build(dev): update dependency tsdown to v0.21.4 by fro-bot[bot] · Pull Request #332 · fro-bot/agent

fro-bot · 2026-03-18T14:18:32Z

This PR contains the following updates:

Package	Change	Age	Confidence	OpenSSF	Code Search
tsdown (source)	`0.21.2` → `0.21.4`

Release Notes

rolldown/tsdown (tsdown)

`v0.21.4`

Compare Source

🚀 Features

css: Add CSS modules support - by @sxzz in #834 (2a88a)

🐞 Bug Fixes

exports: Preserve CRLF line endings in package.json - by @sxzz (a4d4e)

View changes on GitHub

`v0.21.3`

Compare Source

🚀 Features

copy: Add support for watching copy source files - by @schplitt in #721 (7c23a)

🐞 Bug Fixes

css: Watch inline CSS files in watch mode - by @sxzz (2051a)
exports: Sort inlined dependencies by package name - by @sxzz (0ec71)
publint: Support Yarn v1 - by @sxzz (4a291)
unbundle: Root should be lowest common ancestor of entry files - by @sxzz (f1823)

View changes on GitHub

Configuration

📅 Schedule: Branch creation - At any time (no schedule defined), Automerge - At any time (no schedule defined).

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

If you want to rebase/retry this PR, check this box

This PR has been generated by Renovate Bot.

* ci(deps): update bfra-me/.github to v4.13.1 (#330) Co-authored-by: fro-bot[bot] <109017866+fro-bot[bot]@users.noreply.github.com> * fix(settings): remove users/teams from bypass_pull_request_allowances (#338) GitHub API rejects users and teams restrictions on user-owned repos (only org repos support them). Removing the empty arrays from all three branch protection blocks fixes the update-repo-settings error. * fix(settings): drop bypass_pull_request_allowances entirely (#343) The update-repository-settings action deep-merges config over the current GitHub state. Even with users/teams removed from YAML, the action reads them from the existing protection and sends them back. GitHub rejects users/teams on user-owned repos (bfra-me/.github#1837). Workaround: remove bypass_pull_request_allowances from all branches. Manage fro-bot app bypass via GitHub UI until upstream is fixed. * fix(settings): use literal branch name v0 instead of glob v? (#344) fix(settings): use literal branch name v0 instead of glob pattern v? The update-repository-settings action passes branch names directly to the GitHub API, which requires literal names. The glob pattern v? was treated as a literal branch name, causing a 'Branch not found' error. * build(deps): update dependency oh-my-openagent to v3.12.0 (#342) Co-authored-by: fro-bot[bot] <109017866+fro-bot[bot]@users.noreply.github.com> * build(dev): update dependency tsdown to v0.21.3 (#332) Co-authored-by: fro-bot[bot] <109017866+fro-bot[bot]@users.noreply.github.com> * ci(deps): update github/codeql-action action to v4.34.1 (#341) Co-authored-by: fro-bot[bot] <109017866+fro-bot[bot]@users.noreply.github.com> * fix(settings): update action to v4.13.4 and restore bypass_pull_request_allowances (#345) bfra-me/.github#1837 was fixed in update-repository-settings@0.1.3 (shipped in v4.13.4). The action now strips users/teams from bypass_pull_request_allowances on user-owned repos before sending to the API. Restores bypass config: - main: apps: [] (no bypass — OpenSSF Scorecard compliance) - v0: apps: [fro-bot] (release workflow bypass) - release: apps: [fro-bot] (release workflow bypass) * chore(dev): update dependency lint-staged to v16.4.0 (#328) Co-authored-by: fro-bot[bot] <109017866+fro-bot[bot]@users.noreply.github.com> * feat: add execution deduplication to prevent redundant agent runs (#347) * feat: add execution deduplication to prevent redundant agent runs Skip agent execution when it already ran for the same PR or issue within a configurable window (default 10 minutes). Uses @actions/cache sentinel files scoped per entity to track recent completions. New dedup phase runs between routing and acknowledge. Configurable via dedup-window action input (milliseconds, 0 = disabled). Fail-open design: cache miss or error always proceeds. Tolerates ±60s clock skew between runners. 1024 tests, 0 lint errors, 0 type errors. * fix: move dedup sentinel dir from /tmp to ~/.cache to satisfy CodeQL CodeQL flagged insecure temp file creation in /tmp (predictable path). Move sentinel base dir to os.homedir()/.cache/fro-bot-dedup/ which is deterministic across runs but not under the OS temp directory. * build(deps): update dependency oh-my-openagent to v3.12.3 (#346) Co-authored-by: fro-bot[bot] <109017866+fro-bot[bot]@users.noreply.github.com> * ci(deps): update bfra-me/.github to v4.13.5 (#340) Co-authored-by: fro-bot[bot] <109017866+fro-bot[bot]@users.noreply.github.com> --------- Co-authored-by: fro-bot[bot] <109017866+fro-bot[bot]@users.noreply.github.com>

* ci(deps): update bfra-me/.github to v4.13.1 (#330) Co-authored-by: fro-bot[bot] <109017866+fro-bot[bot]@users.noreply.github.com> * fix(settings): remove users/teams from bypass_pull_request_allowances (#338) GitHub API rejects users and teams restrictions on user-owned repos (only org repos support them). Removing the empty arrays from all three branch protection blocks fixes the update-repo-settings error. * fix(settings): drop bypass_pull_request_allowances entirely (#343) The update-repository-settings action deep-merges config over the current GitHub state. Even with users/teams removed from YAML, the action reads them from the existing protection and sends them back. GitHub rejects users/teams on user-owned repos (bfra-me/.github#1837). Workaround: remove bypass_pull_request_allowances from all branches. Manage fro-bot app bypass via GitHub UI until upstream is fixed. * fix(settings): use literal branch name v0 instead of glob v? (#344) fix(settings): use literal branch name v0 instead of glob pattern v? The update-repository-settings action passes branch names directly to the GitHub API, which requires literal names. The glob pattern v? was treated as a literal branch name, causing a 'Branch not found' error. * build(deps): update dependency oh-my-openagent to v3.12.0 (#342) Co-authored-by: fro-bot[bot] <109017866+fro-bot[bot]@users.noreply.github.com> * build(dev): update dependency tsdown to v0.21.3 (#332) Co-authored-by: fro-bot[bot] <109017866+fro-bot[bot]@users.noreply.github.com> * ci(deps): update github/codeql-action action to v4.34.1 (#341) Co-authored-by: fro-bot[bot] <109017866+fro-bot[bot]@users.noreply.github.com> * fix(settings): update action to v4.13.4 and restore bypass_pull_request_allowances (#345) bfra-me/.github#1837 was fixed in update-repository-settings@0.1.3 (shipped in v4.13.4). The action now strips users/teams from bypass_pull_request_allowances on user-owned repos before sending to the API. Restores bypass config: - main: apps: [] (no bypass — OpenSSF Scorecard compliance) - v0: apps: [fro-bot] (release workflow bypass) - release: apps: [fro-bot] (release workflow bypass) * chore(dev): update dependency lint-staged to v16.4.0 (#328) Co-authored-by: fro-bot[bot] <109017866+fro-bot[bot]@users.noreply.github.com> * feat: add execution deduplication to prevent redundant agent runs (#347) * feat: add execution deduplication to prevent redundant agent runs Skip agent execution when it already ran for the same PR or issue within a configurable window (default 10 minutes). Uses @actions/cache sentinel files scoped per entity to track recent completions. New dedup phase runs between routing and acknowledge. Configurable via dedup-window action input (milliseconds, 0 = disabled). Fail-open design: cache miss or error always proceeds. Tolerates ±60s clock skew between runners. 1024 tests, 0 lint errors, 0 type errors. * fix: move dedup sentinel dir from /tmp to ~/.cache to satisfy CodeQL CodeQL flagged insecure temp file creation in /tmp (predictable path). Move sentinel base dir to os.homedir()/.cache/fro-bot-dedup/ which is deterministic across runs but not under the OS temp directory. * build(deps): update dependency oh-my-openagent to v3.12.3 (#346) Co-authored-by: fro-bot[bot] <109017866+fro-bot[bot]@users.noreply.github.com> * ci(deps): update bfra-me/.github to v4.13.5 (#340) Co-authored-by: fro-bot[bot] <109017866+fro-bot[bot]@users.noreply.github.com> * fix(settings): remove bypass_pull_request_allowances for user-owned repo (#349) The update-repo-settings workflow fails with: 'Only organization repositories can have users and team restrictions' This repo is user-owned (fro-bot), not organization-owned. The bypass_pull_request_allowances field is only valid for org repos. Reverts the settings restoration from #345 which broke the workflow. Closes: #348 (related to workflow fix) --------- Co-authored-by: fro-bot[bot] <109017866+fro-bot[bot]@users.noreply.github.com> Co-authored-by: Fro Bot <80104189+fro-bot@users.noreply.github.com>

fro-bot bot requested review from fro-bot and marcusrbrown as code owners March 18, 2026 14:18

fro-bot bot added dependencies Dependency updates or security alerts devDependencies patch renovate Universal dependency update tool <https://mend.io/renovate> labels Mar 18, 2026

fro-bot bot assigned fro-bot and marcusrbrown Mar 18, 2026

fro-bot mentioned this pull request Mar 18, 2026

Daily Maintenance Report #252

Open

10 tasks

fro-bot bot force-pushed the renovate/tsdown-0.x branch 3 times, most recently from 57b4095 to 1a1ced6 Compare March 19, 2026 04:01

settings bot removed devDependencies labels Mar 19, 2026

fro-bot bot force-pushed the renovate/tsdown-0.x branch 2 times, most recently from ad89015 to 968cb9d Compare March 19, 2026 10:09

marcusrbrown enabled auto-merge (squash) March 19, 2026 10:17

fro-bot bot force-pushed the renovate/tsdown-0.x branch 6 times, most recently from ee46d5e to ee81032 Compare March 19, 2026 15:46

fro-bot bot changed the title ~~build(dev): update dependency tsdown to v0.21.3~~ build(dev): update dependency tsdown to v0.21.4 Mar 19, 2026

fro-bot bot force-pushed the renovate/tsdown-0.x branch 2 times, most recently from a2d6bb0 to 47c9bd4 Compare March 21, 2026 02:06

build(dev): update dependency tsdown to v0.21.4

16d9cc0

fro-bot bot force-pushed the renovate/tsdown-0.x branch from 47c9bd4 to 16d9cc0 Compare March 21, 2026 02:21

marcusrbrown approved these changes Mar 21, 2026

View reviewed changes

marcusrbrown merged commit eba2b5d into main Mar 21, 2026
11 checks passed

marcusrbrown deleted the renovate/tsdown-0.x branch March 21, 2026 02:23

fro-bot bot mentioned this pull request Mar 21, 2026

chore(release): pending release v0.31.0 #339

Merged

fro-bot bot mentioned this pull request Mar 22, 2026

chore(release): pending release v0.31.0 #351

Merged

This was referenced Mar 22, 2026

chore(release): pending release #353

Closed

chore(release): pending release v0.31.1 #360

Closed

chore(release): pending release v0.31.2 #362

Closed

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

build(dev): update dependency tsdown to v0.21.4#332

build(dev): update dependency tsdown to v0.21.4#332
marcusrbrown merged 1 commit intomainfrom
renovate/tsdown-0.x

fro-bot bot commented Mar 18, 2026 •

edited

Loading

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

Conversation

fro-bot bot commented Mar 18, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Release Notes

v0.21.4

🚀 Features

🐞 Bug Fixes

View changes on GitHub

v0.21.3

🚀 Features

🐞 Bug Fixes

View changes on GitHub

Configuration

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

fro-bot bot commented Mar 18, 2026 •

edited

Loading

`v0.21.4`

`v0.21.3`