Skip to content

build(deps): bump juspay/yama from 2.6.0 to 3.0.2 - #45

Closed
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/github_actions/juspay/yama-3.0.2
Closed

build(deps): bump juspay/yama from 2.6.0 to 3.0.2#45
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/github_actions/juspay/yama-3.0.2

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Jul 29, 2026

Copy link
Copy Markdown
Contributor

Bumps juspay/yama from 2.6.0 to 3.0.2.

Release notes

Sourced from juspay/yama's releases.

v3.0.2

3.0.2 (2026-07-28)

Bug Fixes

  • review: gate-anchored verdicts, posting finalization, no default wall clock (b842f24)

v3.0.1

3.0.1 (2026-07-27)

Bug Fixes

  • config: make ai temperature optional, omit when unset (10116a8)

v3.0.0

3.0.0 (2026-07-27)

Bug Fixes

  • release: repair GitHub Packages publish and refresh v3 docs (705efe9)

BREAKING CHANGES

  • release: the v3 line rejects the legacy flat mcpServers. config shape at startup - move servers under mcpServers.servers. (see MIGRATION.md). Marker carried here because the v3 refactor merged as a non-releasing refactor commit.

v2.7.2

2.7.2 (2026-07-23)

Bug Fixes

  • deps: bump @​juspay/neurolink to 10.1.2 for litellm timeout defaults (fe1de54), closes juspay/neurolink#1216
  • release: run release.yml on Node 24 so npm@latest OIDC install succeeds (9fa4e96)

v2.7.1

2.7.1 (2026-06-15)

Bug Fixes

  • v2: bump neurolink to 9.70.7 and fix review/config correctness bugs (d0c62f7)

v2.7.0

... (truncated)

Changelog

Sourced from juspay/yama's changelog.

3.0.2 (2026-07-28)

Bug Fixes

  • review: gate-anchored verdicts, posting finalization, no default wall clock (b842f24)

3.0.1 (2026-07-27)

Bug Fixes

  • config: make ai temperature optional, omit when unset (10116a8)

3.0.0 (2026-07-27)

Bug Fixes

  • release: repair GitHub Packages publish and refresh v3 docs (705efe9)

BREAKING CHANGES

  • release: the v3 line rejects the legacy flat mcpServers. config shape at startup - move servers under mcpServers.servers. (see MIGRATION.md). Marker carried here because the v3 refactor merged as a non-releasing refactor commit.

2.7.2 (2026-07-23)

Bug Fixes

  • deps: bump @​juspay/neurolink to 10.1.2 for litellm timeout defaults (fe1de54), closes juspay/neurolink#1216
  • release: run release.yml on Node 24 so npm@latest OIDC install succeeds (9fa4e96)

2.7.1 (2026-06-15)

Bug Fixes

  • v2: bump neurolink to 9.70.7 and fix review/config correctness bugs (d0c62f7)

2.7.0 (2026-06-11)

Features

  • setup: add one-command GitHub integration setup script (6a014b0)
Commits
  • 087e7c6 chore(release): 3.0.2 [skip ci]
  • b842f24 fix(review): gate-anchored verdicts, posting finalization, no default wall clock
  • 7fdacfa chore(release): 3.0.1 [skip ci]
  • 10116a8 fix(config): make ai temperature optional, omit when unset
  • bb6c205 chore(release): 3.0.0 [skip ci]
  • 705efe9 fix(release): repair GitHub Packages publish and refresh v3 docs
  • 53b4a55 refactor(v2): config-driven MCP, agentic review harness, and v3 pipeline
  • b89b3aa chore(release): 2.7.2 [skip ci]
  • 9fa4e96 fix(release): run release.yml on Node 24 so npm@latest OIDC install succeeds
  • fe1de54 fix(deps): bump @​juspay/neurolink to 10.1.2 for litellm timeout defaults
  • Additional commits viewable in compare view

Dependabot compatibility score

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.


Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
  • @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
  • @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
  • @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

Bumps [juspay/yama](https://github.com/juspay/yama) from 2.6.0 to 3.0.2.
- [Release notes](https://github.com/juspay/yama/releases)
- [Changelog](https://github.com/juspay/yama/blob/main/CHANGELOG.md)
- [Commits](juspay/yama@v2.6.0...v3.0.2)

---
updated-dependencies:
- dependency-name: juspay/yama
  dependency-version: 3.0.2
  dependency-type: direct:production
  update-type: version-update:semver-major
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot Bot added dependencies Dependency updates (Dependabot) github_actions Pull requests that update GitHub Actions code labels Jul 29, 2026
@dependabot
dependabot Bot requested a review from murdore as a code owner July 29, 2026 16:54
@dependabot dependabot Bot added dependencies Dependency updates (Dependabot) github_actions Pull requests that update GitHub Actions code labels Jul 29, 2026
@github-actions

Copy link
Copy Markdown

Single Commit Policy — COMPLIANT

Status: 1 commit | Valid format | No merge commits | Ready for merge

Commit details
  • Hash: 3122a2539907f96e7da9212ee25e9e4989f91ebe
  • Message: build(deps): bump juspay/yama from 2.6.0 to 3.0.2
  • Author: dependabot[bot]

Automated validation — dopamine single-commit enforcement

@murdore

murdore commented Jul 29, 2026

Copy link
Copy Markdown
Contributor

Follow-up on the juspay/yama v2.6.0 → v3.0.2 bump: this repo's yama.config.yaml is still in the legacy flat mcpServers shape that v3 rejects at startup.

This PR's diff (verified at current head 3122a2539907f96e7da9212ee25e9e4989f91ebe) only touches .github/workflows/yama-review.yml:

-        uses: juspay/yama@v2.6.0
+        uses: juspay/yama@v3.0.2

But yama.config.yaml:46-49 on main still reads:

mcpServers:
  github:
    enabled: true
  jira:
    enabled: false

The v3.0.0 release notes (surfaced in this very PR's dependabot description) call this out explicitly under BREAKING CHANGES:

"the v3 line rejects the legacy flat mcpServers config shape at startup - move servers under mcpServers.servers (see MIGRATION.md)."

Since this PR bumps the action tag but doesn't migrate the config, the very next PR's "Yama PR Review" run would hit this at config-load time. Looking at how yama-review.yml's "Enforce verdict" step handles that: if the action fails to start, steps.yama.outcome won't be success and DECISION will be empty, so it prints:

::error::Yama could not complete the review (infrastructure error). Re-run this job to retry.

That message reads like a transient infra hiccup — re-running won't fix it, because the actual cause is the config shape, and "Yama PR Review" is a required status check, so this would block merges on every subsequent PR until fixed.

Suggest migrating yama.config.yaml's mcpServers block to the nested mcpServers.servers.<name> shape (per yama's MIGRATION.md) in this PR, or immediately before merging it.

@murdore

murdore commented Aug 4, 2026

Copy link
Copy Markdown
Contributor

Chase on the above — reconfirmed live at current head 3122a2539907f96e7da9212ee25e9e4989f91ebe (still the only commit, PR unchanged since): yama.config.yaml on main still has the flat mcpServers: block (lines 46-49, github:/jira: directly under mcpServers), not the nested mcpServers.servers.<name> shape v3.0.0 requires per its own BREAKING CHANGES note. Recommend migrating yama.config.yaml in/alongside this PR before merging the action bump, otherwise the next PR's required "Yama PR Review" check risks failing at config-load time (matches this repo's own confirmed pattern: a changelog-routine major dependency bump breaking this app's runtime in a way CI's green tsc+test run won't catch).

@dependabot @github

dependabot Bot commented on behalf of github Aug 12, 2026

Copy link
Copy Markdown
Contributor Author

Superseded by #57.

@dependabot dependabot Bot closed this Aug 12, 2026
@dependabot
dependabot Bot deleted the dependabot/github_actions/juspay/yama-3.0.2 branch August 12, 2026 16:54
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

dependencies Dependency updates (Dependabot) github_actions Pull requests that update GitHub Actions code

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant