

  • Updated protocol version to 2025-11-25.
  • Updated get_projects and get_tasks to return fragments, to reduce the payload size.

• Projects

  • Reworked how the language is detected.
  • Flattened project metadata structure.

• Tasks

  • Task inheritance now deep merges instead of shallow merges when dealing with extends and
    multi-global.
  • Task command and args only support simple commands now. Use script for compound commands
    (pipes, redirects, multiple commands, etc).
  • Removed "watcher" task preset.
  • Reworked env var merge order, substitution, and more. Refer to the migration guide for details.
  • Reworked .env handling.
    • Moved loading to occur before task execution, instead of creation.
    • Can no longer reference task env vars for substitution.

• Toolchain

  • Removed the old platform system, and replaced it with the new WASM plugin system.
    • All old "stable" toolchains have been replaced with the new "unstable" toolchains.

• VCS

  • Reworked the hooks layer for better interoperability.

• WASM API

  • Removed the /cwd virtual path.
  • Renamed ProjectFragment.alias to ProjectFragment.aliases and changed its type from
    Option<String> to Vec<String>.
  • Removed RegisterExtensionOutput.config_schema field. Use the new define_extension_config
    plugin function instead.

🚀 Updates

View the announcement blog post for all updates, new
features, improvements, and much more!

• Action pipeline
  • Will now always generate a hash for a task, even if caching is disabled.
  • Applies "transitive reduction" to the graph, removing unnecessary edges for better performance.
  • Improved console output, logging, and error handling.
  • Improved parallelism when running tasks.
    • Now resolves and expands targets before partitioning.
    • Now partitions after filtering based on affected state.
• CLI
  • New commands: moon exec, moon extension, moon hash, moon projects, moon tasks,
    moon query affected, moon template
  • Updated commands moon check, moon ci, and moon run:
    • Now uses moon exec under the hood.
    • Added levels to --summary.
  • Updated commands that require an identifier to prompt for it if not provided.
  • Stabilized the moonx binary (which uses moon exec under the hood).
  • Added support for .config/moon instead of .moon.
  • Added support for ... in task targets, which is an alias for **/*. This is similar to how
    Bazel targets work.
  • Improved stack memory usage by pushing thread data to the heap. This resolves spurious stack
    overflow issues.
• Configuration
  • Added support for more formats: JSON, TOML, and HCL.
  • Improved error messages for union based settings.
  • .moon/extensions.*
    • New file for configuring extensions (formerly in workspace.extensions).
  • .moon/tasks.*
    • Added inheritedBy setting for configuration based task inheritance.
  • .moon/workspace.*
    • Added projects.globFormat setting.
    • Added defaultProject setting.
    • Stabilized remote caching.
  • moon.*
    • Added mergeToolchains task option.
    • Added "utility" task preset.
    • Added "data" stack.
• Docker
  • Better toolchain integration.
  • Added --no-setup and --template support to moon docker file.
  • Updated project configs to override workspace configs.
• Extensions
  • Added a new extension, unpack, for unpacking archive files.
  • Added .moon/extensions.* configuration file.
  • Added support for new plugin APIs: define_extension_config, extend_command,
    extend_project_graph, extend_task_command, extend_task_script, sync_project, and
    sync_workspace.
• MCP
  • Added a generate tool for running the code generator.
• Projects
  • Added a default project concept.
  • Added path based IDs instead of dir name IDs.
  • Updated projects to support multiple aliases (one from each applicable toolchain).
• Remote cache
  • Stabilized all settings.
  • Enabled gzip/zstd compression for HTTP requests.
• Tasks
  • Added deep merging support for task inheritance.
  • Updated command and args with better syntax parsing and error handling.
    • Better handling of quotes, escapes, and spaces.
    • Extracts env vars into the task.
  • Updated env values to support null, which would remove an inherited system env var.
  • Updated envFile option to support token/var substitution.
  • Improved .env handling:
    • Updated the parser to support more syntax.
    • Updated loading to occur before task execution, instead of creation.
    • Can now reference system/moon/task env vars for substitution.
• Toolchains
  • Stabilized the new WASM plugin system.
  • Improved how toolchains extend env vars and paths for commands and scripts.
• Tokens
  • Added new tokens: $projectTitle, $projectAliases, $taskToolchains
• VCS
  • Replaced the old v1 Git implementation with a new v2 implementation.
  • Improved support for worktrees, submodules, and more.
• WASM API
  • Added a load_extension_config_by_id host function.
  • Added define_extension_config, initialize_extension, and extend_command plugin functions.
  • Added load_extension_config, parse_extension_config and parse_extension_config_schema
    utility functions.
  • Added DefineExtensionConfigOutput, InitializeExtensionInput, InitializeExtensionOutput,
    ExtendCommandInput, and ExtendCommandOutput types.
  • Added ExtendProjectGraphInput.extension_config, ExtendTaskCommandInput.extension_config,
    ExtendTaskScriptInput.extension_config, SyncProjectInput.extension_config, and
    SyncWorkspaceInput.extension_config fields.
  • Added RegisterToolchainOutput.language field.

🧩 Extensions

• Migrate Nx
  • Added support for the following project.json fields: targets.*.continuous
• Migrate Turborepo
  • Added support for the following turbo.json fields: tags, tasks.*.env (wildcards and
    negation)
• Unpack
  • Updated to use unzip and tar commands.

🧰 Toolchains

• JavaScript
  • Added support for Yarn v4.10 catalogs.
  • Fixed an issue where implicit dependencies would sometimes not resolve.

🐞 Fixes

• Fixed local executables in @moonrepo packages not being detected correctly.
• Fixed task job parallelism to partition after tasks have been filtered based on affected state.
• Fixed an issue where env var substitution would not process in the order they were defined.
• Fixed an issue where ctrl+c wouldn't exit when a prompt was waiting for input.
• Fixed an issue where project based task inputs would not be reflected internally in the input
  files/globs list.
• Fixed an issue where running a task that triggers a system/moon error wouldn't output the error
  message. This also aborts the action pipeline correctly now.
• Fixed an issue where errors during project graph building would not be reported correctly.
• Fixed an issue where a negated glob in a file group would not expand properly when used as an
  argument.

⚙️ Internal

• Updated proto to v0.55.2 from 0.53.2
  (view v0.54 changes).
• Updated wasmtime to v37.
• Updated Rust to v1.93.0.
• Updated dependencies.

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • At any time (no schedule defined)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.