chore(deps): Bump @actions/glob from 0.4.0 to 0.6.1 by dependabot[bot] · Pull Request #19427 · getsentry/sentry-javascript

dependabot · 2026-02-19T15:29:09Z

Bumps @actions/glob from 0.4.0 to 0.6.1.

Changelog

Sourced from @actions/glob's changelog.

0.6.1
Fix a bad import for minimatch
0.6.0
Breaking change: Package is now ESM-only
CommonJS consumers must use dynamic import() instead of require()
0.5.1
Bump @actions/core to 2.0.3
0.5.0
Added excludeHiddenFiles option, which is disabled by default to preserve existing behavior #1791: Add glob option to ignore hidden files

Commits

See full diff in compare view

Maintainer changes

This version was pushed to npm by [GitHub Actions](https://www.npmjs.com/~GitHub Actions), a new releaser for @actions/glob since your current version.

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

@dependabot rebase will rebase this PR
@dependabot recreate will recreate this PR, overwriting any edits that have been made to it
@dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
@dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
@dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
@dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

Lms24 · 2026-02-19T17:10:05Z

@dependabot rebase

Bumps [@actions/glob](https://github.com/actions/toolkit/tree/HEAD/packages/glob) from 0.4.0 to 0.6.1. - [Changelog](https://github.com/actions/toolkit/blob/main/packages/glob/RELEASES.md) - [Commits](https://github.com/actions/toolkit/commits/HEAD/packages/glob) --- updated-dependencies: - dependency-name: "@actions/glob" dependency-version: 0.6.1 dependency-type: direct:production update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] <support@github.com>

sentry · 2026-02-19T17:17:27Z

 "@actions/exec": "1.1.1",
 "@actions/github": "^5.0.0",
- "@actions/glob": "0.4.0",
+ "@actions/glob": "0.6.1",


Bug: Upgrading @actions/glob introduces a dependency on @actions/core@^3.0.0, which conflicts with the explicitly pinned direct dependency on @actions/core@1.10.1 in package.json.
_{Severity: HIGH}
Suggested Fix
To resolve the conflict, update the @actions/core dependency in both package.json files to a version compatible with what @actions/glob@0.6.1 expects, for example: "@actions/core": "^3.0.0".
Prompt for AI Agent
Review the code at the location below. A potential bug has been identified by an AI agent. Verify if this is a real issue. If it is, propose a fix; if not, explain why it's not valid. Location: dev-packages/node-overhead-gh-action/package.json#L35 Potential issue: The pull request upgrades the `@actions/glob` dependency to version `0.6.1`. This new version of `@actions/glob` has a transitive dependency on `@actions/core@^3.0.0`. However, the `package.json` files for `node-overhead-gh-action` and `size-limit-gh-action` still explicitly pin the direct dependency to `@actions/core@1.10.1`. This creates a version conflict between the direct dependency (`1.10.1`) and the transitive dependency (`^3.0.0`). This incomplete dependency migration is likely to cause runtime failures if the package manager resolves to version `3.0.0`, as the code was written for the `1.x` API and major version bumps often include breaking changes.
_{Did we get this right? 👍 / 👎 to inform future reviews.}

why would you flag this? We use @actions/core for our actions in the repo. This has nothing to do with @actions/glob

dependabot · 2026-02-19T15:29:09Z

Bumps @actions/glob from 0.4.0 to 0.6.1.

Changelog

Sourced from @actions/glob's changelog.

0.6.1
Fix a bad import for minimatch
0.6.0
Breaking change: Package is now ESM-only
CommonJS consumers must use dynamic import() instead of require()
0.5.1
Bump @actions/core to 2.0.3
0.5.0
Added excludeHiddenFiles option, which is disabled by default to preserve existing behavior #1791: Add glob option to ignore hidden files

Commits

See full diff in compare view

Maintainer changes

This version was pushed to npm by [GitHub Actions](https://www.npmjs.com/~GitHub Actions), a new releaser for @actions/glob since your current version.

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

@dependabot rebase will rebase this PR
@dependabot recreate will recreate this PR, overwriting any edits that have been made to it
@dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
@dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
@dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
@dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

Lms24 · 2026-02-19T17:10:05Z

@dependabot rebase

Bumps [@actions/glob](https://github.com/actions/toolkit/tree/HEAD/packages/glob) from 0.4.0 to 0.6.1. - [Changelog](https://github.com/actions/toolkit/blob/main/packages/glob/RELEASES.md) - [Commits](https://github.com/actions/toolkit/commits/HEAD/packages/glob) --- updated-dependencies: - dependency-name: "@actions/glob" dependency-version: 0.6.1 dependency-type: direct:production update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] <support@github.com>

sentry · 2026-02-19T17:17:27Z

 "@actions/exec": "1.1.1",
 "@actions/github": "^5.0.0",
- "@actions/glob": "0.4.0",
+ "@actions/glob": "0.6.1",


Bug: Upgrading @actions/glob introduces a dependency on @actions/core@^3.0.0, which conflicts with the explicitly pinned direct dependency on @actions/core@1.10.1 in package.json.
_{Severity: HIGH}
Suggested Fix
To resolve the conflict, update the @actions/core dependency in both package.json files to a version compatible with what @actions/glob@0.6.1 expects, for example: "@actions/core": "^3.0.0".
Prompt for AI Agent
Review the code at the location below. A potential bug has been identified by an AI agent. Verify if this is a real issue. If it is, propose a fix; if not, explain why it's not valid. Location: dev-packages/node-overhead-gh-action/package.json#L35 Potential issue: The pull request upgrades the `@actions/glob` dependency to version `0.6.1`. This new version of `@actions/glob` has a transitive dependency on `@actions/core@^3.0.0`. However, the `package.json` files for `node-overhead-gh-action` and `size-limit-gh-action` still explicitly pin the direct dependency to `@actions/core@1.10.1`. This creates a version conflict between the direct dependency (`1.10.1`) and the transitive dependency (`^3.0.0`). This incomplete dependency migration is likely to cause runtime failures if the package manager resolves to version `3.0.0`, as the code was written for the `1.x` API and major version bumps often include breaking changes.
_{Did we get this right? 👍 / 👎 to inform future reviews.}

why would you flag this? We use @actions/core for our actions in the repo. This has nothing to do with @actions/glob

dependabot · 2026-02-19T15:29:09Z

Bumps @actions/glob from 0.4.0 to 0.6.1.

Changelog

Sourced from @actions/glob's changelog.

0.6.1
Fix a bad import for minimatch
0.6.0
Breaking change: Package is now ESM-only
CommonJS consumers must use dynamic import() instead of require()
0.5.1
Bump @actions/core to 2.0.3
0.5.0
Added excludeHiddenFiles option, which is disabled by default to preserve existing behavior #1791: Add glob option to ignore hidden files

Commits

See full diff in compare view

Maintainer changes

This version was pushed to npm by [GitHub Actions](https://www.npmjs.com/~GitHub Actions), a new releaser for @actions/glob since your current version.

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

@dependabot rebase will rebase this PR
@dependabot recreate will recreate this PR, overwriting any edits that have been made to it
@dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
@dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
@dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
@dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

Lms24 · 2026-02-19T17:10:05Z

@dependabot rebase

Bumps [@actions/glob](https://github.com/actions/toolkit/tree/HEAD/packages/glob) from 0.4.0 to 0.6.1. - [Changelog](https://github.com/actions/toolkit/blob/main/packages/glob/RELEASES.md) - [Commits](https://github.com/actions/toolkit/commits/HEAD/packages/glob) --- updated-dependencies: - dependency-name: "@actions/glob" dependency-version: 0.6.1 dependency-type: direct:production update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] <support@github.com>

sentry · 2026-02-19T17:17:27Z

 "@actions/exec": "1.1.1",
 "@actions/github": "^5.0.0",
- "@actions/glob": "0.4.0",
+ "@actions/glob": "0.6.1",


Bug: Upgrading @actions/glob introduces a dependency on @actions/core@^3.0.0, which conflicts with the explicitly pinned direct dependency on @actions/core@1.10.1 in package.json.
_{Severity: HIGH}
Suggested Fix
To resolve the conflict, update the @actions/core dependency in both package.json files to a version compatible with what @actions/glob@0.6.1 expects, for example: "@actions/core": "^3.0.0".
Prompt for AI Agent
Review the code at the location below. A potential bug has been identified by an AI agent. Verify if this is a real issue. If it is, propose a fix; if not, explain why it's not valid. Location: dev-packages/node-overhead-gh-action/package.json#L35 Potential issue: The pull request upgrades the `@actions/glob` dependency to version `0.6.1`. This new version of `@actions/glob` has a transitive dependency on `@actions/core@^3.0.0`. However, the `package.json` files for `node-overhead-gh-action` and `size-limit-gh-action` still explicitly pin the direct dependency to `@actions/core@1.10.1`. This creates a version conflict between the direct dependency (`1.10.1`) and the transitive dependency (`^3.0.0`). This incomplete dependency migration is likely to cause runtime failures if the package manager resolves to version `3.0.0`, as the code was written for the `1.x` API and major version bumps often include breaking changes.
_{Did we get this right? 👍 / 👎 to inform future reviews.}

why would you flag this? We use @actions/core for our actions in the repo. This has nothing to do with @actions/glob

dependabot · 2026-02-19T15:29:09Z

Bumps @actions/glob from 0.4.0 to 0.6.1.

Changelog

Sourced from @actions/glob's changelog.

0.6.1
Fix a bad import for minimatch
0.6.0
Breaking change: Package is now ESM-only
CommonJS consumers must use dynamic import() instead of require()
0.5.1
Bump @actions/core to 2.0.3
0.5.0
Added excludeHiddenFiles option, which is disabled by default to preserve existing behavior #1791: Add glob option to ignore hidden files

Commits

See full diff in compare view

Maintainer changes

This version was pushed to npm by [GitHub Actions](https://www.npmjs.com/~GitHub Actions), a new releaser for @actions/glob since your current version.

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

@dependabot rebase will rebase this PR
@dependabot recreate will recreate this PR, overwriting any edits that have been made to it
@dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
@dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
@dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
@dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

Lms24 · 2026-02-19T17:10:05Z

@dependabot rebase

Bumps [@actions/glob](https://github.com/actions/toolkit/tree/HEAD/packages/glob) from 0.4.0 to 0.6.1. - [Changelog](https://github.com/actions/toolkit/blob/main/packages/glob/RELEASES.md) - [Commits](https://github.com/actions/toolkit/commits/HEAD/packages/glob) --- updated-dependencies: - dependency-name: "@actions/glob" dependency-version: 0.6.1 dependency-type: direct:production update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] <support@github.com>

sentry · 2026-02-19T17:17:27Z

 "@actions/exec": "1.1.1",
 "@actions/github": "^5.0.0",
- "@actions/glob": "0.4.0",
+ "@actions/glob": "0.6.1",


Bug: Upgrading @actions/glob introduces a dependency on @actions/core@^3.0.0, which conflicts with the explicitly pinned direct dependency on @actions/core@1.10.1 in package.json.
_{Severity: HIGH}
Suggested Fix
To resolve the conflict, update the @actions/core dependency in both package.json files to a version compatible with what @actions/glob@0.6.1 expects, for example: "@actions/core": "^3.0.0".
Prompt for AI Agent
Review the code at the location below. A potential bug has been identified by an AI agent. Verify if this is a real issue. If it is, propose a fix; if not, explain why it's not valid. Location: dev-packages/node-overhead-gh-action/package.json#L35 Potential issue: The pull request upgrades the `@actions/glob` dependency to version `0.6.1`. This new version of `@actions/glob` has a transitive dependency on `@actions/core@^3.0.0`. However, the `package.json` files for `node-overhead-gh-action` and `size-limit-gh-action` still explicitly pin the direct dependency to `@actions/core@1.10.1`. This creates a version conflict between the direct dependency (`1.10.1`) and the transitive dependency (`^3.0.0`). This incomplete dependency migration is likely to cause runtime failures if the package manager resolves to version `3.0.0`, as the code was written for the `1.x` API and major version bumps often include breaking changes.
_{Did we get this right? 👍 / 👎 to inform future reviews.}

why would you flag this? We use @actions/core for our actions in the repo. This has nothing to do with @actions/glob

dependabot · 2026-02-19T15:29:09Z

Bumps @actions/glob from 0.4.0 to 0.6.1.

Changelog

Sourced from @actions/glob's changelog.

0.6.1
Fix a bad import for minimatch
0.6.0
Breaking change: Package is now ESM-only
CommonJS consumers must use dynamic import() instead of require()
0.5.1
Bump @actions/core to 2.0.3
0.5.0
Added excludeHiddenFiles option, which is disabled by default to preserve existing behavior #1791: Add glob option to ignore hidden files

Commits

See full diff in compare view

Maintainer changes

This version was pushed to npm by [GitHub Actions](https://www.npmjs.com/~GitHub Actions), a new releaser for @actions/glob since your current version.

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

@dependabot rebase will rebase this PR
@dependabot recreate will recreate this PR, overwriting any edits that have been made to it
@dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
@dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
@dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
@dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

Lms24 · 2026-02-19T17:10:05Z

@dependabot rebase

Bumps [@actions/glob](https://github.com/actions/toolkit/tree/HEAD/packages/glob) from 0.4.0 to 0.6.1. - [Changelog](https://github.com/actions/toolkit/blob/main/packages/glob/RELEASES.md) - [Commits](https://github.com/actions/toolkit/commits/HEAD/packages/glob) --- updated-dependencies: - dependency-name: "@actions/glob" dependency-version: 0.6.1 dependency-type: direct:production update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] <support@github.com>

sentry · 2026-02-19T17:17:27Z

 "@actions/exec": "1.1.1",
 "@actions/github": "^5.0.0",
- "@actions/glob": "0.4.0",
+ "@actions/glob": "0.6.1",


Bug: Upgrading @actions/glob introduces a dependency on @actions/core@^3.0.0, which conflicts with the explicitly pinned direct dependency on @actions/core@1.10.1 in package.json.
_{Severity: HIGH}
Suggested Fix
To resolve the conflict, update the @actions/core dependency in both package.json files to a version compatible with what @actions/glob@0.6.1 expects, for example: "@actions/core": "^3.0.0".
Prompt for AI Agent
Review the code at the location below. A potential bug has been identified by an AI agent. Verify if this is a real issue. If it is, propose a fix; if not, explain why it's not valid. Location: dev-packages/node-overhead-gh-action/package.json#L35 Potential issue: The pull request upgrades the `@actions/glob` dependency to version `0.6.1`. This new version of `@actions/glob` has a transitive dependency on `@actions/core@^3.0.0`. However, the `package.json` files for `node-overhead-gh-action` and `size-limit-gh-action` still explicitly pin the direct dependency to `@actions/core@1.10.1`. This creates a version conflict between the direct dependency (`1.10.1`) and the transitive dependency (`^3.0.0`). This incomplete dependency migration is likely to cause runtime failures if the package manager resolves to version `3.0.0`, as the code was written for the `1.x` API and major version bumps often include breaking changes.
_{Did we get this right? 👍 / 👎 to inform future reviews.}

why would you flag this? We use @actions/core for our actions in the repo. This has nothing to do with @actions/glob

dependabot · 2026-02-19T15:29:09Z

Bumps @actions/glob from 0.4.0 to 0.6.1.

Changelog

Sourced from @actions/glob's changelog.

0.6.1
Fix a bad import for minimatch
0.6.0
Breaking change: Package is now ESM-only
CommonJS consumers must use dynamic import() instead of require()
0.5.1
Bump @actions/core to 2.0.3
0.5.0
Added excludeHiddenFiles option, which is disabled by default to preserve existing behavior #1791: Add glob option to ignore hidden files

Commits

See full diff in compare view

Maintainer changes

This version was pushed to npm by [GitHub Actions](https://www.npmjs.com/~GitHub Actions), a new releaser for @actions/glob since your current version.

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

@dependabot rebase will rebase this PR
@dependabot recreate will recreate this PR, overwriting any edits that have been made to it
@dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
@dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
@dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
@dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

Lms24 · 2026-02-19T17:10:05Z

@dependabot rebase

Bumps [@actions/glob](https://github.com/actions/toolkit/tree/HEAD/packages/glob) from 0.4.0 to 0.6.1. - [Changelog](https://github.com/actions/toolkit/blob/main/packages/glob/RELEASES.md) - [Commits](https://github.com/actions/toolkit/commits/HEAD/packages/glob) --- updated-dependencies: - dependency-name: "@actions/glob" dependency-version: 0.6.1 dependency-type: direct:production update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] <support@github.com>

sentry · 2026-02-19T17:17:27Z

 "@actions/exec": "1.1.1",
 "@actions/github": "^5.0.0",
- "@actions/glob": "0.4.0",
+ "@actions/glob": "0.6.1",


Bug: Upgrading @actions/glob introduces a dependency on @actions/core@^3.0.0, which conflicts with the explicitly pinned direct dependency on @actions/core@1.10.1 in package.json.
_{Severity: HIGH}
Suggested Fix
To resolve the conflict, update the @actions/core dependency in both package.json files to a version compatible with what @actions/glob@0.6.1 expects, for example: "@actions/core": "^3.0.0".
Prompt for AI Agent
Review the code at the location below. A potential bug has been identified by an AI agent. Verify if this is a real issue. If it is, propose a fix; if not, explain why it's not valid. Location: dev-packages/node-overhead-gh-action/package.json#L35 Potential issue: The pull request upgrades the `@actions/glob` dependency to version `0.6.1`. This new version of `@actions/glob` has a transitive dependency on `@actions/core@^3.0.0`. However, the `package.json` files for `node-overhead-gh-action` and `size-limit-gh-action` still explicitly pin the direct dependency to `@actions/core@1.10.1`. This creates a version conflict between the direct dependency (`1.10.1`) and the transitive dependency (`^3.0.0`). This incomplete dependency migration is likely to cause runtime failures if the package manager resolves to version `3.0.0`, as the code was written for the `1.x` API and major version bumps often include breaking changes.
_{Did we get this right? 👍 / 👎 to inform future reviews.}

why would you flag this? We use @actions/core for our actions in the repo. This has nothing to do with @actions/glob

dependabot · 2026-02-19T15:29:09Z

Bumps @actions/glob from 0.4.0 to 0.6.1.

Changelog

Sourced from @actions/glob's changelog.

0.6.1
Fix a bad import for minimatch
0.6.0
Breaking change: Package is now ESM-only
CommonJS consumers must use dynamic import() instead of require()
0.5.1
Bump @actions/core to 2.0.3
0.5.0
Added excludeHiddenFiles option, which is disabled by default to preserve existing behavior #1791: Add glob option to ignore hidden files

Commits

See full diff in compare view

Maintainer changes

This version was pushed to npm by [GitHub Actions](https://www.npmjs.com/~GitHub Actions), a new releaser for @actions/glob since your current version.

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

@dependabot rebase will rebase this PR
@dependabot recreate will recreate this PR, overwriting any edits that have been made to it
@dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
@dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
@dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
@dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

Lms24 · 2026-02-19T17:10:05Z

@dependabot rebase

Bumps [@actions/glob](https://github.com/actions/toolkit/tree/HEAD/packages/glob) from 0.4.0 to 0.6.1. - [Changelog](https://github.com/actions/toolkit/blob/main/packages/glob/RELEASES.md) - [Commits](https://github.com/actions/toolkit/commits/HEAD/packages/glob) --- updated-dependencies: - dependency-name: "@actions/glob" dependency-version: 0.6.1 dependency-type: direct:production update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] <support@github.com>

sentry · 2026-02-19T17:17:27Z

 "@actions/exec": "1.1.1",
 "@actions/github": "^5.0.0",
- "@actions/glob": "0.4.0",
+ "@actions/glob": "0.6.1",


Bug: Upgrading @actions/glob introduces a dependency on @actions/core@^3.0.0, which conflicts with the explicitly pinned direct dependency on @actions/core@1.10.1 in package.json.
_{Severity: HIGH}
Suggested Fix
To resolve the conflict, update the @actions/core dependency in both package.json files to a version compatible with what @actions/glob@0.6.1 expects, for example: "@actions/core": "^3.0.0".
Prompt for AI Agent
Review the code at the location below. A potential bug has been identified by an AI agent. Verify if this is a real issue. If it is, propose a fix; if not, explain why it's not valid. Location: dev-packages/node-overhead-gh-action/package.json#L35 Potential issue: The pull request upgrades the `@actions/glob` dependency to version `0.6.1`. This new version of `@actions/glob` has a transitive dependency on `@actions/core@^3.0.0`. However, the `package.json` files for `node-overhead-gh-action` and `size-limit-gh-action` still explicitly pin the direct dependency to `@actions/core@1.10.1`. This creates a version conflict between the direct dependency (`1.10.1`) and the transitive dependency (`^3.0.0`). This incomplete dependency migration is likely to cause runtime failures if the package manager resolves to version `3.0.0`, as the code was written for the `1.x` API and major version bumps often include breaking changes.
_{Did we get this right? 👍 / 👎 to inform future reviews.}

why would you flag this? We use @actions/core for our actions in the repo. This has nothing to do with @actions/glob

dependabot · 2026-02-19T15:29:09Z

Bumps @actions/glob from 0.4.0 to 0.6.1.

Changelog

Sourced from @actions/glob's changelog.

0.6.1
Fix a bad import for minimatch
0.6.0
Breaking change: Package is now ESM-only
CommonJS consumers must use dynamic import() instead of require()
0.5.1
Bump @actions/core to 2.0.3
0.5.0
Added excludeHiddenFiles option, which is disabled by default to preserve existing behavior #1791: Add glob option to ignore hidden files

Commits

See full diff in compare view

Maintainer changes

This version was pushed to npm by [GitHub Actions](https://www.npmjs.com/~GitHub Actions), a new releaser for @actions/glob since your current version.

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

@dependabot rebase will rebase this PR
@dependabot recreate will recreate this PR, overwriting any edits that have been made to it
@dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
@dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
@dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
@dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

Lms24 · 2026-02-19T17:10:05Z

@dependabot rebase

Bumps [@actions/glob](https://github.com/actions/toolkit/tree/HEAD/packages/glob) from 0.4.0 to 0.6.1. - [Changelog](https://github.com/actions/toolkit/blob/main/packages/glob/RELEASES.md) - [Commits](https://github.com/actions/toolkit/commits/HEAD/packages/glob) --- updated-dependencies: - dependency-name: "@actions/glob" dependency-version: 0.6.1 dependency-type: direct:production update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] <support@github.com>

sentry · 2026-02-19T17:17:27Z

 "@actions/exec": "1.1.1",
 "@actions/github": "^5.0.0",
- "@actions/glob": "0.4.0",
+ "@actions/glob": "0.6.1",


Bug: Upgrading @actions/glob introduces a dependency on @actions/core@^3.0.0, which conflicts with the explicitly pinned direct dependency on @actions/core@1.10.1 in package.json.
_{Severity: HIGH}
Suggested Fix
To resolve the conflict, update the @actions/core dependency in both package.json files to a version compatible with what @actions/glob@0.6.1 expects, for example: "@actions/core": "^3.0.0".
Prompt for AI Agent
Review the code at the location below. A potential bug has been identified by an AI agent. Verify if this is a real issue. If it is, propose a fix; if not, explain why it's not valid. Location: dev-packages/node-overhead-gh-action/package.json#L35 Potential issue: The pull request upgrades the `@actions/glob` dependency to version `0.6.1`. This new version of `@actions/glob` has a transitive dependency on `@actions/core@^3.0.0`. However, the `package.json` files for `node-overhead-gh-action` and `size-limit-gh-action` still explicitly pin the direct dependency to `@actions/core@1.10.1`. This creates a version conflict between the direct dependency (`1.10.1`) and the transitive dependency (`^3.0.0`). This incomplete dependency migration is likely to cause runtime failures if the package manager resolves to version `3.0.0`, as the code was written for the `1.x` API and major version bumps often include breaking changes.
_{Did we get this right? 👍 / 👎 to inform future reviews.}

why would you flag this? We use @actions/core for our actions in the repo. This has nothing to do with @actions/glob

dependabotBot added dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code labels Feb 19, 2026

dependabotBotforce-pushed the dependabot/npm_and_yarn/actions/glob-0.6.1 branch from fd457dd to d34382bCompare February 19, 2026 17:13

sentryBot reviewed Feb 19, 2026
View reviewed changes

Lms24 changed the title ~~feat(deps): bump @actions/glob from 0.4.0 to 0.6.1~~chore(deps): Bump @actions/glob from 0.4.0 to 0.6.1Feb 19, 2026

Lms24 approved these changes Feb 19, 2026
View reviewed changes

Lms24 merged commit ee55e8d into developFeb 19, 2026
208 checks passed

Lms24 deleted the dependabot/npm_and_yarn/actions/glob-0.6.1 branch February 19, 2026 20:24

logaretm mentioned this pull request Feb 20, 2026
meta(changelog): Update changelog for 10.40.0 #19459
Closed

This was referenced Feb 24, 2026
Update dependency @sentry/browser to v10.40.0 danielemery/quizlord-client#304
Merged
Update sentry-javascript monorepo to v10.40.0 danielemery/quizlord-api#419
Merged

github-actionsBot mentioned this pull request Feb 24, 2026
chore(deps): update JavaScript SDK to v10.40.0 getsentry/sentry-react-native#5715
Merged

have-renovateBot mentioned this pull request Feb 24, 2026
chore(deps): update @sentry/node to v10 happyvertical/sdk#827
Merged
1 task

red-hat-konfluxBot mentioned this pull request Feb 24, 2026
fix(deps): update npm minor and patch dependencies RedHatInsights/insights-chrome#3381
Merged
1 task

konflux-stagingBot mentioned this pull request Mar 10, 2026
chore(deps): update dependency @sentry/react to v10.43.0 testcara/konflux-ui#124
Open
1 task

This was referenced Mar 10, 2026
Update dependency @sentry/browser to v10.40.0 naymspace/backpex#1863
Merged
chore(deps): update dependency @sentry/react to v10.43.0 giantswarm/backstage#1361
Merged

github-actionsBot mentioned this pull request Mar 11, 2026
chore(deps): update JavaScript SDK to v10.49.0 glemartret/sentry-dart#1
Open

This was referenced Mar 21, 2026
Update dependency @sentry/node to v10 sderickson/saflib#230
Merged
chore(deps): update dependency @sentry/nextjs to v10.46.0 m1m0zzz/visualizers#16
Merged
chore(deps): update all non-major dependencies MooncellWiki/prts-widgets#286
Merged

red-hat-konfluxBot mentioned this pull request Mar 24, 2026
fix(deps): update dependency @sentry/browser to v10 RedHatInsights/uhc-portal#413
Closed
1 task

renovateBot mentioned this pull request Apr 2, 2026
fix(deps): update dependency @sentry/sveltekit to ^10.45.0 Seenivers/App#612
Merged
1 task