Uh oh!
There was an error while loading. Please reload this page.
chore(deps): bump probot from 11.0.6 to 11.2.0 - #116
Closed
dependabot[bot] wants to merge 1 commit into
Closed
Conversation
Bumps [probot](https://github.com/probot/probot) from 11.0.6 to 11.2.0. - [Release notes](https://github.com/probot/probot/releases) - [Commits](probot/probot@v11.0.6...v11.2.0) Signed-off-by: dependabot[bot] <support@github.com>
ContributorAuthor
Superseded by #117. |
decyjphr added a commit
that referenced
this pull request
Jun 5, 2026
Resolve Dependabot alert #116 - lodash vulnerable to Code Injection via `_.template` imports key names. Updated from ^4.17.21 to ^4.18.1. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
decyjphr added a commit
that referenced
this pull request
Aug 11, 2026
* Handle multiple config changes in a PR or Push event and process them as a batch (#888) * handle multiple changes as a batch * Update index.js Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com> * Update index.js Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com> * depup files in a push * Update index.js Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com> * moved the dedup logic * Update index.js Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com> --------- Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com> * build(deps): bump undici from 7.7.0 to 7.16.0 (#881) Bumps [undici](https://github.com/nodejs/undici) from 7.7.0 to 7.16.0. - [Release notes](https://github.com/nodejs/undici/releases) - [Commits](nodejs/undici@v7.7.0...v7.16.0) --- updated-dependencies: - dependency-name: undici dependency-version: 7.16.0 dependency-type: direct:production update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> * build(deps): bump node-cron from 3.0.3 to 4.2.1 (#865) Bumps [node-cron](https://github.com/merencia/node-cron) from 3.0.3 to 4.2.1. - [Release notes](https://github.com/merencia/node-cron/releases) - [Commits](node-cron/node-cron@v3.0.3...v4.2.1) --- updated-dependencies: - dependency-name: node-cron dependency-version: 4.2.1 dependency-type: direct:production update-type: version-update:semver-major ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Co-authored-by: Yadhav Jayaraman <57544838+decyjphr@users.noreply.github.com> * build(deps): bump @apidevtools/json-schema-ref-parser (#882) Bumps [@apidevtools/json-schema-ref-parser](https://github.com/APIDevTools/json-schema-ref-parser) from 12.0.2 to 14.2.1. - [Release notes](https://github.com/APIDevTools/json-schema-ref-parser/releases) - [Commits](APIDevTools/json-schema-ref-parser@v12.0.2...v14.2.1) --- updated-dependencies: - dependency-name: "@apidevtools/json-schema-ref-parser" dependency-version: 14.2.1 dependency-type: direct:production update-type: version-update:semver-major ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Co-authored-by: Yadhav Jayaraman <57544838+decyjphr@users.noreply.github.com> * build(deps): bump minimatch from 10.0.1 to 10.0.3 (#883) Bumps [minimatch](https://github.com/isaacs/minimatch) from 10.0.1 to 10.0.3. - [Changelog](https://github.com/isaacs/minimatch/blob/main/changelog.md) - [Commits](isaacs/minimatch@v10.0.1...v10.0.3) --- updated-dependencies: - dependency-name: minimatch dependency-version: 10.0.3 dependency-type: direct:production update-type: version-update:semver-patch ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Co-authored-by: Yadhav Jayaraman <57544838+decyjphr@users.noreply.github.com> * build(deps-dev): bump eslint-plugin-import from 2.31.0 to 2.32.0 (#884) Bumps [eslint-plugin-import](https://github.com/import-js/eslint-plugin-import) from 2.31.0 to 2.32.0. - [Release notes](https://github.com/import-js/eslint-plugin-import/releases) - [Changelog](https://github.com/import-js/eslint-plugin-import/blob/main/CHANGELOG.md) - [Commits](import-js/eslint-plugin-import@v2.31.0...v2.32.0) --- updated-dependencies: - dependency-name: eslint-plugin-import dependency-version: 2.32.0 dependency-type: direct:development update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Co-authored-by: Yadhav Jayaraman <57544838+decyjphr@users.noreply.github.com> * ci(deps): bump docker/login-action from 3.5.0 to 3.6.0 (#885) Bumps [docker/login-action](https://github.com/docker/login-action) from 3.5.0 to 3.6.0. - [Release notes](https://github.com/docker/login-action/releases) - [Commits](docker/login-action@184bdaa...5e57cd1) --- updated-dependencies: - dependency-name: docker/login-action dependency-version: 3.6.0 dependency-type: direct:production update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Co-authored-by: Yadhav Jayaraman <57544838+decyjphr@users.noreply.github.com> * ci(deps): bump actions/setup-node from 4 to 6 (#890) Bumps [actions/setup-node](https://github.com/actions/setup-node) from 4 to 6. - [Release notes](https://github.com/actions/setup-node/releases) - [Commits](actions/setup-node@v4...v6) --- updated-dependencies: - dependency-name: actions/setup-node dependency-version: '6' dependency-type: direct:production update-type: version-update:semver-major ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Co-authored-by: Yadhav Jayaraman <57544838+decyjphr@users.noreply.github.com> * build(deps): bump js-yaml in the npm_and_yarn group across 1 directory (#894) Bumps the npm_and_yarn group with 1 update in the / directory: [js-yaml](https://github.com/nodeca/js-yaml). Updates `js-yaml` from 4.1.0 to 4.1.1 - [Changelog](https://github.com/nodeca/js-yaml/blob/master/CHANGELOG.md) - [Commits](nodeca/js-yaml@4.1.0...4.1.1) --- updated-dependencies: - dependency-name: js-yaml dependency-version: 4.1.1 dependency-type: direct:production dependency-group: npm_and_yarn ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Co-authored-by: Yadhav Jayaraman <57544838+decyjphr@users.noreply.github.com> * ci(deps): bump docker/metadata-action from 5.8.0 to 5.10.0 (#897) Bumps [docker/metadata-action](https://github.com/docker/metadata-action) from 5.8.0 to 5.10.0. - [Release notes](https://github.com/docker/metadata-action/releases) - [Commits](docker/metadata-action@c1e5197...c299e40) --- updated-dependencies: - dependency-name: docker/metadata-action dependency-version: 5.10.0 dependency-type: direct:production update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Co-authored-by: Yadhav Jayaraman <57544838+decyjphr@users.noreply.github.com> * ci(deps): bump actions/checkout from 4 to 6 (#898) Bumps [actions/checkout](https://github.com/actions/checkout) from 4 to 6. - [Release notes](https://github.com/actions/checkout/releases) - [Changelog](https://github.com/actions/checkout/blob/main/CHANGELOG.md) - [Commits](actions/checkout@v4...v6) --- updated-dependencies: - dependency-name: actions/checkout dependency-version: '6' dependency-type: direct:production update-type: version-update:semver-major ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> * ci(deps): bump docker/setup-qemu-action from 3.6.0 to 3.7.0 (#899) Bumps [docker/setup-qemu-action](https://github.com/docker/setup-qemu-action) from 3.6.0 to 3.7.0. - [Release notes](https://github.com/docker/setup-qemu-action/releases) - [Commits](docker/setup-qemu-action@2910929...c7c5346) --- updated-dependencies: - dependency-name: docker/setup-qemu-action dependency-version: 3.7.0 dependency-type: direct:production update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Co-authored-by: Yadhav Jayaraman <57544838+decyjphr@users.noreply.github.com> * build(deps): bump the npm_and_yarn group across 1 directory with 2 updates (#904) Bumps the npm_and_yarn group with 2 updates in the / directory: [jws](https://github.com/brianloveswords/node-jws) and [validator](https://github.com/validatorjs/validator.js). Updates `jws` from 3.2.2 to 3.2.3 - [Release notes](https://github.com/brianloveswords/node-jws/releases) - [Changelog](https://github.com/auth0/node-jws/blob/master/CHANGELOG.md) - [Commits](auth0/node-jws@v3.2.2...v3.2.3) Updates `validator` from 13.11.0 to 13.15.26 - [Release notes](https://github.com/validatorjs/validator.js/releases) - [Changelog](https://github.com/validatorjs/validator.js/blob/master/CHANGELOG.md) - [Commits](validatorjs/validator.js@13.11.0...13.15.26) --- updated-dependencies: - dependency-name: jws dependency-version: 3.2.3 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: validator dependency-version: 13.15.26 dependency-type: indirect dependency-group: npm_and_yarn ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> * build(deps): bump qs in the npm_and_yarn group across 1 directory (#912) Bumps the npm_and_yarn group with 1 update in the / directory: [qs](https://github.com/ljharb/qs). Updates `qs` from 6.13.0 to 6.14.1 - [Changelog](https://github.com/ljharb/qs/blob/main/CHANGELOG.md) - [Commits](ljharb/qs@v6.13.0...v6.14.1) --- updated-dependencies: - dependency-name: qs dependency-version: 6.14.1 dependency-type: indirect dependency-group: npm_and_yarn ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> * build(deps): bump qs in the npm_and_yarn group across 1 directory (#913) Bumps the npm_and_yarn group with 1 update in the / directory: [qs](https://github.com/ljharb/qs). Updates `qs` from 6.13.0 to 6.14.1 - [Changelog](https://github.com/ljharb/qs/blob/main/CHANGELOG.md) - [Commits](ljharb/qs@v6.13.0...v6.14.1) --- updated-dependencies: - dependency-name: qs dependency-version: 6.14.1 dependency-type: indirect dependency-group: npm_and_yarn ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> * build(deps): bump octokit from 5.0.3 to 5.0.5 (#905) Bumps [octokit](https://github.com/octokit/octokit.js) from 5.0.3 to 5.0.5. - [Release notes](https://github.com/octokit/octokit.js/releases) - [Commits](octokit/octokit.js@v5.0.3...v5.0.5) --- updated-dependencies: - dependency-name: octokit dependency-version: 5.0.5 dependency-type: direct:production update-type: version-update:semver-patch ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> * build(deps-dev): bump smee-client from 4.3.1 to 5.0.0 (#906) Bumps [smee-client](https://github.com/probot/smee-client) from 4.3.1 to 5.0.0. - [Release notes](https://github.com/probot/smee-client/releases) - [Commits](probot/smee-client@v4.3.1...v5.0.0) --- updated-dependencies: - dependency-name: smee-client dependency-version: 5.0.0 dependency-type: direct:development update-type: version-update:semver-major ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Co-authored-by: Yadhav Jayaraman <57544838+decyjphr@users.noreply.github.com> * build(deps-dev): bump @eslint/eslintrc from 3.3.1 to 3.3.3 (#908) Bumps [@eslint/eslintrc](https://github.com/eslint/eslintrc) from 3.3.1 to 3.3.3. - [Release notes](https://github.com/eslint/eslintrc/releases) - [Changelog](https://github.com/eslint/eslintrc/blob/main/CHANGELOG.md) - [Commits](eslint/eslintrc@v3.3.1...eslintrc-v3.3.3) --- updated-dependencies: - dependency-name: "@eslint/eslintrc" dependency-version: 3.3.3 dependency-type: direct:development update-type: version-update:semver-patch ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Co-authored-by: Yadhav Jayaraman <57544838+decyjphr@users.noreply.github.com> * ci(deps): bump docker/setup-buildx-action from 3.11.1 to 3.12.0 (#909) Bumps [docker/setup-buildx-action](https://github.com/docker/setup-buildx-action) from 3.11.1 to 3.12.0. - [Release notes](https://github.com/docker/setup-buildx-action/releases) - [Commits](docker/setup-buildx-action@e468171...8d2750c) --- updated-dependencies: - dependency-name: docker/setup-buildx-action dependency-version: 3.12.0 dependency-type: direct:production update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Co-authored-by: Yadhav Jayaraman <57544838+decyjphr@users.noreply.github.com> * build(deps): bump undici in the npm_and_yarn group across 1 directory (#921) Bumps the npm_and_yarn group with 1 update in the / directory: [undici](https://github.com/nodejs/undici). Updates `undici` from 7.16.0 to 7.18.2 - [Release notes](https://github.com/nodejs/undici/releases) - [Commits](nodejs/undici@v7.16.0...v7.18.2) --- updated-dependencies: - dependency-name: undici dependency-version: 7.18.2 dependency-type: direct:production dependency-group: npm_and_yarn ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Co-authored-by: Yadhav Jayaraman <57544838+decyjphr@users.noreply.github.com> * ci(deps): bump docker/login-action from 3.6.0 to 3.7.0 (#924) Bumps [docker/login-action](https://github.com/docker/login-action) from 3.6.0 to 3.7.0. - [Release notes](https://github.com/docker/login-action/releases) - [Commits](docker/login-action@5e57cd1...c94ce9f) --- updated-dependencies: - dependency-name: docker/login-action dependency-version: 3.7.0 dependency-type: direct:production update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Co-authored-by: Yadhav Jayaraman <57544838+decyjphr@users.noreply.github.com> * build(deps): bump the npm_and_yarn group across 1 directory with 2 updates (#927) Bumps the npm_and_yarn group with 2 updates in the / directory: [lodash](https://github.com/lodash/lodash) and @isaacs/brace-expansion. Updates `lodash` from 4.17.21 to 4.17.23 - [Release notes](https://github.com/lodash/lodash/releases) - [Commits](lodash/lodash@4.17.21...4.17.23) Updates `@isaacs/brace-expansion` from 5.0.0 to 5.0.1 --- updated-dependencies: - dependency-name: lodash dependency-version: 4.17.23 dependency-type: direct:production dependency-group: npm_and_yarn - dependency-name: "@isaacs/brace-expansion" dependency-version: 5.0.1 dependency-type: indirect dependency-group: npm_and_yarn ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> * [WIP] Upgrade project to support Node.js 22 and 24 (#939) * Initial plan * Upgrade Node.js to 22 and 24 (last 2 LTS versions) Co-authored-by: decyjphr <57544838+decyjphr@users.noreply.github.com> --------- Co-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com> Co-authored-by: decyjphr <57544838+decyjphr@users.noreply.github.com> * Fix Dependabot CI: correct actor check from `dependabot` to `dependabot[bot]` (#940) * Initial plan * Initial plan for fixing CI workflow test Co-authored-by: decyjphr <57544838+decyjphr@users.noreply.github.com> * Fix Dependabot actor check in node-ci.yml workflow The `if` condition used `'dependabot'` but Dependabot's actual GitHub actor username is `'dependabot[bot]'`. This caused the test job to run for Dependabot PRs when it should be skipped, resulting in npm install failures due to ESLint 10 peer dependency conflicts. Co-authored-by: decyjphr <57544838+decyjphr@users.noreply.github.com> --------- Co-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com> Co-authored-by: decyjphr <57544838+decyjphr@users.noreply.github.com> * Refactor advanced CodeQL workflow steps (#941) * Added support for proxy servers in all execution environments (#917) * Added support for proxy servers in all execution environments * Update index.js Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com> --------- Co-authored-by: Yadhav Jayaraman <57544838+decyjphr@users.noreply.github.com> Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com> * build(deps): bump probot from 13.4.4 to 14.2.4 (#907) * build(deps): bump probot from 13.4.4 to 14.2.4 Bumps [probot](https://github.com/probot/probot) from 13.4.4 to 14.2.4. - [Release notes](https://github.com/probot/probot/releases) - [Commits](probot/probot@v13.4.4...v14.2.4) --- updated-dependencies: - dependency-name: probot dependency-version: 14.2.4 dependency-type: direct:production update-type: version-update:semver-major ... Signed-off-by: dependabot[bot] <support@github.com> * Fix test suite failures caused by ESM-only `@octokit/core` and `probot` dependencies (#938) * Initial plan * Initial plan for fixing failing test suites Co-authored-by: decyjphr <57544838+decyjphr@users.noreply.github.com> * Fix failing test suites caused by ESM-only dependencies Co-authored-by: decyjphr <57544838+decyjphr@users.noreply.github.com> --------- Co-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com> Co-authored-by: decyjphr <57544838+decyjphr@users.noreply.github.com> * Update minimatch dependency version to 10.2.1 * Fix devcontainer configuration and update dependencies (#942) * fix devcontainer * Update .devcontainer/Dockerfile Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com> * Update .devcontainer/Dockerfile Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com> * Update .devcontainer/devcontainer.json Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com> --------- Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com> --------- Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Co-authored-by: Yadhav Jayaraman <57544838+decyjphr@users.noreply.github.com> Co-authored-by: Copilot <198982749+Copilot@users.noreply.github.com> Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com> * fix: prevent race conditions by creating new objects for repository configurations (#943) * fix: prevent race conditions by creating new objects for repository configurations Signed-off-by: Jan Bronicki <janbronicki@microsoft.com> * Update lib/plugins/repository.js Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com> --------- Signed-off-by: Jan Bronicki <janbronicki@microsoft.com> Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com> * Change helm defaults to be more newcomer friendly (#919) * Updated container port to match the port exposed by the application inside the container * Added examples for common environment variables * Changed validators to be examples in comments to avoid needing to override * Changed min replica count to 1 for more cost effective defaults * Updated min replica default in docs * Updated service port default in docs * Updated validator defaults in docs * Updated restricted repos include default in docs * Update helm/safe-settings/values.yaml Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com> * Update helm/safe-settings/values.yaml Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com> * Updated README to match the new default value Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com> --------- Co-authored-by: Yadhav Jayaraman <57544838+decyjphr@users.noreply.github.com> Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com> * fix: add HOST=0.0.0.0 env to Dockerfile for probot v14 compatibility (#948) Agent-Logs-Url: https://github.com/github/safe-settings/sessions/6a4f5799-ea1f-4900-a659-b492dbdf5cfc Co-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com> Co-authored-by: decyjphr <57544838+decyjphr@users.noreply.github.com> * fix: migrate all octokit API calls to .rest namespace for probot v14 compatibility (#949) * fix: override NODE_ENV=development in functional test and add retry logic Co-authored-by: decyjphr <57544838+decyjphr@users.noreply.github.com> Agent-Logs-Url: https://github.com/github/safe-settings/sessions/97b10121-f26e-44c0-86e6-3ede047fe176 * fix: add --fail to curl and || true to docker logs in functional test Co-authored-by: decyjphr <57544838+decyjphr@users.noreply.github.com> Agent-Logs-Url: https://github.com/github/safe-settings/sessions/97b10121-f26e-44c0-86e6-3ede047fe176 * fix: migrate all octokit API calls to .rest namespace for probot v14 compatibility and revert Dockerfile ENV HOST Co-authored-by: decyjphr <57544838+decyjphr@users.noreply.github.com> Agent-Logs-Url: https://github.com/github/safe-settings/sessions/179c9d77-8ca0-4098-9017-8a255df170f9 * Update lib/plugins/repository.js Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com> * fix: address review feedback - NopCommand repo arg, milestones mock, teams test error propagation Co-authored-by: decyjphr <57544838+decyjphr@users.noreply.github.com> Agent-Logs-Url: https://github.com/github/safe-settings/sessions/d9420b15-2cca-40a3-a30b-869df73487f1 --------- Co-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com> Co-authored-by: decyjphr <57544838+decyjphr@users.noreply.github.com> Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com> * Add HOST environment variable to Dockerfile (#950) * docs: add troubleshooting section for Docker build and runtime issues (#951) * build(deps): bump undici in the npm_and_yarn group across 1 directory (#947) Bumps the npm_and_yarn group with 1 update in the / directory: [undici](https://github.com/nodejs/undici). Updates `undici` from 7.22.0 to 7.24.1 - [Release notes](https://github.com/nodejs/undici/releases) - [Commits](nodejs/undici@v7.22.0...v7.24.1) --- updated-dependencies: - dependency-name: undici dependency-version: 7.24.1 dependency-type: direct:production dependency-group: npm_and_yarn ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Co-authored-by: Yadhav Jayaraman <57544838+decyjphr@users.noreply.github.com> * build(deps-dev): bump brace-expansion Bumps the npm_and_yarn group with 1 update in the / directory: [brace-expansion](https://github.com/juliangruber/brace-expansion). Updates `brace-expansion` from 1.1.12 to 1.1.13 - [Release notes](https://github.com/juliangruber/brace-expansion/releases) - [Commits](juliangruber/brace-expansion@v1.1.12...v1.1.13) --- updated-dependencies: - dependency-name: brace-expansion dependency-version: 1.1.13 dependency-type: indirect dependency-group: npm_and_yarn ... Signed-off-by: dependabot[bot] <support@github.com> * build(deps): bump proxy-from-env from 1.1.0 to 2.0.0 (#934) Bumps [proxy-from-env](https://github.com/Rob--W/proxy-from-env) from 1.1.0 to 2.0.0. - [Release notes](https://github.com/Rob--W/proxy-from-env/releases) - [Commits](Rob--W/proxy-from-env@v1.1.0...v2.0.0) --- updated-dependencies: - dependency-name: proxy-from-env dependency-version: 2.0.0 dependency-type: direct:production update-type: version-update:semver-major ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> * ci(deps): bump docker/build-push-action from 6.18.0 to 6.19.2 (#935) Bumps [docker/build-push-action](https://github.com/docker/build-push-action) from 6.18.0 to 6.19.2. - [Release notes](https://github.com/docker/build-push-action/releases) - [Commits](docker/build-push-action@2634353...10e90e3) --- updated-dependencies: - dependency-name: docker/build-push-action dependency-version: 6.19.2 dependency-type: direct:production update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Co-authored-by: Yadhav Jayaraman <57544838+decyjphr@users.noreply.github.com> * build(deps): bump path-to-regexp (#953) Bumps the npm_and_yarn group with 1 update in the / directory: [path-to-regexp](https://github.com/pillarjs/path-to-regexp). Updates `path-to-regexp` from 8.3.0 to 8.4.0 - [Release notes](https://github.com/pillarjs/path-to-regexp/releases) - [Changelog](https://github.com/pillarjs/path-to-regexp/blob/master/History.md) - [Commits](pillarjs/path-to-regexp@v8.3.0...v8.4.0) --- updated-dependencies: - dependency-name: path-to-regexp dependency-version: 8.4.0 dependency-type: indirect dependency-group: npm_and_yarn ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> * build(deps): bump the npm_and_yarn group across 1 directory with 2 updates (#954) Bumps the npm_and_yarn group with 2 updates in the / directory: [path-to-regexp](https://github.com/pillarjs/path-to-regexp) and [yaml](https://github.com/eemeli/yaml). Updates `path-to-regexp` from 8.3.0 to 8.4.0 - [Release notes](https://github.com/pillarjs/path-to-regexp/releases) - [Changelog](https://github.com/pillarjs/path-to-regexp/blob/master/History.md) - [Commits](pillarjs/path-to-regexp@v8.3.0...v8.4.0) Updates `yaml` from 2.8.2 to 2.8.3 - [Release notes](https://github.com/eemeli/yaml/releases) - [Commits](eemeli/yaml@v2.8.2...v2.8.3) --- updated-dependencies: - dependency-name: path-to-regexp dependency-version: 8.4.0 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: yaml dependency-version: 2.8.3 dependency-type: indirect dependency-group: npm_and_yarn ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Co-authored-by: Yadhav Jayaraman <57544838+decyjphr@users.noreply.github.com> * Remove non-deterministic `npm install -g npm` from devcontainer Dockerfile (#956) * Initial plan * Fix alert #129: Remove non-deterministic npm install from devcontainer Dockerfile Agent-Logs-Url: https://github.com/github/safe-settings/sessions/0af97764-5b14-4195-ad8a-6b8adf723453 Co-authored-by: decyjphr <57544838+decyjphr@users.noreply.github.com> * Fix typo in devcontainer Dockerfile comment (Intall -> Install) Agent-Logs-Url: https://github.com/github/safe-settings/sessions/0af97764-5b14-4195-ad8a-6b8adf723453 Co-authored-by: decyjphr <57544838+decyjphr@users.noreply.github.com> --------- Co-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com> Co-authored-by: decyjphr <57544838+decyjphr@users.noreply.github.com> * Pin Dockerfile base image to SHA256 digest (#957) * Initial plan * Pin Docker base image to SHA256 digest to fix alert #128 Agent-Logs-Url: https://github.com/github/safe-settings/sessions/afcb39cb-64ea-43c7-8b49-200dd166ad5f Co-authored-by: decyjphr <57544838+decyjphr@users.noreply.github.com> --------- Co-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com> Co-authored-by: decyjphr <57544838+decyjphr@users.noreply.github.com> * Use `npm ci` instead of `npm install` in CI workflow (#958) * Initial plan * Replace npm install with npm ci in node-ci.yml workflow Agent-Logs-Url: https://github.com/github/safe-settings/sessions/4460185b-428a-48f4-a8b9-471226ccbf58 Co-authored-by: decyjphr <57544838+decyjphr@users.noreply.github.com> --------- Co-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com> Co-authored-by: decyjphr <57544838+decyjphr@users.noreply.github.com> * Replace npm install with npm ci in workflow (#960) * Replace npm install with npm ci in workflow * Replace npm install with npm ci in workflow * Bug/issue 465 (#970) * fix: apply org-level settings before loading repository configurations * fix: enhance descriptions and add new properties for security features in settings.json * fix: update description for deprecated squash-merge commit title property in settings.json * Update api endpoint version * Add JSON schemas for safe-settings configuration at repo, org, and suborg levels - Introduced `repos.json` schema for repository-level safe-settings overrides. - Updated `settings.json` schema to include additional properties for org-level configurations. - Created `suborgs.json` schema for suborg-level safe-settings configuration. - Enhanced the build script to dereference all schemas and handle errors during the process. * chores: fix branches tests * fix(build-schema): enhance schema dereferencing with GitHub API spec * Update docs/github-settings/5. branch-protection.md Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com> * Update index.js Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com> * fix(schema): simplify description for force_create property --------- Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com> * Bug/issue 842 (#928) * fix: apply org-level settings before loading repository configurations * fix: enhance descriptions and add new properties for security features in settings.json * fix: update description for deprecated squash-merge commit title property in settings.json * test: update branch protection tests to handle null restrictions and enforce_admins * fix: normalize branch protection restrictions and preserve existing settings * fix: update GitHub API calls to use the correct namespace for branch protection methods --------- Co-authored-by: Yadhav Jayaraman <57544838+decyjphr@users.noreply.github.com> * Fix custom_properties diffing when config uses `property_name` (#978) * Initial plan * Handle alternate custom property name shapes in normalize * Add explicit object guard in custom property normalization * Support property_name in custom_properties config entries * Polish custom properties test descriptions --------- Co-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com> * fix(variables): add noop mode support (#926) * feat(variables): add noop mode support - Add noop mode support to Variables plugin add/remove/update methods - Return NopCommand instead of making API calls when nop=true - Add comprehensive tests for noop mode behavior Signed-off-by: Kyle Harding <kyle@balena.io> * refactor(variables): align with Diffable contract pattern Refactor Variables plugin to match the single-item Diffable contract used by labels, milestones, and other plugins. The previous update() reimplemented sync() logic internally; now each method handles one item and lets Diffable.sync() orchestrate iteration. - Simplify update() from 90-line array-diffing to single-item PATCH - Simplify changed() from JSON.stringify comparison to value check - Remove getChanged(), lodash dependency, .then(res=>res) no-ops - Match labels.js nop return pattern: Promise.resolve([NopCommand]) - Fix inconsistent toUpperCase() between add/remove/update - Let errors propagate to Diffable.sync() instead of swallowing - Normalize find() to strip API metadata fields (created_at, etc.) Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com> Signed-off-by: Kyle Harding <kyle@balena.io> --------- Signed-off-by: Kyle Harding <kyle@balena.io> Co-authored-by: Claude Opus 4.6 (1M context) <noreply@anthropic.com> * fix: update lodash to ^4.18.1 to fix code injection vulnerability (#992) Resolve Dependabot alert #116 - lodash vulnerable to Code Injection via `_.template` imports key names. Updated from ^4.17.21 to ^4.18.1. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> --------- Signed-off-by: dependabot[bot] <support@github.com> Signed-off-by: Jan Bronicki <janbronicki@microsoft.com> Signed-off-by: Kyle Harding <kyle@balena.io> Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Co-authored-by: Copilot <198982749+Copilot@users.noreply.github.com> Co-authored-by: Tyler Ohlsen <tylerohlsen@hotmail.com> Co-authored-by: Jan Bronicki <janbronicki@microsoft.com> Co-authored-by: Brett Logan <lindluni@github.com> Co-authored-by: Madis Kõosaar <madis.koosaar@solidify.dev> Co-authored-by: Kyle Harding <kyle@balena.io> Co-authored-by: Claude Opus 4.6 (1M context) <noreply@anthropic.com> Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> Copilot-Session: dfabae4c-7df4-49eb-bffa-82f104ac8316
decyjphr added a commit
that referenced
this pull request
Aug 19, 2026
…sion (#1066) * Handle multiple config changes in a PR or Push event and process them as a batch (#888) * handle multiple changes as a batch * Update index.js Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com> * Update index.js Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com> * depup files in a push * Update index.js Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com> * moved the dedup logic * Update index.js Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com> --------- Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com> * build(deps): bump undici from 7.7.0 to 7.16.0 (#881) Bumps [undici](https://github.com/nodejs/undici) from 7.7.0 to 7.16.0. - [Release notes](https://github.com/nodejs/undici/releases) - [Commits](nodejs/undici@v7.7.0...v7.16.0) --- updated-dependencies: - dependency-name: undici dependency-version: 7.16.0 dependency-type: direct:production update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> * build(deps): bump node-cron from 3.0.3 to 4.2.1 (#865) Bumps [node-cron](https://github.com/merencia/node-cron) from 3.0.3 to 4.2.1. - [Release notes](https://github.com/merencia/node-cron/releases) - [Commits](node-cron/node-cron@v3.0.3...v4.2.1) --- updated-dependencies: - dependency-name: node-cron dependency-version: 4.2.1 dependency-type: direct:production update-type: version-update:semver-major ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Co-authored-by: Yadhav Jayaraman <57544838+decyjphr@users.noreply.github.com> * build(deps): bump @apidevtools/json-schema-ref-parser (#882) Bumps [@apidevtools/json-schema-ref-parser](https://github.com/APIDevTools/json-schema-ref-parser) from 12.0.2 to 14.2.1. - [Release notes](https://github.com/APIDevTools/json-schema-ref-parser/releases) - [Commits](APIDevTools/json-schema-ref-parser@v12.0.2...v14.2.1) --- updated-dependencies: - dependency-name: "@apidevtools/json-schema-ref-parser" dependency-version: 14.2.1 dependency-type: direct:production update-type: version-update:semver-major ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Co-authored-by: Yadhav Jayaraman <57544838+decyjphr@users.noreply.github.com> * build(deps): bump minimatch from 10.0.1 to 10.0.3 (#883) Bumps [minimatch](https://github.com/isaacs/minimatch) from 10.0.1 to 10.0.3. - [Changelog](https://github.com/isaacs/minimatch/blob/main/changelog.md) - [Commits](isaacs/minimatch@v10.0.1...v10.0.3) --- updated-dependencies: - dependency-name: minimatch dependency-version: 10.0.3 dependency-type: direct:production update-type: version-update:semver-patch ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Co-authored-by: Yadhav Jayaraman <57544838+decyjphr@users.noreply.github.com> * build(deps-dev): bump eslint-plugin-import from 2.31.0 to 2.32.0 (#884) Bumps [eslint-plugin-import](https://github.com/import-js/eslint-plugin-import) from 2.31.0 to 2.32.0. - [Release notes](https://github.com/import-js/eslint-plugin-import/releases) - [Changelog](https://github.com/import-js/eslint-plugin-import/blob/main/CHANGELOG.md) - [Commits](import-js/eslint-plugin-import@v2.31.0...v2.32.0) --- updated-dependencies: - dependency-name: eslint-plugin-import dependency-version: 2.32.0 dependency-type: direct:development update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Co-authored-by: Yadhav Jayaraman <57544838+decyjphr@users.noreply.github.com> * ci(deps): bump docker/login-action from 3.5.0 to 3.6.0 (#885) Bumps [docker/login-action](https://github.com/docker/login-action) from 3.5.0 to 3.6.0. - [Release notes](https://github.com/docker/login-action/releases) - [Commits](docker/login-action@184bdaa...5e57cd1) --- updated-dependencies: - dependency-name: docker/login-action dependency-version: 3.6.0 dependency-type: direct:production update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Co-authored-by: Yadhav Jayaraman <57544838+decyjphr@users.noreply.github.com> * ci(deps): bump actions/setup-node from 4 to 6 (#890) Bumps [actions/setup-node](https://github.com/actions/setup-node) from 4 to 6. - [Release notes](https://github.com/actions/setup-node/releases) - [Commits](actions/setup-node@v4...v6) --- updated-dependencies: - dependency-name: actions/setup-node dependency-version: '6' dependency-type: direct:production update-type: version-update:semver-major ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Co-authored-by: Yadhav Jayaraman <57544838+decyjphr@users.noreply.github.com> * build(deps): bump js-yaml in the npm_and_yarn group across 1 directory (#894) Bumps the npm_and_yarn group with 1 update in the / directory: [js-yaml](https://github.com/nodeca/js-yaml). Updates `js-yaml` from 4.1.0 to 4.1.1 - [Changelog](https://github.com/nodeca/js-yaml/blob/master/CHANGELOG.md) - [Commits](nodeca/js-yaml@4.1.0...4.1.1) --- updated-dependencies: - dependency-name: js-yaml dependency-version: 4.1.1 dependency-type: direct:production dependency-group: npm_and_yarn ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Co-authored-by: Yadhav Jayaraman <57544838+decyjphr@users.noreply.github.com> * ci(deps): bump docker/metadata-action from 5.8.0 to 5.10.0 (#897) Bumps [docker/metadata-action](https://github.com/docker/metadata-action) from 5.8.0 to 5.10.0. - [Release notes](https://github.com/docker/metadata-action/releases) - [Commits](docker/metadata-action@c1e5197...c299e40) --- updated-dependencies: - dependency-name: docker/metadata-action dependency-version: 5.10.0 dependency-type: direct:production update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Co-authored-by: Yadhav Jayaraman <57544838+decyjphr@users.noreply.github.com> * ci(deps): bump actions/checkout from 4 to 6 (#898) Bumps [actions/checkout](https://github.com/actions/checkout) from 4 to 6. - [Release notes](https://github.com/actions/checkout/releases) - [Changelog](https://github.com/actions/checkout/blob/main/CHANGELOG.md) - [Commits](actions/checkout@v4...v6) --- updated-dependencies: - dependency-name: actions/checkout dependency-version: '6' dependency-type: direct:production update-type: version-update:semver-major ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> * ci(deps): bump docker/setup-qemu-action from 3.6.0 to 3.7.0 (#899) Bumps [docker/setup-qemu-action](https://github.com/docker/setup-qemu-action) from 3.6.0 to 3.7.0. - [Release notes](https://github.com/docker/setup-qemu-action/releases) - [Commits](docker/setup-qemu-action@2910929...c7c5346) --- updated-dependencies: - dependency-name: docker/setup-qemu-action dependency-version: 3.7.0 dependency-type: direct:production update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Co-authored-by: Yadhav Jayaraman <57544838+decyjphr@users.noreply.github.com> * build(deps): bump the npm_and_yarn group across 1 directory with 2 updates (#904) Bumps the npm_and_yarn group with 2 updates in the / directory: [jws](https://github.com/brianloveswords/node-jws) and [validator](https://github.com/validatorjs/validator.js). Updates `jws` from 3.2.2 to 3.2.3 - [Release notes](https://github.com/brianloveswords/node-jws/releases) - [Changelog](https://github.com/auth0/node-jws/blob/master/CHANGELOG.md) - [Commits](auth0/node-jws@v3.2.2...v3.2.3) Updates `validator` from 13.11.0 to 13.15.26 - [Release notes](https://github.com/validatorjs/validator.js/releases) - [Changelog](https://github.com/validatorjs/validator.js/blob/master/CHANGELOG.md) - [Commits](validatorjs/validator.js@13.11.0...13.15.26) --- updated-dependencies: - dependency-name: jws dependency-version: 3.2.3 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: validator dependency-version: 13.15.26 dependency-type: indirect dependency-group: npm_and_yarn ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> * build(deps): bump qs in the npm_and_yarn group across 1 directory (#912) Bumps the npm_and_yarn group with 1 update in the / directory: [qs](https://github.com/ljharb/qs). Updates `qs` from 6.13.0 to 6.14.1 - [Changelog](https://github.com/ljharb/qs/blob/main/CHANGELOG.md) - [Commits](ljharb/qs@v6.13.0...v6.14.1) --- updated-dependencies: - dependency-name: qs dependency-version: 6.14.1 dependency-type: indirect dependency-group: npm_and_yarn ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> * build(deps): bump qs in the npm_and_yarn group across 1 directory (#913) Bumps the npm_and_yarn group with 1 update in the / directory: [qs](https://github.com/ljharb/qs). Updates `qs` from 6.13.0 to 6.14.1 - [Changelog](https://github.com/ljharb/qs/blob/main/CHANGELOG.md) - [Commits](ljharb/qs@v6.13.0...v6.14.1) --- updated-dependencies: - dependency-name: qs dependency-version: 6.14.1 dependency-type: indirect dependency-group: npm_and_yarn ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> * build(deps): bump octokit from 5.0.3 to 5.0.5 (#905) Bumps [octokit](https://github.com/octokit/octokit.js) from 5.0.3 to 5.0.5. - [Release notes](https://github.com/octokit/octokit.js/releases) - [Commits](octokit/octokit.js@v5.0.3...v5.0.5) --- updated-dependencies: - dependency-name: octokit dependency-version: 5.0.5 dependency-type: direct:production update-type: version-update:semver-patch ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> * build(deps-dev): bump smee-client from 4.3.1 to 5.0.0 (#906) Bumps [smee-client](https://github.com/probot/smee-client) from 4.3.1 to 5.0.0. - [Release notes](https://github.com/probot/smee-client/releases) - [Commits](probot/smee-client@v4.3.1...v5.0.0) --- updated-dependencies: - dependency-name: smee-client dependency-version: 5.0.0 dependency-type: direct:development update-type: version-update:semver-major ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Co-authored-by: Yadhav Jayaraman <57544838+decyjphr@users.noreply.github.com> * build(deps-dev): bump @eslint/eslintrc from 3.3.1 to 3.3.3 (#908) Bumps [@eslint/eslintrc](https://github.com/eslint/eslintrc) from 3.3.1 to 3.3.3. - [Release notes](https://github.com/eslint/eslintrc/releases) - [Changelog](https://github.com/eslint/eslintrc/blob/main/CHANGELOG.md) - [Commits](eslint/eslintrc@v3.3.1...eslintrc-v3.3.3) --- updated-dependencies: - dependency-name: "@eslint/eslintrc" dependency-version: 3.3.3 dependency-type: direct:development update-type: version-update:semver-patch ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Co-authored-by: Yadhav Jayaraman <57544838+decyjphr@users.noreply.github.com> * ci(deps): bump docker/setup-buildx-action from 3.11.1 to 3.12.0 (#909) Bumps [docker/setup-buildx-action](https://github.com/docker/setup-buildx-action) from 3.11.1 to 3.12.0. - [Release notes](https://github.com/docker/setup-buildx-action/releases) - [Commits](docker/setup-buildx-action@e468171...8d2750c) --- updated-dependencies: - dependency-name: docker/setup-buildx-action dependency-version: 3.12.0 dependency-type: direct:production update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Co-authored-by: Yadhav Jayaraman <57544838+decyjphr@users.noreply.github.com> * build(deps): bump undici in the npm_and_yarn group across 1 directory (#921) Bumps the npm_and_yarn group with 1 update in the / directory: [undici](https://github.com/nodejs/undici). Updates `undici` from 7.16.0 to 7.18.2 - [Release notes](https://github.com/nodejs/undici/releases) - [Commits](nodejs/undici@v7.16.0...v7.18.2) --- updated-dependencies: - dependency-name: undici dependency-version: 7.18.2 dependency-type: direct:production dependency-group: npm_and_yarn ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Co-authored-by: Yadhav Jayaraman <57544838+decyjphr@users.noreply.github.com> * ci(deps): bump docker/login-action from 3.6.0 to 3.7.0 (#924) Bumps [docker/login-action](https://github.com/docker/login-action) from 3.6.0 to 3.7.0. - [Release notes](https://github.com/docker/login-action/releases) - [Commits](docker/login-action@5e57cd1...c94ce9f) --- updated-dependencies: - dependency-name: docker/login-action dependency-version: 3.7.0 dependency-type: direct:production update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Co-authored-by: Yadhav Jayaraman <57544838+decyjphr@users.noreply.github.com> * build(deps): bump the npm_and_yarn group across 1 directory with 2 updates (#927) Bumps the npm_and_yarn group with 2 updates in the / directory: [lodash](https://github.com/lodash/lodash) and @isaacs/brace-expansion. Updates `lodash` from 4.17.21 to 4.17.23 - [Release notes](https://github.com/lodash/lodash/releases) - [Commits](lodash/lodash@4.17.21...4.17.23) Updates `@isaacs/brace-expansion` from 5.0.0 to 5.0.1 --- updated-dependencies: - dependency-name: lodash dependency-version: 4.17.23 dependency-type: direct:production dependency-group: npm_and_yarn - dependency-name: "@isaacs/brace-expansion" dependency-version: 5.0.1 dependency-type: indirect dependency-group: npm_and_yarn ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> * [WIP] Upgrade project to support Node.js 22 and 24 (#939) * Initial plan * Upgrade Node.js to 22 and 24 (last 2 LTS versions) Co-authored-by: decyjphr <57544838+decyjphr@users.noreply.github.com> --------- Co-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com> Co-authored-by: decyjphr <57544838+decyjphr@users.noreply.github.com> * Fix Dependabot CI: correct actor check from `dependabot` to `dependabot[bot]` (#940) * Initial plan * Initial plan for fixing CI workflow test Co-authored-by: decyjphr <57544838+decyjphr@users.noreply.github.com> * Fix Dependabot actor check in node-ci.yml workflow The `if` condition used `'dependabot'` but Dependabot's actual GitHub actor username is `'dependabot[bot]'`. This caused the test job to run for Dependabot PRs when it should be skipped, resulting in npm install failures due to ESLint 10 peer dependency conflicts. Co-authored-by: decyjphr <57544838+decyjphr@users.noreply.github.com> --------- Co-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com> Co-authored-by: decyjphr <57544838+decyjphr@users.noreply.github.com> * Refactor advanced CodeQL workflow steps (#941) * Added support for proxy servers in all execution environments (#917) * Added support for proxy servers in all execution environments * Update index.js Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com> --------- Co-authored-by: Yadhav Jayaraman <57544838+decyjphr@users.noreply.github.com> Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com> * build(deps): bump probot from 13.4.4 to 14.2.4 (#907) * build(deps): bump probot from 13.4.4 to 14.2.4 Bumps [probot](https://github.com/probot/probot) from 13.4.4 to 14.2.4. - [Release notes](https://github.com/probot/probot/releases) - [Commits](probot/probot@v13.4.4...v14.2.4) --- updated-dependencies: - dependency-name: probot dependency-version: 14.2.4 dependency-type: direct:production update-type: version-update:semver-major ... Signed-off-by: dependabot[bot] <support@github.com> * Fix test suite failures caused by ESM-only `@octokit/core` and `probot` dependencies (#938) * Initial plan * Initial plan for fixing failing test suites Co-authored-by: decyjphr <57544838+decyjphr@users.noreply.github.com> * Fix failing test suites caused by ESM-only dependencies Co-authored-by: decyjphr <57544838+decyjphr@users.noreply.github.com> --------- Co-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com> Co-authored-by: decyjphr <57544838+decyjphr@users.noreply.github.com> * Update minimatch dependency version to 10.2.1 * Fix devcontainer configuration and update dependencies (#942) * fix devcontainer * Update .devcontainer/Dockerfile Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com> * Update .devcontainer/Dockerfile Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com> * Update .devcontainer/devcontainer.json Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com> --------- Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com> --------- Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Co-authored-by: Yadhav Jayaraman <57544838+decyjphr@users.noreply.github.com> Co-authored-by: Copilot <198982749+Copilot@users.noreply.github.com> Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com> * fix: prevent race conditions by creating new objects for repository configurations (#943) * fix: prevent race conditions by creating new objects for repository configurations Signed-off-by: Jan Bronicki <janbronicki@microsoft.com> * Update lib/plugins/repository.js Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com> --------- Signed-off-by: Jan Bronicki <janbronicki@microsoft.com> Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com> * Change helm defaults to be more newcomer friendly (#919) * Updated container port to match the port exposed by the application inside the container * Added examples for common environment variables * Changed validators to be examples in comments to avoid needing to override * Changed min replica count to 1 for more cost effective defaults * Updated min replica default in docs * Updated service port default in docs * Updated validator defaults in docs * Updated restricted repos include default in docs * Update helm/safe-settings/values.yaml Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com> * Update helm/safe-settings/values.yaml Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com> * Updated README to match the new default value Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com> --------- Co-authored-by: Yadhav Jayaraman <57544838+decyjphr@users.noreply.github.com> Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com> * fix: add HOST=0.0.0.0 env to Dockerfile for probot v14 compatibility (#948) Agent-Logs-Url: https://github.com/github/safe-settings/sessions/6a4f5799-ea1f-4900-a659-b492dbdf5cfc Co-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com> Co-authored-by: decyjphr <57544838+decyjphr@users.noreply.github.com> * fix: migrate all octokit API calls to .rest namespace for probot v14 compatibility (#949) * fix: override NODE_ENV=development in functional test and add retry logic Co-authored-by: decyjphr <57544838+decyjphr@users.noreply.github.com> Agent-Logs-Url: https://github.com/github/safe-settings/sessions/97b10121-f26e-44c0-86e6-3ede047fe176 * fix: add --fail to curl and || true to docker logs in functional test Co-authored-by: decyjphr <57544838+decyjphr@users.noreply.github.com> Agent-Logs-Url: https://github.com/github/safe-settings/sessions/97b10121-f26e-44c0-86e6-3ede047fe176 * fix: migrate all octokit API calls to .rest namespace for probot v14 compatibility and revert Dockerfile ENV HOST Co-authored-by: decyjphr <57544838+decyjphr@users.noreply.github.com> Agent-Logs-Url: https://github.com/github/safe-settings/sessions/179c9d77-8ca0-4098-9017-8a255df170f9 * Update lib/plugins/repository.js Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com> * fix: address review feedback - NopCommand repo arg, milestones mock, teams test error propagation Co-authored-by: decyjphr <57544838+decyjphr@users.noreply.github.com> Agent-Logs-Url: https://github.com/github/safe-settings/sessions/d9420b15-2cca-40a3-a30b-869df73487f1 --------- Co-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com> Co-authored-by: decyjphr <57544838+decyjphr@users.noreply.github.com> Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com> * Add HOST environment variable to Dockerfile (#950) * docs: add troubleshooting section for Docker build and runtime issues (#951) * build(deps): bump undici in the npm_and_yarn group across 1 directory (#947) Bumps the npm_and_yarn group with 1 update in the / directory: [undici](https://github.com/nodejs/undici). Updates `undici` from 7.22.0 to 7.24.1 - [Release notes](https://github.com/nodejs/undici/releases) - [Commits](nodejs/undici@v7.22.0...v7.24.1) --- updated-dependencies: - dependency-name: undici dependency-version: 7.24.1 dependency-type: direct:production dependency-group: npm_and_yarn ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Co-authored-by: Yadhav Jayaraman <57544838+decyjphr@users.noreply.github.com> * build(deps-dev): bump brace-expansion Bumps the npm_and_yarn group with 1 update in the / directory: [brace-expansion](https://github.com/juliangruber/brace-expansion). Updates `brace-expansion` from 1.1.12 to 1.1.13 - [Release notes](https://github.com/juliangruber/brace-expansion/releases) - [Commits](juliangruber/brace-expansion@v1.1.12...v1.1.13) --- updated-dependencies: - dependency-name: brace-expansion dependency-version: 1.1.13 dependency-type: indirect dependency-group: npm_and_yarn ... Signed-off-by: dependabot[bot] <support@github.com> * build(deps): bump proxy-from-env from 1.1.0 to 2.0.0 (#934) Bumps [proxy-from-env](https://github.com/Rob--W/proxy-from-env) from 1.1.0 to 2.0.0. - [Release notes](https://github.com/Rob--W/proxy-from-env/releases) - [Commits](Rob--W/proxy-from-env@v1.1.0...v2.0.0) --- updated-dependencies: - dependency-name: proxy-from-env dependency-version: 2.0.0 dependency-type: direct:production update-type: version-update:semver-major ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> * ci(deps): bump docker/build-push-action from 6.18.0 to 6.19.2 (#935) Bumps [docker/build-push-action](https://github.com/docker/build-push-action) from 6.18.0 to 6.19.2. - [Release notes](https://github.com/docker/build-push-action/releases) - [Commits](docker/build-push-action@2634353...10e90e3) --- updated-dependencies: - dependency-name: docker/build-push-action dependency-version: 6.19.2 dependency-type: direct:production update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Co-authored-by: Yadhav Jayaraman <57544838+decyjphr@users.noreply.github.com> * build(deps): bump path-to-regexp (#953) Bumps the npm_and_yarn group with 1 update in the / directory: [path-to-regexp](https://github.com/pillarjs/path-to-regexp). Updates `path-to-regexp` from 8.3.0 to 8.4.0 - [Release notes](https://github.com/pillarjs/path-to-regexp/releases) - [Changelog](https://github.com/pillarjs/path-to-regexp/blob/master/History.md) - [Commits](pillarjs/path-to-regexp@v8.3.0...v8.4.0) --- updated-dependencies: - dependency-name: path-to-regexp dependency-version: 8.4.0 dependency-type: indirect dependency-group: npm_and_yarn ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> * build(deps): bump the npm_and_yarn group across 1 directory with 2 updates (#954) Bumps the npm_and_yarn group with 2 updates in the / directory: [path-to-regexp](https://github.com/pillarjs/path-to-regexp) and [yaml](https://github.com/eemeli/yaml). Updates `path-to-regexp` from 8.3.0 to 8.4.0 - [Release notes](https://github.com/pillarjs/path-to-regexp/releases) - [Changelog](https://github.com/pillarjs/path-to-regexp/blob/master/History.md) - [Commits](pillarjs/path-to-regexp@v8.3.0...v8.4.0) Updates `yaml` from 2.8.2 to 2.8.3 - [Release notes](https://github.com/eemeli/yaml/releases) - [Commits](eemeli/yaml@v2.8.2...v2.8.3) --- updated-dependencies: - dependency-name: path-to-regexp dependency-version: 8.4.0 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: yaml dependency-version: 2.8.3 dependency-type: indirect dependency-group: npm_and_yarn ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Co-authored-by: Yadhav Jayaraman <57544838+decyjphr@users.noreply.github.com> * Remove non-deterministic `npm install -g npm` from devcontainer Dockerfile (#956) * Initial plan * Fix alert #129: Remove non-deterministic npm install from devcontainer Dockerfile Agent-Logs-Url: https://github.com/github/safe-settings/sessions/0af97764-5b14-4195-ad8a-6b8adf723453 Co-authored-by: decyjphr <57544838+decyjphr@users.noreply.github.com> * Fix typo in devcontainer Dockerfile comment (Intall -> Install) Agent-Logs-Url: https://github.com/github/safe-settings/sessions/0af97764-5b14-4195-ad8a-6b8adf723453 Co-authored-by: decyjphr <57544838+decyjphr@users.noreply.github.com> --------- Co-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com> Co-authored-by: decyjphr <57544838+decyjphr@users.noreply.github.com> * Pin Dockerfile base image to SHA256 digest (#957) * Initial plan * Pin Docker base image to SHA256 digest to fix alert #128 Agent-Logs-Url: https://github.com/github/safe-settings/sessions/afcb39cb-64ea-43c7-8b49-200dd166ad5f Co-authored-by: decyjphr <57544838+decyjphr@users.noreply.github.com> --------- Co-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com> Co-authored-by: decyjphr <57544838+decyjphr@users.noreply.github.com> * Use `npm ci` instead of `npm install` in CI workflow (#958) * Initial plan * Replace npm install with npm ci in node-ci.yml workflow Agent-Logs-Url: https://github.com/github/safe-settings/sessions/4460185b-428a-48f4-a8b9-471226ccbf58 Co-authored-by: decyjphr <57544838+decyjphr@users.noreply.github.com> --------- Co-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com> Co-authored-by: decyjphr <57544838+decyjphr@users.noreply.github.com> * Replace npm install with npm ci in workflow (#960) * Replace npm install with npm ci in workflow * Replace npm install with npm ci in workflow * Bug/issue 465 (#970) * fix: apply org-level settings before loading repository configurations * fix: enhance descriptions and add new properties for security features in settings.json * fix: update description for deprecated squash-merge commit title property in settings.json * Update api endpoint version * Add JSON schemas for safe-settings configuration at repo, org, and suborg levels - Introduced `repos.json` schema for repository-level safe-settings overrides. - Updated `settings.json` schema to include additional properties for org-level configurations. - Created `suborgs.json` schema for suborg-level safe-settings configuration. - Enhanced the build script to dereference all schemas and handle errors during the process. * chores: fix branches tests * fix(build-schema): enhance schema dereferencing with GitHub API spec * Update docs/github-settings/5. branch-protection.md Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com> * Update index.js Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com> * fix(schema): simplify description for force_create property --------- Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com> * Bug/issue 842 (#928) * fix: apply org-level settings before loading repository configurations * fix: enhance descriptions and add new properties for security features in settings.json * fix: update description for deprecated squash-merge commit title property in settings.json * test: update branch protection tests to handle null restrictions and enforce_admins * fix: normalize branch protection restrictions and preserve existing settings * fix: update GitHub API calls to use the correct namespace for branch protection methods --------- Co-authored-by: Yadhav Jayaraman <57544838+decyjphr@users.noreply.github.com> * Fix custom_properties diffing when config uses `property_name` (#978) * Initial plan * Handle alternate custom property name shapes in normalize * Add explicit object guard in custom property normalization * Support property_name in custom_properties config entries * Polish custom properties test descriptions --------- Co-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com> * fix(variables): add noop mode support (#926) * feat(variables): add noop mode support - Add noop mode support to Variables plugin add/remove/update methods - Return NopCommand instead of making API calls when nop=true - Add comprehensive tests for noop mode behavior Signed-off-by: Kyle Harding <kyle@balena.io> * refactor(variables): align with Diffable contract pattern Refactor Variables plugin to match the single-item Diffable contract used by labels, milestones, and other plugins. The previous update() reimplemented sync() logic internally; now each method handles one item and lets Diffable.sync() orchestrate iteration. - Simplify update() from 90-line array-diffing to single-item PATCH - Simplify changed() from JSON.stringify comparison to value check - Remove getChanged(), lodash dependency, .then(res=>res) no-ops - Match labels.js nop return pattern: Promise.resolve([NopCommand]) - Fix inconsistent toUpperCase() between add/remove/update - Let errors propagate to Diffable.sync() instead of swallowing - Normalize find() to strip API metadata fields (created_at, etc.) Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com> Signed-off-by: Kyle Harding <kyle@balena.io> --------- Signed-off-by: Kyle Harding <kyle@balena.io> Co-authored-by: Claude Opus 4.6 (1M context) <noreply@anthropic.com> * fix: update lodash to ^4.18.1 to fix code injection vulnerability (#992) Resolve Dependabot alert #116 - lodash vulnerable to Code Injection via `_.template` imports key names. Updated from ^4.17.21 to ^4.18.1. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> * build(deps): bump uuid in the npm_and_yarn group across 1 directory Bumps the npm_and_yarn group with 1 update in the / directory: [uuid](https://github.com/uuidjs/uuid). Updates `uuid` from 8.3.2 to 14.0.0 - [Release notes](https://github.com/uuidjs/uuid/releases) - [Changelog](https://github.com/uuidjs/uuid/blob/main/CHANGELOG.md) - [Commits](uuidjs/uuid@v8.3.2...v14.0.0) --- updated-dependencies: - dependency-name: uuid dependency-version: 14.0.0 dependency-type: indirect ... Signed-off-by: dependabot[bot] <support@github.com> * Bug/archived repo (#991) * fix: apply org-level settings before loading repository configurations * fix: enhance descriptions and add new properties for security features in settings.json * fix: update description for deprecated squash-merge commit title property in settings.json * fix issue with archived repos --------- Co-authored-by: Yadhav Jayaraman <57544838+decyjphr@users.noreply.github.com> * build(deps): bump the npm_and_yarn group across 1 directory with 3 updates Bumps the npm_and_yarn group with 3 updates in the / directory: [js-yaml](https://github.com/nodeca/js-yaml), [qs](https://github.com/ljharb/qs) and [shell-quote](https://github.com/ljharb/shell-quote). Updates `js-yaml` from 4.1.1 to 4.2.0 - [Changelog](https://github.com/nodeca/js-yaml/blob/master/CHANGELOG.md) - [Commits](https://github.com/nodeca/js-yaml/commits) Updates `qs` from 6.15.0 to 6.15.2 - [Changelog](https://github.com/ljharb/qs/blob/main/CHANGELOG.md) - [Commits](ljharb/qs@v6.15.0...v6.15.2) Updates `shell-quote` from 1.8.3 to 1.8.4 - [Changelog](https://github.com/ljharb/shell-quote/blob/main/CHANGELOG.md) - [Commits](ljharb/shell-quote@v1.8.3...v1.8.4) --- updated-dependencies: - dependency-name: js-yaml dependency-version: 4.2.0 dependency-type: direct:production dependency-group: npm_and_yarn - dependency-name: qs dependency-version: 6.15.2 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: shell-quote dependency-version: 1.8.4 dependency-type: indirect dependency-group: npm_and_yarn ... Signed-off-by: dependabot[bot] <support@github.com> * Initial plan * feat: add priorityClassName support to Helm chart * Add include/exclude repo filters to team settings Team entries are filtered by the same Diffable include/exclude logic that collaborators use, but unlike collaborators those keys were never part of the TeamSettings schema or documented, so editors and linters can't validate them. Mirror the CollaboratorSettings allOf pattern to declare include and exclude on TeamSettings, document both in the teams guide with examples, add a sample, and cover the filter path with unit tests. No runtime changes. * build(deps-dev): bump flatted from 3.3.4 to 3.4.4 (#1055) Bumps [flatted](https://github.com/WebReflection/flatted) from 3.3.4 to 3.4.4. - [Commits](WebReflection/flatted@v3.3.4...v3.4.4) --- updated-dependencies: - dependency-name: flatted dependency-version: 3.4.4 dependency-type: indirect ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> * build(deps): bump undici in the npm_and_yarn group across 1 directory (#1058) Bumps the npm_and_yarn group with 1 update in the / directory: [undici](https://github.com/nodejs/undici). Updates `undici` from 7.24.5 to 7.29.0 - [Release notes](https://github.com/nodejs/undici/releases) - [Commits](nodejs/undici@v7.24.5...v7.29.0) --- updated-dependencies: - dependency-name: undici dependency-version: 7.29.0 dependency-type: direct:production dependency-group: npm_and_yarn ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> * build(deps-dev): bump shell-quote from 1.8.4 to 1.10.0 (#1057) Bumps [shell-quote](https://github.com/ljharb/shell-quote) from 1.8.4 to 1.10.0. - [Changelog](https://github.com/ljharb/shell-quote/blob/main/CHANGELOG.md) - [Commits](ljharb/shell-quote@v1.8.4...v1.10.0) --- updated-dependencies: - dependency-name: shell-quote dependency-version: 1.10.0 dependency-type: indirect ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Co-authored-by: Yadhav Jayaraman <57544838+decyjphr@users.noreply.github.com> * build(deps): bump js-yaml in the npm_and_yarn group across 1 directory (#1059) Bumps the npm_and_yarn group with 1 update in the / directory: [js-yaml](https://github.com/nodeca/js-yaml). Updates `js-yaml` from 4.2.0 to 4.3.1 - [Changelog](https://github.com/nodeca/js-yaml/blob/4.3.1/CHANGELOG.md) - [Commits](nodeca/js-yaml@4.2.0...4.3.1) --- updated-dependencies: - dependency-name: js-yaml dependency-version: 4.3.1 dependency-type: direct:production dependency-group: npm_and_yarn ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Co-authored-by: Yadhav Jayaraman <57544838+decyjphr@users.noreply.github.com> * build(deps-dev): bump brace-expansion (#1060) Bumps the npm_and_yarn group with 1 update in the / directory: [brace-expansion](https://github.com/juliangruber/brace-expansion). Updates `brace-expansion` from 1.1.13 to 1.1.18 - [Release notes](https://github.com/juliangruber/brace-expansion/releases) - [Commits](juliangruber/brace-expansion@v1.1.13...v1.1.18) --- updated-dependencies: - dependency-name: brace-expansion dependency-version: 1.1.18 dependency-type: indirect ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Co-authored-by: Yadhav Jayaraman <57544838+decyjphr@users.noreply.github.com> * build(deps): bump body-parser (#1061) Bumps the npm_and_yarn group with 1 update in the / directory: [body-parser](https://github.com/expressjs/body-parser). Updates `body-parser` from 2.2.2 to 2.3.0 - [Release notes](https://github.com/expressjs/body-parser/releases) - [Changelog](https://github.com/expressjs/body-parser/blob/master/HISTORY.md) - [Commits](expressjs/body-parser@v2.2.2...v2.3.0) --- updated-dependencies: - dependency-name: body-parser dependency-version: 2.3.0 dependency-type: indirect dependency-group: npm_and_yarn ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> * Fix GHSA-52cp-r559-cp3m: resolve transitive js-yaml via jest and lockfile-lint upgrades (#1064) Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> --------- Signed-off-by: dependabot[bot] <support@github.com> Signed-off-by: Jan Bronicki <janbronicki@microsoft.com> Signed-off-by: Kyle Harding <kyle@balena.io> Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Co-authored-by: Copilot <198982749+Copilot@users.noreply.github.com> Co-authored-by: Tyler Ohlsen <tylerohlsen@hotmail.com> Co-authored-by: Jan Bronicki <janbronicki@microsoft.com> Co-authored-by: Brett Logan <lindluni@github.com> Co-authored-by: Madis Kõosaar <madis.koosaar@solidify.dev> Co-authored-by: Kyle Harding <kyle@balena.io> Co-authored-by: Claude Opus 4.6 (1M context) <noreply@anthropic.com> Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> Co-authored-by: neatcoder <28711376+neatcoder@users.noreply.github.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for freeto join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Bumps probot from 11.0.6 to 11.2.0.
Release notes
Sourced from probot's releases.
Commits
ce96884feat: Add dark mode to builtin pages (#1509)9eb3e97docs(deployment): netlify functions (#1507)0e37427fix: update design of probot landing page (#1508)fa4a95cRemove grave accents (`) from header texts (#1493)d70c4afbuild(package): fix descriptionc956d25build(package): lock file5b79ce2docs: update sentence to include the word use (#1500)57ad735build(deps): bump y18n from 4.0.0 to 4.0.1 (#1495)f053bf8docs(deployment): GitHub Actions example repo link (#1484)b2fe1f5build(package): simplify repository fieldsDependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting
@dependabot rebase.Dependabot commands and options
You can trigger Dependabot actions by commenting on this PR:
@dependabot rebasewill rebase this PR@dependabot recreatewill recreate this PR, overwriting any edits that have been made to it@dependabot mergewill merge this PR after your CI passes on it@dependabot squash and mergewill squash and merge this PR after your CI passes on it@dependabot cancel mergewill cancel a previously requested merge and block automerging@dependabot reopenwill reopen this PR if it is closed@dependabot closewill close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually@dependabot ignore this major versionwill close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)@dependabot ignore this minor versionwill close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)@dependabot ignore this dependencywill close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)