Sync: actions/create-github-app-token@f8d387b#1
Open
forklebot[bot] wants to merge 20 commits intomainfrom
Open
Sync: actions/create-github-app-token@f8d387b#1forklebot[bot] wants to merge 20 commits intomainfrom
forklebot[bot] wants to merge 20 commits intomainfrom
Conversation
…7.1.0 (actions#317) Bumps [stefanzweifel/git-auto-commit-action](https://github.com/stefanzweifel/git-auto-commit-action) from 6.0.1 to 7.1.0. <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/stefanzweifel/git-auto-commit-action/releases">stefanzweifel/git-auto-commit-action's releases</a>.</em></p> <blockquote> <h2>v7.1.0</h2> <h2>Added</h2> <ul> <li>Add skip_push input option (<a href="https://redirect.github.com/stefanzweifel/git-auto-commit-action/pull/401">#401</a>) <a href="https://github.com/@kvanzuijlen"><code>@kvanzuijlen</code></a></li> </ul> <h2>Changes</h2> <ul> <li>docs: fix typo in README.md (<a href="https://redirect.github.com/stefanzweifel/git-auto-commit-action/pull/400">#400</a>) <a href="https://github.com/@GideonBear"><code>@GideonBear</code></a></li> </ul> <h2>Dependency Updates</h2> <ul> <li>Bump actions/checkout from 5 to 6 (<a href="https://redirect.github.com/stefanzweifel/git-auto-commit-action/pull/399">#399</a>) [@<a href="https://github.com/apps/dependabot">dependabot[bot]</a>](<a href="https://github.com/@%5Bdependabot%5Bbot%5D%5D(https://github.com/apps/dependabot)">https://github.com/@[dependabot[bot]](https://github.com/apps/dependabot)</a>)</li> <li>Bump bats from 1.12.0 to 1.13.0 (<a href="https://redirect.github.com/stefanzweifel/git-auto-commit-action/pull/398">#398</a>) [@<a href="https://github.com/apps/dependabot">dependabot[bot]</a>](<a href="https://github.com/@%5Bdependabot%5Bbot%5D%5D(https://github.com/apps/dependabot)">https://github.com/@[dependabot[bot]](https://github.com/apps/dependabot)</a>)</li> </ul> <h2>v7.0.0</h2> <h2>Added</h2> <ul> <li>Restore skip_fetch, skip_checkout, create_branch (<a href="https://redirect.github.com/stefanzweifel/git-auto-commit-action/pull/388">#388</a>) <a href="https://github.com/@stefanzweifel"><code>@stefanzweifel</code></a></li> <li>Restore Detached State Detection (<a href="https://redirect.github.com/stefanzweifel/git-auto-commit-action/pull/393">#393</a>) <a href="https://github.com/@stefanzweifel"><code>@stefanzweifel</code></a></li> <li>Add Support for Tag Messages (<a href="https://redirect.github.com/stefanzweifel/git-auto-commit-action/pull/391">#391</a>) <a href="https://github.com/@EliasBoulharts"><code>@EliasBoulharts</code></a></li> </ul> <h2>Changed</h2> <ul> <li>Run Action on Node 24 (<a href="https://redirect.github.com/stefanzweifel/git-auto-commit-action/pull/389">#389</a>) <a href="https://github.com/@stefanzweifel"><code>@stefanzweifel</code></a></li> </ul> <h2>Dependency Updates</h2> <ul> <li>Bump actions/checkout from 4 to 5 (<a href="https://redirect.github.com/stefanzweifel/git-auto-commit-action/pull/386">#386</a>) [@<a href="https://github.com/apps/dependabot">dependabot[bot]</a>](<a href="https://github.com/@%5Bdependabot%5Bbot%5D%5D(https://github.com/apps/dependabot)">https://github.com/@[dependabot[bot]](https://github.com/apps/dependabot)</a>)</li> </ul> </blockquote> </details> <details> <summary>Changelog</summary> <p><em>Sourced from <a href="https://github.com/stefanzweifel/git-auto-commit-action/blob/master/CHANGELOG.md">stefanzweifel/git-auto-commit-action's changelog</a>.</em></p> <blockquote> <h1>Changelog</h1> <p>All notable changes to this project will be documented in this file.</p> <p>The format is based on <a href="http://keepachangelog.com/en/1.0.0/">Keep a Changelog</a> and this project adheres to <a href="http://semver.org/spec/v2.0.0.html">Semantic Versioning</a>.</p> <h2><a href="https://github.com/stefanzweifel/git-auto-commit-action/compare/v7.1.0...HEAD">Unreleased</a></h2> <blockquote> <p>TBD</p> </blockquote> <h2><a href="https://github.com/stefanzweifel/git-auto-commit-action/compare/v7.0.0...v7.1.0">v7.1.0</a> - 2025-12-17</h2> <h3>Added</h3> <ul> <li>Add skip_push input option (<a href="https://redirect.github.com/stefanzweifel/git-auto-commit-action/pull/401">#401</a>) <a href="https://github.com/@kvanzuijlen"><code>@kvanzuijlen</code></a></li> </ul> <h3>Changes</h3> <ul> <li>docs: fix typo in README.md (<a href="https://redirect.github.com/stefanzweifel/git-auto-commit-action/pull/400">#400</a>) <a href="https://github.com/@GideonBear"><code>@GideonBear</code></a></li> </ul> <h3>Dependency Updates</h3> <ul> <li>Bump actions/checkout from 5 to 6 (<a href="https://redirect.github.com/stefanzweifel/git-auto-commit-action/pull/399">#399</a>) [@<a href="https://github.com/apps/dependabot">dependabot[bot]</a>](<a href="https://github.com/@%5Bdependabot%5Bbot%5D%5D(https://github.com/apps/dependabot)">https://github.com/@[dependabot[bot]](https://github.com/apps/dependabot)</a>)</li> <li>Bump bats from 1.12.0 to 1.13.0 (<a href="https://redirect.github.com/stefanzweifel/git-auto-commit-action/pull/398">#398</a>) [@<a href="https://github.com/apps/dependabot">dependabot[bot]</a>](<a href="https://github.com/@%5Bdependabot%5Bbot%5D%5D(https://github.com/apps/dependabot)">https://github.com/@[dependabot[bot]](https://github.com/apps/dependabot)</a>)</li> </ul> <h2><a href="https://github.com/stefanzweifel/git-auto-commit-action/compare/v6.0.1...v7.0.0">v7.0.0</a> - 2025-10-12</h2> <h3>Added</h3> <ul> <li>Restore skip_fetch, skip_checkout, create_branch (<a href="https://redirect.github.com/stefanzweifel/git-auto-commit-action/pull/388">#388</a>) <a href="https://github.com/@stefanzweifel"><code>@stefanzweifel</code></a></li> <li>Restore Detached State Detection (<a href="https://redirect.github.com/stefanzweifel/git-auto-commit-action/pull/393">#393</a>) <a href="https://github.com/@stefanzweifel"><code>@stefanzweifel</code></a></li> <li>Add Support for Tag Messages (<a href="https://redirect.github.com/stefanzweifel/git-auto-commit-action/pull/391">#391</a>) <a href="https://github.com/@EliasBoulharts"><code>@EliasBoulharts</code></a></li> </ul> <h3>Changed</h3> <ul> <li>Run Action on Node 24 (<a href="https://redirect.github.com/stefanzweifel/git-auto-commit-action/pull/389">#389</a>) <a href="https://github.com/@stefanzweifel"><code>@stefanzweifel</code></a></li> </ul> <h3>Dependency Updates</h3> <ul> <li>Bump actions/checkout from 4 to 5 (<a href="https://redirect.github.com/stefanzweifel/git-auto-commit-action/pull/386">#386</a>) [@<a href="https://github.com/apps/dependabot">dependabot[bot]</a>](<a href="https://github.com/@%5Bdependabot%5Bbot%5D%5D(https://github.com/apps/dependabot)">https://github.com/@[dependabot[bot]](https://github.com/apps/dependabot)</a>)</li> </ul> <h2><a href="https://github.com/stefanzweifel/git-auto-commit-action/compare/v6.0.0...v6.0.1">v6.0.1</a> - 2025-06-11</h2> <h3>Fixed</h3> <ul> <li>Disable Check if Repo is in Detached State (<a href="https://redirect.github.com/stefanzweifel/git-auto-commit-action/pull/379">#379</a>) <a href="https://github.com/@stefanzweifel"><code>@stefanzweifel</code></a></li> </ul> <h2><a href="https://github.com/stefanzweifel/git-auto-commit-action/compare/v5.2.0...v6.0.0">v6.0.0</a> - 2025-06-10</h2> <!-- raw HTML omitted --> </blockquote> <p>... (truncated)</p> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/stefanzweifel/git-auto-commit-action/commit/04702edda442b2e678b25b537cec683a1493fcb9"><code>04702ed</code></a> Bump actions/checkout from 5 to 6 (<a href="https://redirect.github.com/stefanzweifel/git-auto-commit-action/issues/399">#399</a>)</li> <li><a href="https://github.com/stefanzweifel/git-auto-commit-action/commit/1e49d5001fa4bb7d02711af41f4af23c58ef1de8"><code>1e49d50</code></a> Add skip_push input option (<a href="https://redirect.github.com/stefanzweifel/git-auto-commit-action/issues/401">#401</a>)</li> <li><a href="https://github.com/stefanzweifel/git-auto-commit-action/commit/65c56779c90b0324ac2a7e7c31ec876b8db47914"><code>65c5677</code></a> docs: fix typo in README.md (<a href="https://redirect.github.com/stefanzweifel/git-auto-commit-action/issues/400">#400</a>)</li> <li><a href="https://github.com/stefanzweifel/git-auto-commit-action/commit/547c1409cec143c754e148a6fbdfa359db836cf6"><code>547c140</code></a> Bump bats from 1.12.0 to 1.13.0 (<a href="https://redirect.github.com/stefanzweifel/git-auto-commit-action/issues/398">#398</a>)</li> <li><a href="https://github.com/stefanzweifel/git-auto-commit-action/commit/8fa7f5a3c51038deaa521c22ae89fac24baad8e7"><code>8fa7f5a</code></a> Update CHANGELOG</li> <li><a href="https://github.com/stefanzweifel/git-auto-commit-action/commit/28e16e81777b558cc906c8750092100bbb34c5e3"><code>28e16e8</code></a> Release preparations for v7 (<a href="https://redirect.github.com/stefanzweifel/git-auto-commit-action/issues/394">#394</a>)</li> <li><a href="https://github.com/stefanzweifel/git-auto-commit-action/commit/698fd76863f4609be5d51f1d1fe685aa92f062e9"><code>698fd76</code></a> Merge pull request <a href="https://redirect.github.com/stefanzweifel/git-auto-commit-action/issues/391">#391</a> from EliasBoulharts/custom-tag-message</li> <li><a href="https://github.com/stefanzweifel/git-auto-commit-action/commit/c40819ab3b7619623b7d0d760f3296f014f245b8"><code>c40819a</code></a> Update README</li> <li><a href="https://github.com/stefanzweifel/git-auto-commit-action/commit/d7ee275235b337d03e77815bd319db607e2b455b"><code>d7ee275</code></a> Change internal variable names</li> <li><a href="https://github.com/stefanzweifel/git-auto-commit-action/commit/e8684eb0cd3714a844cb825cd29a0afcf6d66dbc"><code>e8684eb</code></a> Fix Tests</li> <li>Additional commits viewable in <a href="https://github.com/stefanzweifel/git-auto-commit-action/compare/778341af668090896ca464160c2def5d1d1a3eb0...04702edda442b2e678b25b537cec683a1493fcb9">compare view</a></li> </ul> </details> <br /> [](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot merge` will merge this PR after your CI passes on it - `@dependabot squash and merge` will squash and merge this PR after your CI passes on it - `@dependabot cancel merge` will cancel a previously requested merge and block automerging - `@dependabot reopen` will reopen this PR if it is closed - `@dependabot close` will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually - `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself) </details> Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Bumps [lodash](https://github.com/lodash/lodash) from 4.17.21 to 4.17.23. <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/lodash/lodash/commit/dec55b7a3b382da075e2eac90089b4cd00a26cbb"><code>dec55b7</code></a> Bump main to v4.17.23 (<a href="https://redirect.github.com/lodash/lodash/issues/6088">#6088</a>)</li> <li><a href="https://github.com/lodash/lodash/commit/19c9251b3631d7cf220b43bc757eb33f1084f117"><code>19c9251</code></a> fix: setCacheHas JSDoc return type should be boolean (<a href="https://redirect.github.com/lodash/lodash/issues/6071">#6071</a>)</li> <li><a href="https://github.com/lodash/lodash/commit/b5e672995ae26929d111a6e94589f8d03fb8e578"><code>b5e6729</code></a> jsdoc: Add -0 and BigInt zeros to _.compact falsey values list (<a href="https://redirect.github.com/lodash/lodash/issues/6062">#6062</a>)</li> <li><a href="https://github.com/lodash/lodash/commit/edadd452146f7e4bad4ea684e955708931d84d81"><code>edadd45</code></a> Prevent prototype pollution on baseUnset function</li> <li><a href="https://github.com/lodash/lodash/commit/4879a7a7d0a4494b0e83c7fa21bcc9fc6e7f1a6d"><code>4879a7a</code></a> doc: fix autoLink function, conversion of source links (<a href="https://redirect.github.com/lodash/lodash/issues/6056">#6056</a>)</li> <li><a href="https://github.com/lodash/lodash/commit/9648f692b0fc7c2f6a7a763d754377200126c2e8"><code>9648f69</code></a> chore: remove <code>yarn.lock</code> file (<a href="https://redirect.github.com/lodash/lodash/issues/6053">#6053</a>)</li> <li><a href="https://github.com/lodash/lodash/commit/dfa407db0bf5b200f2c7a9e4f06830ceaf074be9"><code>dfa407d</code></a> ci: remove legacy configuration files (<a href="https://redirect.github.com/lodash/lodash/issues/6052">#6052</a>)</li> <li><a href="https://github.com/lodash/lodash/commit/156e1965ae78b121a88f81178ab81632304e8d64"><code>156e196</code></a> feat: add renovate setup (<a href="https://redirect.github.com/lodash/lodash/issues/6039">#6039</a>)</li> <li><a href="https://github.com/lodash/lodash/commit/933e1061b8c344d3fc742cdc400175d5ffc99bce"><code>933e106</code></a> ci: add pipeline for Bun (<a href="https://redirect.github.com/lodash/lodash/issues/6023">#6023</a>)</li> <li><a href="https://github.com/lodash/lodash/commit/072a807ff7ad8ffc7c1d2c3097266e815d138e20"><code>072a807</code></a> docs: update links related to Open JS Foundation (<a href="https://redirect.github.com/lodash/lodash/issues/5968">#5968</a>)</li> <li>Additional commits viewable in <a href="https://github.com/lodash/lodash/compare/4.17.21...4.17.23">compare view</a></li> </ul> </details> <br /> [](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) You can trigger a rebase of this PR by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot merge` will merge this PR after your CI passes on it - `@dependabot squash and merge` will squash and merge this PR after your CI passes on it - `@dependabot cancel merge` will cancel a previously requested merge and block automerging - `@dependabot reopen` will reopen this PR if it is closed - `@dependabot close` will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually - `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself) You can disable automated security fix PRs for this repo from the [Security Alerts page](https://github.com/actions/create-github-app-token/network/alerts). </details> > **Note** > Automatic rebases have been disabled on this pull request as it has been open for over 30 days. Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
…ectory with 5 updates (actions#334) Bumps the development-dependencies group with 5 updates in the / directory: | Package | From | To | | --- | --- | --- | | [@sinonjs/fake-timers](https://github.com/sinonjs/fake-timers) | `15.0.0` | `15.1.0` | | [dotenv](https://github.com/motdotla/dotenv) | `17.2.3` | `17.3.1` | | [esbuild](https://github.com/evanw/esbuild) | `0.25.10` | `0.27.3` | | [execa](https://github.com/sindresorhus/execa) | `9.6.0` | `9.6.1` | | [yaml](https://github.com/eemeli/yaml) | `2.8.1` | `2.8.2` | Updates `@sinonjs/fake-timers` from 15.0.0 to 15.1.0 <details> <summary>Changelog</summary> <p><em>Sourced from <a href="https://github.com/sinonjs/fake-timers/blob/main/CHANGELOG.md"><code>@sinonjs/fake-timers</code>'s changelog</a>.</em></p> <blockquote> <h1>15.1.0 / 2025-12-18</h1> <ul> <li>Include stacktrace clear native timers warning (<a href="https://redirect.github.com/sinonjs/fake-timers/issues/529">#529</a>)</li> <li>docs: Update <code>setTickMode</code> docs to mention sinon APIs, not jest (<a href="https://redirect.github.com/sinonjs/fake-timers/issues/527">#527</a>)</li> </ul> </blockquote> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/sinonjs/fake-timers/commit/307815db063b5001f946488292c0093a991c3062"><code>307815d</code></a> 15.1.0</li> <li><a href="https://github.com/sinonjs/fake-timers/commit/d4d0eed1c9432f07f2b4a0dcbba58b388e1fc8c6"><code>d4d0eed</code></a> Updated release files for 15.1.0</li> <li><a href="https://github.com/sinonjs/fake-timers/commit/88145ac11337176d19aadf9dbe0d7a4cd6410abb"><code>88145ac</code></a> Commit lock file</li> <li><a href="https://github.com/sinonjs/fake-timers/commit/4296cb900cd7ea54cff9fec2d346ba73a4be0f60"><code>4296cb9</code></a> Update all</li> <li><a href="https://github.com/sinonjs/fake-timers/commit/c623931fa954dbcb564e65b32a463ea0b2224aff"><code>c623931</code></a> adjustment: only do check on V8 engines</li> <li><a href="https://github.com/sinonjs/fake-timers/commit/d1983d2842886bb01486984b8611082710eb97d6"><code>d1983d2</code></a> Include stacktrace clear native timers warning (<a href="https://redirect.github.com/sinonjs/fake-timers/issues/529">#529</a>)</li> <li><a href="https://github.com/sinonjs/fake-timers/commit/73f52d814aa35e3e702757ca555f7ddaa12e7f53"><code>73f52d8</code></a> docs: Update <code>setTickMode</code> docs to mention sinon APIs, not jest (<a href="https://redirect.github.com/sinonjs/fake-timers/issues/527">#527</a>)</li> <li>See full diff in <a href="https://github.com/sinonjs/fake-timers/compare/v15.0.0...v15.1.0">compare view</a></li> </ul> </details> <br /> Updates `dotenv` from 17.2.3 to 17.3.1 <details> <summary>Changelog</summary> <p><em>Sourced from <a href="https://github.com/motdotla/dotenv/blob/master/CHANGELOG.md">dotenv's changelog</a>.</em></p> <blockquote> <h2><a href="https://github.com/motdotla/dotenv/compare/v17.3.0...v17.3.1">17.3.1</a> (2026-02-12)</h2> <h3>Changed</h3> <ul> <li>Fix as2 example command in README and update spanish README</li> </ul> <h2><a href="https://github.com/motdotla/dotenv/compare/v17.2.4...v17.3.0">17.3.0</a> (2026-02-12)</h2> <h3>Added</h3> <ul> <li>Add a new README section on dotenv’s approach to the agentic future.</li> </ul> <h3>Changed</h3> <ul> <li>Rewrite README to get humans started more quickly with less noise while simultaneously making more accessible for llms and agents to go deeper into details.</li> </ul> <h2><a href="https://github.com/motdotla/dotenv/compare/v17.2.3...v17.2.4">17.2.4</a> (2026-02-05)</h2> <h3>Changed</h3> <ul> <li>Make <code>DotenvPopulateInput</code> accept <code>NodeJS.ProcessEnv</code> type (<a href="https://redirect.github.com/motdotla/dotenv/pull/915">#915</a>)</li> </ul> <ul> <li>Give back to dotenv by checking out my newest project <a href="https://github.com/vestauth/vestauth">vestauth</a>. It is auth for agents. Thank you for using my software.</li> </ul> </blockquote> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/motdotla/dotenv/commit/7bc16a41c9efd4cf4ab8a4614d0ace7fd240b27b"><code>7bc16a4</code></a> 17.3.1</li> <li><a href="https://github.com/motdotla/dotenv/commit/27303fd56321a166d698f0482e0f4d0c51e51c1e"><code>27303fd</code></a> update README-es</li> <li><a href="https://github.com/motdotla/dotenv/commit/6379eb2cae43c27656df8d93509b2c14366811ec"><code>6379eb2</code></a> update README</li> <li><a href="https://github.com/motdotla/dotenv/commit/b6d7339fd085a290669af8e601331c13b4dd2920"><code>b6d7339</code></a> fix spelling</li> <li><a href="https://github.com/motdotla/dotenv/commit/5febe352d4dd499bfaa73de808a56bf03a268b6b"><code>5febe35</code></a> 17.3.0</li> <li><a href="https://github.com/motdotla/dotenv/commit/f61f3832c438078fc5d6552f59fac0c0205eca98"><code>f61f383</code></a> changelog 🪵</li> <li><a href="https://github.com/motdotla/dotenv/commit/dec94ad828acba99e3a8570ecf12a1081f9c189c"><code>dec94ad</code></a> update README</li> <li><a href="https://github.com/motdotla/dotenv/commit/485695052c82c26024fbb8568babb0770756dd06"><code>4856950</code></a> update README</li> <li><a href="https://github.com/motdotla/dotenv/commit/6351887077957c5ee74c3528bccbf5512b184b2e"><code>6351887</code></a> update README</li> <li><a href="https://github.com/motdotla/dotenv/commit/23bd017381f1ab5e4fcdeaebe2e134aaef644a4c"><code>23bd017</code></a> update README</li> <li>Additional commits viewable in <a href="https://github.com/motdotla/dotenv/compare/v17.2.3...v17.3.1">compare view</a></li> </ul> </details> <br /> Updates `esbuild` from 0.25.10 to 0.27.3 <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/evanw/esbuild/releases">esbuild's releases</a>.</em></p> <blockquote> <h2>v0.27.3</h2> <ul> <li> <p>Preserve URL fragments in data URLs (<a href="https://redirect.github.com/evanw/esbuild/issues/4370">#4370</a>)</p> <p>Consider the following HTML, CSS, and SVG:</p> <ul> <li> <p><code>index.html</code>:</p> <pre lang="html"><code><!DOCTYPE html> <html> <head><link rel="stylesheet" href="icons.css"></head> <body><div class="triangle"></div></body> </html> </code></pre> </li> <li> <p><code>icons.css</code>:</p> <pre lang="css"><code>.triangle { width: 10px; height: 10px; background: currentColor; clip-path: url(./triangle.svg#x); } </code></pre> </li> <li> <p><code>triangle.svg</code>:</p> <pre lang="xml"><code><svg xmlns="http://www.w3.org/2000/svg"> <defs> <clipPath id="x"> <path d="M0 0H10V10Z"/> </clipPath> </defs> </svg> </code></pre> </li> </ul> <p>The CSS uses a URL fragment (the <code>#x</code>) to reference the <code>clipPath</code> element in the SVG file. Previously esbuild's CSS bundler didn't preserve the URL fragment when bundling the SVG using the <code>dataurl</code> loader, which broke the bundled CSS. With this release, esbuild will now preserve the URL fragment in the bundled CSS:</p> <pre lang="css"><code>/* icons.css */ .triangle { width: 10px; height: 10px; background: currentColor; clip-path: url('data:image/svg+xml,<svg xmlns="http://www.w3.org/2000/svg"><defs><clipPath id="x"><path d="M0 0H10V10Z"/></clipPath></defs></svg>#x'); } </code></pre> </li> </ul> <!-- raw HTML omitted --> </blockquote> <p>... (truncated)</p> </details> <details> <summary>Changelog</summary> <p><em>Sourced from <a href="https://github.com/evanw/esbuild/blob/main/CHANGELOG.md">esbuild's changelog</a>.</em></p> <blockquote> <h2>0.27.3</h2> <ul> <li> <p>Preserve URL fragments in data URLs (<a href="https://redirect.github.com/evanw/esbuild/issues/4370">#4370</a>)</p> <p>Consider the following HTML, CSS, and SVG:</p> <ul> <li> <p><code>index.html</code>:</p> <pre lang="html"><code><!DOCTYPE html> <html> <head><link rel="stylesheet" href="icons.css"></head> <body><div class="triangle"></div></body> </html> </code></pre> </li> <li> <p><code>icons.css</code>:</p> <pre lang="css"><code>.triangle { width: 10px; height: 10px; background: currentColor; clip-path: url(./triangle.svg#x); } </code></pre> </li> <li> <p><code>triangle.svg</code>:</p> <pre lang="xml"><code><svg xmlns="http://www.w3.org/2000/svg"> <defs> <clipPath id="x"> <path d="M0 0H10V10Z"/> </clipPath> </defs> </svg> </code></pre> </li> </ul> <p>The CSS uses a URL fragment (the <code>#x</code>) to reference the <code>clipPath</code> element in the SVG file. Previously esbuild's CSS bundler didn't preserve the URL fragment when bundling the SVG using the <code>dataurl</code> loader, which broke the bundled CSS. With this release, esbuild will now preserve the URL fragment in the bundled CSS:</p> <pre lang="css"><code>/* icons.css */ .triangle { width: 10px; height: 10px; background: currentColor; clip-path: url('data:image/svg+xml,<svg xmlns="http://www.w3.org/2000/svg"><defs><clipPath id="x"><path d="M0 0H10V10Z"/></clipPath></defs></svg>#x'); } </code></pre> </li> </ul> <!-- raw HTML omitted --> </blockquote> <p>... (truncated)</p> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/evanw/esbuild/commit/9129e00e6c36a3e374820cb5e3fc2cd319c8ab85"><code>9129e00</code></a> publish 0.27.3 to npm</li> <li><a href="https://github.com/evanw/esbuild/commit/e20e4115acda9c9f052fdd1ec8d7d5c5489e837b"><code>e20e411</code></a> small fix to release notes</li> <li><a href="https://github.com/evanw/esbuild/commit/0dc0f2dee556460bd7b81d5bbbae5a2f86449ab6"><code>0dc0f2d</code></a> fix <a href="https://redirect.github.com/evanw/esbuild/issues/4322">#4322</a>: parse and print CSS <code>@scope</code> rules</li> <li><a href="https://github.com/evanw/esbuild/commit/55fe39164cd3429fcb92c6f358a8dfe2f6e6e559"><code>55fe391</code></a> update firefox css gradient support</li> <li><a href="https://github.com/evanw/esbuild/commit/2c35297c7ad249a51b9cc3974fa91f74dc13f68c"><code>2c35297</code></a> update gradient lowering transform</li> <li><a href="https://github.com/evanw/esbuild/commit/9209e4445abe7610018f0f758fd5d1fa13ec3ea8"><code>9209e44</code></a> Update Go to 1.25.7 (<a href="https://redirect.github.com/evanw/esbuild/issues/4388">#4388</a>)</li> <li><a href="https://github.com/evanw/esbuild/commit/e8d861b68cf8c3c3a4806ec87444ee48b9af1ade"><code>e8d861b</code></a> close <a href="https://redirect.github.com/evanw/esbuild/issues/4374">#4374</a>: compat table for the <code>using</code> feature</li> <li><a href="https://github.com/evanw/esbuild/commit/19b8887368396934957abd75f316cc069d6cc067"><code>19b8887</code></a> no longer need <code>williamkapke/node-compat-table</code></li> <li><a href="https://github.com/evanw/esbuild/commit/7e442189722b54bc6c574ae1148e1014d99e5f32"><code>7e44218</code></a> the <code>kangax/compat-table</code> repo moved to a new url</li> <li><a href="https://github.com/evanw/esbuild/commit/23b9338ed5efbdfa29d59b8b0d8088b1761fdc39"><code>23b9338</code></a> run <code>make update-compat-table</code></li> <li>Additional commits viewable in <a href="https://github.com/evanw/esbuild/compare/v0.25.10...v0.27.3">compare view</a></li> </ul> </details> <details> <summary>Maintainer changes</summary> <p>This version was pushed to npm by [GitHub Actions](<a href="https://www.npmjs.com/~GitHub">https://www.npmjs.com/~GitHub</a> Actions), a new releaser for esbuild since your current version.</p> </details> <br /> Updates `execa` from 9.6.0 to 9.6.1 <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/sindresorhus/execa/releases">execa's releases</a>.</em></p> <blockquote> <h2>v9.6.1</h2> <ul> <li>Fix <code>VerboseOption</code> type not being properly exported (<a href="https://redirect.github.com/sindresorhus/execa/issues/1215">#1215</a>) 7891c39</li> </ul> <hr /> <p><a href="https://github.com/sindresorhus/execa/compare/v9.6.0...v9.6.1">https://github.com/sindresorhus/execa/compare/v9.6.0...v9.6.1</a></p> </blockquote> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/sindresorhus/execa/commit/84e1f36b2c31a463e3efbd37c7505da9438a05c9"><code>84e1f36</code></a> 9.6.1</li> <li><a href="https://github.com/sindresorhus/execa/commit/7891c39441c5a6d0fca4be696c0c1cf0b746fa1e"><code>7891c39</code></a> Fix <code>VerboseOption</code> type not being properly exported (<a href="https://redirect.github.com/sindresorhus/execa/issues/1215">#1215</a>)</li> <li><a href="https://github.com/sindresorhus/execa/commit/103095f2c9a459ae3500fa7d861f162c21a94b3a"><code>103095f</code></a> Meta tweaks</li> <li><a href="https://github.com/sindresorhus/execa/commit/23ec6f0569b3e42af43294dc807494ebe896e980"><code>23ec6f0</code></a> Fix CI tests related to <code>.kill(0)</code> (<a href="https://redirect.github.com/sindresorhus/execa/issues/1212">#1212</a>)</li> <li><a href="https://github.com/sindresorhus/execa/commit/9a2cb79b1120f3b476aa8a452ceaeb71bfa19a2d"><code>9a2cb79</code></a> Meta tweaks</li> <li><a href="https://github.com/sindresorhus/execa/commit/e7cafebf55e19485a9d4bdf5af9ed5d2c82fe0d8"><code>e7cafeb</code></a> [docs] TTY control is lost only on the FD that uses mixed inherit. (<a href="https://redirect.github.com/sindresorhus/execa/issues/1209">#1209</a>)</li> <li><a href="https://github.com/sindresorhus/execa/commit/5587ae1dcb9b258b0d9667219100b197de50594f"><code>5587ae1</code></a> Fix CI tests (<a href="https://redirect.github.com/sindresorhus/execa/issues/1207">#1207</a>)</li> <li><a href="https://github.com/sindresorhus/execa/commit/3e8fa32d498dcc57f1da447524bdb6b521fbd603"><code>3e8fa32</code></a> [docs] A process is not a TTY usually, just connected to one. (<a href="https://redirect.github.com/sindresorhus/execa/issues/1208">#1208</a>)</li> <li><a href="https://github.com/sindresorhus/execa/commit/c468672a7f212e9040c4405e99f9428d3253a76a"><code>c468672</code></a> [docs] Transforms: Summary: Fix example command and output. (<a href="https://redirect.github.com/sindresorhus/execa/issues/1206">#1206</a>)</li> <li>See full diff in <a href="https://github.com/sindresorhus/execa/compare/v9.6.0...v9.6.1">compare view</a></li> </ul> </details> <br /> Updates `yaml` from 2.8.1 to 2.8.2 <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/eemeli/yaml/releases">yaml's releases</a>.</em></p> <blockquote> <h2>v2.8.2</h2> <ul> <li>Serialize -0 as -0 (<a href="https://redirect.github.com/eemeli/yaml/issues/638">#638</a>)</li> <li>Do not double newlines for empty map values (<a href="https://redirect.github.com/eemeli/yaml/issues/642">#642</a>)</li> </ul> </blockquote> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/eemeli/yaml/commit/086fa6b5bae325da18734750cddee231ce578930"><code>086fa6b</code></a> 2.8.2</li> <li><a href="https://github.com/eemeli/yaml/commit/95f01e98032ddf199b42bb3ba0737303b35ef752"><code>95f01e9</code></a> chore: Add funding to package.json</li> <li><a href="https://github.com/eemeli/yaml/commit/152e204a9255064cc0af4f70b7fa0ac25e324a42"><code>152e204</code></a> style: Apply updated Prettier rules & satisfy updated ESLint</li> <li><a href="https://github.com/eemeli/yaml/commit/3f3378c3bff1663a41f413dbf3c65b9bbb292db7"><code>3f3378c</code></a> chore: Drop unused dependency cross-env</li> <li><a href="https://github.com/eemeli/yaml/commit/f0b9af7b6fba48e0fe4b4a85a64cb3339e5dd7aa"><code>f0b9af7</code></a> chore: Update to <code>@rollup/plugin-replace</code> v6</li> <li><a href="https://github.com/eemeli/yaml/commit/e3cafc70ca0dfac449f25cfa60a426f68c23e061"><code>e3cafc7</code></a> chore: Update to eslint-config-prettier v10</li> <li><a href="https://github.com/eemeli/yaml/commit/553c1b56f1f3a6b23b6f0358322dfbacfc3e80cb"><code>553c1b5</code></a> chore: Refresh lockfile</li> <li><a href="https://github.com/eemeli/yaml/commit/70a8db37c3bd8d6db6e8dddd4a1e9e6fc5a9a3b0"><code>70a8db3</code></a> fix: Do not double newlines for empty map values (<a href="https://redirect.github.com/eemeli/yaml/issues/642">#642</a>)</li> <li><a href="https://github.com/eemeli/yaml/commit/92821f2b8164f9831ff5a51f6e5a575e06365742"><code>92821f2</code></a> ci: Limit action permissions to minimum required</li> <li><a href="https://github.com/eemeli/yaml/commit/95285f82a888781d4ff010b26f9beb6d13778422"><code>95285f8</code></a> fix: Serialize -0 as -0 (fixes <a href="https://redirect.github.com/eemeli/yaml/issues/638">#638</a>)</li> <li>Additional commits viewable in <a href="https://github.com/eemeli/yaml/compare/v2.8.1...v2.8.2">compare view</a></li> </ul> </details> <br /> Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore <dependency name> major version` will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself) - `@dependabot ignore <dependency name> minor version` will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself) - `@dependabot ignore <dependency name>` will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself) - `@dependabot unignore <dependency name>` will remove all of the ignore conditions of the specified dependency - `@dependabot unignore <dependency name> <ignore condition>` will remove the ignore condition of the specified dependency and ignore conditions </details> Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Bumps [tar](https://github.com/isaacs/node-tar) from 7.4.3 to 7.5.11. <details> <summary>Changelog</summary> <p><em>Sourced from <a href="https://github.com/isaacs/node-tar/blob/main/CHANGELOG.md">tar's changelog</a>.</em></p> <blockquote> <h1>Changelog</h1> <h2>7.5</h2> <ul> <li>Added <code>zstd</code> compression support.</li> <li>Consistent TOCTOU behavior in sync t.list</li> <li>Only read from ustar block if not specified in Pax</li> <li>Fix sync tar.list when file size reduces while reading</li> <li>Sanitize absolute linkpaths properly</li> <li>Prevent writing hardlink entries to the archive ahead of their file target</li> </ul> <h2>7.4</h2> <ul> <li>Deprecate <code>onentry</code> in favor of <code>onReadEntry</code> for clarity.</li> </ul> <h2>7.3</h2> <ul> <li>Add <code>onWriteEntry</code> option</li> </ul> <h2>7.2</h2> <ul> <li>DRY the command definitions into a single <code>makeCommand</code> method, and update the type signatures to more appropriately infer the return type from the options and arguments provided.</li> </ul> <h2>7.1</h2> <ul> <li>Update minipass to v7.1.0</li> <li>Update the type definitions of <code>write()</code> and <code>end()</code> methods on <code>Unpack</code> and <code>Parser</code> classes to be compatible with the NodeJS.WritableStream type in the latest versions of <code>@types/node</code>.</li> </ul> <h2>7.0</h2> <ul> <li>Drop support for node <18</li> <li>Rewrite in TypeScript, provide ESM and CommonJS hybrid interface</li> <li>Add tree-shake friendly exports, like <code>import('tar/create')</code> and <code>import('tar/read-entry')</code> to get individual functions or classes.</li> <li>Add <code>chmod</code> option that defaults to false, and deprecate <code>noChmod</code>. That is, reverse the default option regarding explicitly setting file system modes to match tar entry settings.</li> <li>Add <code>processUmask</code> option to avoid having to call <code>process.umask()</code> when <code>chmod: true</code> (or <code>noChmod: false</code>) is set.</li> </ul> <!-- raw HTML omitted --> </blockquote> <p>... (truncated)</p> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/isaacs/node-tar/commit/bf776f673164215074b62749e0fe80e5834588f4"><code>bf776f6</code></a> 7.5.11</li> <li><a href="https://github.com/isaacs/node-tar/commit/f48b5fa3b7985ddab96dc0f2125a4ffc9911b6ad"><code>f48b5fa</code></a> prevent escaping symlinks with drive-relative paths</li> <li><a href="https://github.com/isaacs/node-tar/commit/97cff15d3539a37a4095eb3d287147d9d77c2dc3"><code>97cff15</code></a> docs: more security info</li> <li><a href="https://github.com/isaacs/node-tar/commit/2b72abc1d47c3570e1ad95c9ab557fc4c2e6e4b1"><code>2b72abc</code></a> 7.5.10</li> <li><a href="https://github.com/isaacs/node-tar/commit/7bc755dd85e623c0279e08eb3784909e6d7e4b9f"><code>7bc755d</code></a> parse root off paths before sanitizing .. parts</li> <li><a href="https://github.com/isaacs/node-tar/commit/c8cb84629dee649feedde03f2f4ea48f2e44e778"><code>c8cb846</code></a> update deps</li> <li><a href="https://github.com/isaacs/node-tar/commit/1f0c2c9006b10199cf2686f8ef43e79a1773e1aa"><code>1f0c2c9</code></a> 7.5.9</li> <li><a href="https://github.com/isaacs/node-tar/commit/fbb08518bf290733b68ca4d4135f75becf73fd75"><code>fbb0851</code></a> build minified version as default export</li> <li><a href="https://github.com/isaacs/node-tar/commit/6b8eba0ef367ac937e703238daa6df94ae6f823f"><code>6b8eba0</code></a> 7.5.8</li> <li><a href="https://github.com/isaacs/node-tar/commit/2cb1120bcefe28d7ecc719b41441ade59c52e384"><code>2cb1120</code></a> fix(unpack): improve UnpackSync symlink error "into" path accuracy</li> <li>Additional commits viewable in <a href="https://github.com/isaacs/node-tar/compare/v7.4.3...v7.5.11">compare view</a></li> </ul> </details> <details> <summary>Maintainer changes</summary> <p>This version was pushed to npm by <a href="https://www.npmjs.com/~isaacs">isaacs</a>, a new releaser for tar since your current version.</p> </details> <details> <summary>Install script changes</summary> <p>This version adds <code>prepare</code> script that runs during installation. Review the package contents before updating.</p> </details> <br /> [](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself) You can disable automated security fix PRs for this repo from the [Security Alerts page](https://github.com/actions/create-github-app-token/network/alerts). </details> Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Bumps [undici](https://github.com/nodejs/undici) from 7.16.0 to 7.18.2. <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/nodejs/undici/releases">undici's releases</a>.</em></p> <blockquote> <h2>v7.18.2</h2> <h2>⚠️ Security Release</h2> <p>This fixes <a href="https://github.com/nodejs/undici/security/advisories/GHSA-g9mf-h72j-4rw9">https://github.com/nodejs/undici/security/advisories/GHSA-g9mf-h72j-4rw9</a> and CVE-2026-22036.</p> <h2>What's Changed</h2> <ul> <li>fix(decompress): limit Content-Encoding chain to 5 to prevent resourc… by <a href="https://github.com/mcollina"><code>@mcollina</code></a> in <a href="https://redirect.github.com/nodejs/undici/pull/4729">nodejs/undici#4729</a></li> </ul> <p><strong>Full Changelog</strong>: <a href="https://github.com/nodejs/undici/compare/v7.18.1...v7.18.2">https://github.com/nodejs/undici/compare/v7.18.1...v7.18.2</a></p> <h2>v7.18.1</h2> <h2>What's Changed</h2> <ul> <li>Test and Fix running without SSL by <a href="https://github.com/mcollina"><code>@mcollina</code></a> in <a href="https://redirect.github.com/nodejs/undici/pull/4727">nodejs/undici#4727</a></li> <li>docs: add security warning for strictContentLength option by <a href="https://github.com/mcollina"><code>@mcollina</code></a> in <a href="https://redirect.github.com/nodejs/undici/pull/4726">nodejs/undici#4726</a></li> <li>build(deps): bump step-security/harden-runner from 2.13.1 to 2.14.0 by <a href="https://github.com/dependabot"><code>@dependabot</code></a>[bot] in <a href="https://redirect.github.com/nodejs/undici/pull/4718">nodejs/undici#4718</a></li> <li>build(deps): bump actions/checkout from 6.0.0 to 6.0.1 by <a href="https://github.com/dependabot"><code>@dependabot</code></a>[bot] in <a href="https://redirect.github.com/nodejs/undici/pull/4719">nodejs/undici#4719</a></li> </ul> <p><strong>Full Changelog</strong>: <a href="https://github.com/nodejs/undici/compare/v7.18.0...v7.18.1">https://github.com/nodejs/undici/compare/v7.18.0...v7.18.1</a></p> <h2>v7.18.0</h2> <h2>What's Changed</h2> <p><strong>Full Changelog</strong>: <a href="https://github.com/nodejs/undici/compare/v7.17.0...v7.18.0">https://github.com/nodejs/undici/compare/v7.17.0...v7.18.0</a></p> <h2>v7.17.0</h2> <h2>What's Changed</h2> <ul> <li>chore: extract infra and encoding methods by <a href="https://github.com/Uzlopak"><code>@Uzlopak</code></a> in <a href="https://redirect.github.com/nodejs/undici/pull/4523">nodejs/undici#4523</a></li> <li>ci: remove h2 by <a href="https://github.com/Uzlopak"><code>@Uzlopak</code></a> in <a href="https://redirect.github.com/nodejs/undici/pull/4534">nodejs/undici#4534</a></li> <li>ci: make nodejs-shared wf reusable, install binaryen for wasm-opt, test on node-nightly by <a href="https://github.com/Uzlopak"><code>@Uzlopak</code></a> in <a href="https://redirect.github.com/nodejs/undici/pull/4535">nodejs/undici#4535</a></li> <li>ci: fix nightly shared library case by <a href="https://github.com/Uzlopak"><code>@Uzlopak</code></a> in <a href="https://redirect.github.com/nodejs/undici/pull/4543">nodejs/undici#4543</a></li> <li>test: consume bodies of fetch responses to fix failing macos 20 ci by <a href="https://github.com/Uzlopak"><code>@Uzlopak</code></a> in <a href="https://redirect.github.com/nodejs/undici/pull/4528">nodejs/undici#4528</a></li> <li>docs: add Cache Interceptor example to README by <a href="https://github.com/tawseefnabi"><code>@tawseefnabi</code></a> in <a href="https://redirect.github.com/nodejs/undici/pull/4393">nodejs/undici#4393</a></li> <li>test: remove node20 version check by <a href="https://github.com/Uzlopak"><code>@Uzlopak</code></a> in <a href="https://redirect.github.com/nodejs/undici/pull/4544">nodejs/undici#4544</a></li> <li>types: use MessagePort instance type in MessageEvent by <a href="https://github.com/Renegade334"><code>@Renegade334</code></a> in <a href="https://redirect.github.com/nodejs/undici/pull/4546">nodejs/undici#4546</a></li> <li>ci: set write permissions on job level by <a href="https://github.com/Uzlopak"><code>@Uzlopak</code></a> in <a href="https://redirect.github.com/nodejs/undici/pull/4537">nodejs/undici#4537</a></li> <li>lint: activate n/no-process-exit by <a href="https://github.com/Uzlopak"><code>@Uzlopak</code></a> in <a href="https://redirect.github.com/nodejs/undici/pull/4548">nodejs/undici#4548</a></li> <li>ci: run benchmarks on pull_requests and by pushing on specific branches only by <a href="https://github.com/Uzlopak"><code>@Uzlopak</code></a> in <a href="https://redirect.github.com/nodejs/undici/pull/4536">nodejs/undici#4536</a></li> <li>chore: activate n/prefer-node-protocol to enforce <code>'node:'</code> prefix for requiring node built-ins by <a href="https://github.com/Uzlopak"><code>@Uzlopak</code></a> in <a href="https://redirect.github.com/nodejs/undici/pull/4547">nodejs/undici#4547</a></li> <li>feat(H2): correct CONNECT behaviour by <a href="https://github.com/metcoder95"><code>@metcoder95</code></a> in <a href="https://redirect.github.com/nodejs/undici/pull/4541">nodejs/undici#4541</a></li> <li>test: fix plans by <a href="https://github.com/Uzlopak"><code>@Uzlopak</code></a> in <a href="https://redirect.github.com/nodejs/undici/pull/4550">nodejs/undici#4550</a></li> <li>feat: add runtime feature "detection" by <a href="https://github.com/Uzlopak"><code>@Uzlopak</code></a> in <a href="https://redirect.github.com/nodejs/undici/pull/4545">nodejs/undici#4545</a></li> <li>perf: use less promises in extractBody by <a href="https://github.com/Uzlopak"><code>@Uzlopak</code></a> in <a href="https://redirect.github.com/nodejs/undici/pull/4458">nodejs/undici#4458</a></li> <li>fix(proxy-agent): add missing return after callback-call by <a href="https://github.com/Uzlopak"><code>@Uzlopak</code></a> in <a href="https://redirect.github.com/nodejs/undici/pull/4553">nodejs/undici#4553</a></li> <li>fix: remove redundant line in retry-handler by <a href="https://github.com/Uzlopak"><code>@Uzlopak</code></a> in <a href="https://redirect.github.com/nodejs/undici/pull/4554">nodejs/undici#4554</a></li> <li>ci: add no-wasm-simd option by <a href="https://github.com/Uzlopak"><code>@Uzlopak</code></a> in <a href="https://redirect.github.com/nodejs/undici/pull/4533">nodejs/undici#4533</a></li> <li>fix: use lazyloaders for runtime feature detection by <a href="https://github.com/Uzlopak"><code>@Uzlopak</code></a> in <a href="https://redirect.github.com/nodejs/undici/pull/4557">nodejs/undici#4557</a></li> <li>fix: minor changes in dispatcher-base.js and types for Dispatcher by <a href="https://github.com/Uzlopak"><code>@Uzlopak</code></a> in <a href="https://redirect.github.com/nodejs/undici/pull/4556">nodejs/undici#4556</a></li> </ul> <!-- raw HTML omitted --> </blockquote> <p>... (truncated)</p> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/nodejs/undici/commit/7e5cb2d7468633b48679627061d696a0bb45f651"><code>7e5cb2d</code></a> Bumped v7.18.2 (<a href="https://redirect.github.com/nodejs/undici/issues/4730">#4730</a>)</li> <li><a href="https://github.com/nodejs/undici/commit/b04e3cbb569c1596f86c108e9b52c79d8475dcb3"><code>b04e3cb</code></a> fix(decompress): limit Content-Encoding chain to 5 to prevent resource exhaus...</li> <li><a href="https://github.com/nodejs/undici/commit/2bcb77bbc27f966ac86e31154161792a4a8dadf5"><code>2bcb77b</code></a> Bumped v7.18.1 (<a href="https://redirect.github.com/nodejs/undici/issues/4728">#4728</a>)</li> <li><a href="https://github.com/nodejs/undici/commit/58a12b7f19f5d4b186c90aed2e3a55a3ba37decf"><code>58a12b7</code></a> build(deps): bump actions/checkout from 6.0.0 to 6.0.1 (<a href="https://redirect.github.com/nodejs/undici/issues/4719">#4719</a>)</li> <li><a href="https://github.com/nodejs/undici/commit/5fa2930582cab9c387df5cb2ddef44cb42bdf4a9"><code>5fa2930</code></a> build(deps): bump step-security/harden-runner from 2.13.1 to 2.14.0 (<a href="https://redirect.github.com/nodejs/undici/issues/4718">#4718</a>)</li> <li><a href="https://github.com/nodejs/undici/commit/fbbe283fc4054c35ad21316bcf65996b0929ed58"><code>fbbe283</code></a> docs: add security warning for strictContentLength option (<a href="https://redirect.github.com/nodejs/undici/issues/4726">#4726</a>)</li> <li><a href="https://github.com/nodejs/undici/commit/ce12d9e5dc1a72724cbef8ac43219ba9643b9142"><code>ce12d9e</code></a> fix: do not crash if Node.js is compiled without SSL (<a href="https://redirect.github.com/nodejs/undici/issues/4727">#4727</a>)</li> <li><a href="https://github.com/nodejs/undici/commit/ebe3e33ea4d25402e0dc12dcc67902fdb7f231d4"><code>ebe3e33</code></a> Bumped v7.18.0 (<a href="https://redirect.github.com/nodejs/undici/issues/4725">#4725</a>)</li> <li><a href="https://github.com/nodejs/undici/commit/4e9b88b1c78349a956babef1151add83866f2dfb"><code>4e9b88b</code></a> fix: limit Content-Encoding chain to 5 to prevent resource exhaustion</li> <li><a href="https://github.com/nodejs/undici/commit/d5607677d444553183b0a637f687d20167427b36"><code>d560767</code></a> Bumped v7.17.0 (<a href="https://redirect.github.com/nodejs/undici/issues/4724">#4724</a>)</li> <li>Additional commits viewable in <a href="https://github.com/nodejs/undici/compare/v7.16.0...v7.18.2">compare view</a></li> </ul> </details> <br /> [](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) You can trigger a rebase of this PR by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot merge` will merge this PR after your CI passes on it - `@dependabot squash and merge` will squash and merge this PR after your CI passes on it - `@dependabot cancel merge` will cancel a previously requested merge and block automerging - `@dependabot reopen` will reopen this PR if it is closed - `@dependabot close` will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually - `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself) You can disable automated security fix PRs for this repo from the [Security Alerts page](https://github.com/actions/create-github-app-token/network/alerts). </details> > **Note** > Automatic rebases have been disabled on this pull request as it has been open for over 30 days. Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Bumps [minimatch](https://github.com/isaacs/minimatch) from 9.0.5 to 9.0.9. <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/isaacs/minimatch/commit/8a10e473e2e0ff03c2d4de308f257093af2bce21"><code>8a10e47</code></a> 9.0.9</li> <li><a href="https://github.com/isaacs/minimatch/commit/c6f180636cebd4de2f9af7ef29ca4c9bf2eeef02"><code>c6f1806</code></a> brace-expansion@2</li> <li><a href="https://github.com/isaacs/minimatch/commit/446cfa3e2aa3ef45bd4a27fa4418221e158489f6"><code>446cfa3</code></a> 9.0.8</li> <li><a href="https://github.com/isaacs/minimatch/commit/8fa151ab95fd4e2acd6e1a81f10d02dc7c1098d3"><code>8fa151a</code></a> docs: add warning about ReDoS</li> <li><a href="https://github.com/isaacs/minimatch/commit/71b78a2a4cad3a40af08a39c065e71bbf69ea7f7"><code>71b78a2</code></a> fix partial matching of globstar patterns</li> <li><a href="https://github.com/isaacs/minimatch/commit/2de496f6d9362dd92460f35ffa6ff8de2907244b"><code>2de496f</code></a> 9.0.7</li> <li><a href="https://github.com/isaacs/minimatch/commit/0d4616de9193bf1d359271662e92657bb51b2f75"><code>0d4616d</code></a> limit nested extglob recursion, flatten extglobs</li> <li><a href="https://github.com/isaacs/minimatch/commit/7117ef381e74deace1c62a74d2298c8fe61d10ca"><code>7117ef3</code></a> 9.0.6</li> <li><a href="https://github.com/isaacs/minimatch/commit/2418458b7fe82e0a1fd1a1b6f618c41c90b9848a"><code>2418458</code></a> update deps, do not checkin dist</li> <li><a href="https://github.com/isaacs/minimatch/commit/1d1f531009d5e4a86083de37e5ef3f301e073986"><code>1d1f531</code></a> update deps</li> <li>Additional commits viewable in <a href="https://github.com/isaacs/minimatch/compare/v9.0.5...v9.0.9">compare view</a></li> </ul> </details> <br /> [](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself) You can disable automated security fix PRs for this repo from the [Security Alerts page](https://github.com/actions/create-github-app-token/network/alerts). </details> Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Bumps [@actions/core](https://github.com/actions/toolkit/tree/HEAD/packages/core) from 1.11.1 to 3.0.0. <details> <summary>Changelog</summary> <p><em>Sourced from <a href="https://github.com/actions/toolkit/blob/main/packages/core/RELEASES.md"><code>@actions/core</code>'s changelog</a>.</em></p> <blockquote> <h2>3.0.0</h2> <ul> <li><strong>Breaking change</strong>: Package is now ESM-only <ul> <li>CommonJS consumers must use dynamic <code>import()</code> instead of <code>require()</code></li> </ul> </li> </ul> <h2>2.0.3</h2> <ul> <li>Bump <code>@actions/http-client</code> to <code>3.0.2</code></li> </ul> <h2>2.0.1</h2> <ul> <li>Bump <code>@actions/exec</code> from 1.1.1 to 2.0.0 <a href="https://redirect.github.com/actions/toolkit/pull/2199">#2199</a></li> </ul> <h2>2.0.0</h2> <ul> <li>Add support for Node 24 <a href="https://redirect.github.com/actions/toolkit/pull/2110">#2110</a></li> <li>Bump <code>@actions/http-client</code> from 2.0.1 to 3.0.0</li> </ul> </blockquote> </details> <details> <summary>Commits</summary> <ul> <li>See full diff in <a href="https://github.com/actions/toolkit/commits/HEAD/packages/core">compare view</a></li> </ul> </details> <details> <summary>Maintainer changes</summary> <p>This version was pushed to npm by [GitHub Actions](<a href="https://www.npmjs.com/~GitHub">https://www.npmjs.com/~GitHub</a> Actions), a new releaser for <code>@actions/core</code> since your current version.</p> </details> <br /> [](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself) </details> --------- Co-authored-by: Parker Brown <17183625+parkerbxyz@users.noreply.github.com> Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
…ions#336) Bumps the production-dependencies group with 4 updates: [@octokit/auth-app](https://github.com/octokit/auth-app.js), [@octokit/request](https://github.com/octokit/request.js), [p-retry](https://github.com/sindresorhus/p-retry) and [undici](https://github.com/nodejs/undici). Updates `@octokit/auth-app` from 8.1.2 to 8.2.0 <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/octokit/auth-app.js/releases"><code>@octokit/auth-app</code>'s releases</a>.</em></p> <blockquote> <h2>v8.2.0</h2> <h1><a href="https://github.com/octokit/auth-app.js/compare/v8.1.2...v8.2.0">8.2.0</a> (2026-02-03)</h1> <h3>Features</h3> <ul> <li>handling exp is too far in the future (<a href="https://redirect.github.com/octokit/auth-app.js/issues/699">#699</a>) (<a href="https://github.com/octokit/auth-app.js/commit/6201580be6cc3f0967c7454d5de92db35e353041">6201580</a>)</li> <li>Add enterprise installation route to JWT-authenticated routes (<a href="https://redirect.github.com/octokit/auth-app.js/issues/736">#736</a>) (<a href="https://github.com/octokit/auth-app.js/commit/5b218af8ee91347b25ef944aac76932e45b997d0">5b218af</a>)</li> </ul> </blockquote> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/octokit/auth-app.js/commit/6201580be6cc3f0967c7454d5de92db35e353041"><code>6201580</code></a> feat: handling exp is too far in the future (<a href="https://redirect.github.com/octokit/auth-app.js/issues/699">#699</a>)</li> <li><a href="https://github.com/octokit/auth-app.js/commit/5b218af8ee91347b25ef944aac76932e45b997d0"><code>5b218af</code></a> Add enterprise installation route to JWT-authenticated routes (<a href="https://redirect.github.com/octokit/auth-app.js/issues/736">#736</a>)</li> <li><a href="https://github.com/octokit/auth-app.js/commit/4486c10028249f4f2ffaabeafde986edca92e7b5"><code>4486c10</code></a> build(deps-dev): bump vite from 7.1.7 to 7.1.11 (<a href="https://redirect.github.com/octokit/auth-app.js/issues/728">#728</a>)</li> <li><a href="https://github.com/octokit/auth-app.js/commit/e1fecc4ea8c5475da1a1d9c6c119c9322087dbd4"><code>e1fecc4</code></a> build(deps): bump glob from 10.4.5 to 10.5.0 (<a href="https://redirect.github.com/octokit/auth-app.js/issues/733">#733</a>)</li> <li>See full diff in <a href="https://github.com/octokit/auth-app.js/compare/v8.1.2...v8.2.0">compare view</a></li> </ul> </details> <details> <summary>Maintainer changes</summary> <p>This version was pushed to npm by [GitHub Actions](<a href="https://www.npmjs.com/~GitHub">https://www.npmjs.com/~GitHub</a> Actions), a new releaser for <code>@octokit/auth-app</code> since your current version.</p> </details> <br /> Updates `@octokit/request` from 10.0.7 to 10.0.8 <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/octokit/request.js/releases"><code>@octokit/request</code>'s releases</a>.</em></p> <blockquote> <h2>v10.0.8</h2> <h2><a href="https://github.com/octokit/request.js/compare/v10.0.7...v10.0.8">10.0.8</a> (2026-02-20)</h2> <h3>Bug Fixes</h3> <ul> <li>use <code>json-with-bigint</code> instead of built-in JSON methods in order to properly support int64's (<a href="https://redirect.github.com/octokit/request.js/issues/798">#798</a>) (<a href="https://github.com/octokit/request.js/commit/f13f5d9814cec9e51cdbe57e3864f9a7f95a9731">f13f5d9</a>)</li> </ul> </blockquote> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/octokit/request.js/commit/f13f5d9814cec9e51cdbe57e3864f9a7f95a9731"><code>f13f5d9</code></a> fix: use <code>json-with-bigint</code> instead of built-in JSON methods in order to prop...</li> <li><a href="https://github.com/octokit/request.js/commit/9ba6ae0fd2eff35a6c29a9f032eca6e9ba002976"><code>9ba6ae0</code></a> Document that unsuccessful HTTP status code result in an exception (<a href="https://redirect.github.com/octokit/request.js/issues/795">#795</a>)</li> <li><a href="https://github.com/octokit/request.js/commit/7160b8201ee183d57e3572c9ac78aa3f241c9468"><code>7160b82</code></a> chore(deps): replace glob with tinyglobby (<a href="https://redirect.github.com/octokit/request.js/issues/791">#791</a>)</li> <li><a href="https://github.com/octokit/request.js/commit/ab8018b6d42de25adb305e3ea5ea840ee2805481"><code>ab8018b</code></a> ci(action): update peter-evans/create-or-update-comment action to v5 (<a href="https://redirect.github.com/octokit/request.js/issues/776">#776</a>)</li> <li><a href="https://github.com/octokit/request.js/commit/fb916e454df205980835281368da81a003cde30d"><code>fb916e4</code></a> build(deps): bump vite from 6.3.4 to 6.4.1 (<a href="https://redirect.github.com/octokit/request.js/issues/780">#780</a>)</li> <li><a href="https://github.com/octokit/request.js/commit/e1eb7693969a87cbdde278c82a7474b8acec9207"><code>e1eb769</code></a> chore(deps): update dependency esbuild to ^0.27.0 (<a href="https://redirect.github.com/octokit/request.js/issues/784">#784</a>)</li> <li>See full diff in <a href="https://github.com/octokit/request.js/compare/v10.0.7...v10.0.8">compare view</a></li> </ul> </details> <details> <summary>Maintainer changes</summary> <p>This version was pushed to npm by [GitHub Actions](<a href="https://www.npmjs.com/~GitHub">https://www.npmjs.com/~GitHub</a> Actions), a new releaser for <code>@octokit/request</code> since your current version.</p> </details> <br /> Updates `p-retry` from 7.1.0 to 7.1.1 <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/sindresorhus/p-retry/releases">p-retry's releases</a>.</em></p> <blockquote> <h2>v7.1.1</h2> <ul> <li>Fix delayed abort when signal is already aborted before delay phase 2aba573</li> </ul> <hr /> <p><a href="https://github.com/sindresorhus/p-retry/compare/v7.1.0...v7.1.1">https://github.com/sindresorhus/p-retry/compare/v7.1.0...v7.1.1</a></p> </blockquote> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/sindresorhus/p-retry/commit/0b1e29877422c40b59cad4a4c938dcf44fe512ce"><code>0b1e298</code></a> 7.1.1</li> <li><a href="https://github.com/sindresorhus/p-retry/commit/2aba573c0fdca165c4d95262f51ae56902f2f892"><code>2aba573</code></a> Fix delayed abort when signal is already aborted before delay phase</li> <li><a href="https://github.com/sindresorhus/p-retry/commit/6ac326b188834f4af5a54cedc114f67f0f510613"><code>6ac326b</code></a> Minor tweak</li> <li>See full diff in <a href="https://github.com/sindresorhus/p-retry/compare/v7.1.0...v7.1.1">compare view</a></li> </ul> </details> <br /> Updates `undici` from 7.16.0 to 7.22.0 <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/nodejs/undici/releases">undici's releases</a>.</em></p> <blockquote> <h2>v7.22.0</h2> <h2>What's Changed</h2> <ul> <li>docs: fix syntax highlighting in WebSocket.md by <a href="https://github.com/styfle"><code>@styfle</code></a> in <a href="https://redirect.github.com/nodejs/undici/pull/4814">nodejs/undici#4814</a></li> <li>fix: use OR operator in includesCredentials per WHATWG URL Standard by <a href="https://github.com/jackhax"><code>@jackhax</code></a> in <a href="https://redirect.github.com/nodejs/undici/pull/4816">nodejs/undici#4816</a></li> <li>feat(dispatcher/env-http-proxy-agent): strip leading dot and asterisk by <a href="https://github.com/SuperOleg39"><code>@SuperOleg39</code></a> in <a href="https://redirect.github.com/nodejs/undici/pull/4676">nodejs/undici#4676</a></li> <li>fix: route WebSocket upgrades through onRequestUpgrade by <a href="https://github.com/mcollina"><code>@mcollina</code></a> in <a href="https://redirect.github.com/nodejs/undici/pull/4787">nodejs/undici#4787</a></li> <li>build(deps-dev): bump esbuild from 0.25.12 to 0.27.3 by <a href="https://github.com/dependabot"><code>@dependabot</code></a>[bot] in <a href="https://redirect.github.com/nodejs/undici/pull/4821">nodejs/undici#4821</a></li> <li>fix(deduplicate): do not deduplicate non-safe methods by default by <a href="https://github.com/mcollina"><code>@mcollina</code></a> in <a href="https://redirect.github.com/nodejs/undici/pull/4818">nodejs/undici#4818</a></li> <li>feat: Support async cache stores in revalidation by <a href="https://github.com/marcopiraccini"><code>@marcopiraccini</code></a> in <a href="https://redirect.github.com/nodejs/undici/pull/4826">nodejs/undici#4826</a></li> </ul> <h2>New Contributors</h2> <ul> <li><a href="https://github.com/jackhax"><code>@jackhax</code></a> made their first contribution in <a href="https://redirect.github.com/nodejs/undici/pull/4816">nodejs/undici#4816</a></li> <li><a href="https://github.com/marcopiraccini"><code>@marcopiraccini</code></a> made their first contribution in <a href="https://redirect.github.com/nodejs/undici/pull/4826">nodejs/undici#4826</a></li> </ul> <p><strong>Full Changelog</strong>: <a href="https://github.com/nodejs/undici/compare/v7.21.0...v7.22.0">https://github.com/nodejs/undici/compare/v7.21.0...v7.22.0</a></p> <h2>v7.21.0</h2> <h2>What's Changed</h2> <ul> <li>build(deps): bump actions/setup-node from 6.0.0 to 6.2.0 by <a href="https://github.com/dependabot"><code>@dependabot</code></a>[bot] in <a href="https://redirect.github.com/nodejs/undici/pull/4796">nodejs/undici#4796</a></li> <li>test: restore global dispatcher after fetch tests by <a href="https://github.com/mcollina"><code>@mcollina</code></a> in <a href="https://redirect.github.com/nodejs/undici/pull/4790">nodejs/undici#4790</a></li> <li>Add missing <code>close</code> method to WebSocketStream interface by <a href="https://github.com/piotr-cz"><code>@piotr-cz</code></a> in <a href="https://redirect.github.com/nodejs/undici/pull/4802">nodejs/undici#4802</a></li> <li>fix: error stream instead of canceling by <a href="https://github.com/KhafraDev"><code>@KhafraDev</code></a> in <a href="https://redirect.github.com/nodejs/undici/pull/4804">nodejs/undici#4804</a></li> <li>Fix clientTtl cleanup race in Agent by <a href="https://github.com/mcollina"><code>@mcollina</code></a> in <a href="https://redirect.github.com/nodejs/undici/pull/4807">nodejs/undici#4807</a></li> <li>feat(<a href="https://redirect.github.com/nodejs/undici/issues/4230">#4230</a>): Implement pingInterval for dispatching PING frames by <a href="https://github.com/metcoder95"><code>@metcoder95</code></a> in <a href="https://redirect.github.com/nodejs/undici/pull/4296">nodejs/undici#4296</a></li> <li>fix: handle undefined __filename in bundled environments by <a href="https://github.com/mcollina"><code>@mcollina</code></a> in <a href="https://redirect.github.com/nodejs/undici/pull/4812">nodejs/undici#4812</a></li> <li>fix: set finalizer only for fetch responses by <a href="https://github.com/tsctx"><code>@tsctx</code></a> in <a href="https://redirect.github.com/nodejs/undici/pull/4803">nodejs/undici#4803</a></li> </ul> <h2>New Contributors</h2> <ul> <li><a href="https://github.com/piotr-cz"><code>@piotr-cz</code></a> made their first contribution in <a href="https://redirect.github.com/nodejs/undici/pull/4802">nodejs/undici#4802</a></li> </ul> <p><strong>Full Changelog</strong>: <a href="https://github.com/nodejs/undici/compare/v7.20.0...v7.21.0">https://github.com/nodejs/undici/compare/v7.20.0...v7.21.0</a></p> <h2>v7.20.0</h2> <h2>What's Changed</h2> <ul> <li>fix: preserve fetch stack traces by <a href="https://github.com/mcollina"><code>@mcollina</code></a> in <a href="https://redirect.github.com/nodejs/undici/pull/4778">nodejs/undici#4778</a></li> <li>Fix error handling in MockPool example by <a href="https://github.com/dave-kennedy"><code>@dave-kennedy</code></a> in <a href="https://redirect.github.com/nodejs/undici/pull/4781">nodejs/undici#4781</a></li> <li>feat: expose statusText in request() ResponseData by <a href="https://github.com/domenic"><code>@domenic</code></a> in <a href="https://redirect.github.com/nodejs/undici/pull/4784">nodejs/undici#4784</a></li> <li>test: reduce retry-after invalid date flake by <a href="https://github.com/mcollina"><code>@mcollina</code></a> in <a href="https://redirect.github.com/nodejs/undici/pull/4788">nodejs/undici#4788</a></li> <li>extractBody fixes by <a href="https://github.com/KhafraDev"><code>@KhafraDev</code></a> in <a href="https://redirect.github.com/nodejs/undici/pull/4791">nodejs/undici#4791</a></li> <li>fix: MockAgent delayed response with AbortSignal (<a href="https://redirect.github.com/nodejs/undici/issues/4693">#4693</a>) by <a href="https://github.com/mcollina"><code>@mcollina</code></a> in <a href="https://redirect.github.com/nodejs/undici/pull/4772">nodejs/undici#4772</a></li> <li>fix: onParserTimeout potentially accessing undefined by <a href="https://github.com/vbfox"><code>@vbfox</code></a> in <a href="https://redirect.github.com/nodejs/undici/pull/4758">nodejs/undici#4758</a></li> </ul> <h2>New Contributors</h2> <ul> <li><a href="https://github.com/dave-kennedy"><code>@dave-kennedy</code></a> made their first contribution in <a href="https://redirect.github.com/nodejs/undici/pull/4781">nodejs/undici#4781</a></li> <li><a href="https://github.com/vbfox"><code>@vbfox</code></a> made their first contribution in <a href="https://redirect.github.com/nodejs/undici/pull/4758">nodejs/undici#4758</a></li> </ul> <p><strong>Full Changelog</strong>: <a href="https://github.com/nodejs/undici/compare/v7.19.2...v7.20.0">https://github.com/nodejs/undici/compare/v7.19.2...v7.20.0</a></p> <h2>v7.19.2</h2> <h2>What's Changed</h2> <!-- raw HTML omitted --> </blockquote> <p>... (truncated)</p> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/nodejs/undici/commit/0a236106a3a3e1b0aab424f71de2a68ca2c1d37b"><code>0a23610</code></a> Bumped v7.22.0 (<a href="https://redirect.github.com/nodejs/undici/issues/4829">#4829</a>)</li> <li><a href="https://github.com/nodejs/undici/commit/f3c5c614901e4ba29f2f60730c3d4f28e60a5186"><code>f3c5c61</code></a> feat: Support async cache stores in revalidation (<a href="https://redirect.github.com/nodejs/undici/issues/4826">#4826</a>)</li> <li><a href="https://github.com/nodejs/undici/commit/9b78a44eb21cabe0451263ef8e3cfc7ad8e40876"><code>9b78a44</code></a> fix(deduplicate): avoid deduping methods not in methods option (<a href="https://redirect.github.com/nodejs/undici/issues/4818">#4818</a>)</li> <li><a href="https://github.com/nodejs/undici/commit/0ce57bad2c171a16c043c8234317ef5383f86e0b"><code>0ce57ba</code></a> build(deps-dev): bump esbuild from 0.25.12 to 0.27.3 (<a href="https://redirect.github.com/nodejs/undici/issues/4821">#4821</a>)</li> <li><a href="https://github.com/nodejs/undici/commit/2453caf93824997c24383e5a84fddbfa783113b0"><code>2453caf</code></a> fix: route websocket upgrades through new handler API (<a href="https://redirect.github.com/nodejs/undici/issues/4787">#4787</a>)</li> <li><a href="https://github.com/nodejs/undici/commit/4658cdf5eacf3f6692ec96811a0e49e6b9bc060a"><code>4658cdf</code></a> feat(dispatcher/env-http-proxy-agent): strip leading dot and asterisk (<a href="https://redirect.github.com/nodejs/undici/issues/4676">#4676</a>)</li> <li><a href="https://github.com/nodejs/undici/commit/a821c5669fa653364649d8fb7b36957702c548f5"><code>a821c56</code></a> fix: use OR operator in includesCredentials per WHATWG URL Standard (<a href="https://redirect.github.com/nodejs/undici/issues/4816">#4816</a>)</li> <li><a href="https://github.com/nodejs/undici/commit/b3326b58969e2370a7da77d80dbad4df2f36ca1e"><code>b3326b5</code></a> docs: fix syntax highlighting in WebSocket.md (<a href="https://redirect.github.com/nodejs/undici/issues/4814">#4814</a>)</li> <li><a href="https://github.com/nodejs/undici/commit/393c0da68691a6da8ea0a774e38bcce2889be89e"><code>393c0da</code></a> Bumped v7.21.0 (<a href="https://redirect.github.com/nodejs/undici/issues/4813">#4813</a>)</li> <li><a href="https://github.com/nodejs/undici/commit/47f9b9664759d18d30c3c8f321425bee102e1df3"><code>47f9b96</code></a> fix: set finalizer only for fetch responses (<a href="https://redirect.github.com/nodejs/undici/issues/4803">#4803</a>)</li> <li>Additional commits viewable in <a href="https://github.com/nodejs/undici/compare/v7.16.0...v7.22.0">compare view</a></li> </ul> </details> <br /> Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore <dependency name> major version` will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself) - `@dependabot ignore <dependency name> minor version` will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself) - `@dependabot ignore <dependency name>` will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself) - `@dependabot unignore <dependency name>` will remove all of the ignore conditions of the specified dependency - `@dependabot unignore <dependency name> <ignore condition>` will remove the ignore condition of the specified dependency and ignore conditions </details> Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Co-authored-by: Parker Brown <17183625+parkerbxyz@users.noreply.github.com> Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
## [2.2.2](actions/create-github-app-token@v2.2.1...v2.2.2) (2026-03-13) ### Bug Fixes * **deps:** bump @actions/core from 1.11.1 to 3.0.0 ([actions#337](actions#337)) ([b044133](actions@b044133)) * **deps:** bump minimatch from 9.0.5 to 9.0.9 ([actions#335](actions#335)) ([5cbc656](actions@5cbc656)) * **deps:** bump the production-dependencies group with 4 updates ([actions#336](actions#336)) ([6bda5bc](actions@6bda5bc)) * **deps:** bump undici from 7.16.0 to 7.18.2 ([actions#323](actions#323)) ([b4f638f](actions@b4f638f))
BREAKING CHANGE: Requires [Actions Runner v2.327.1](https://github.com/actions/runner/releases/tag/v2.327.1) or later if you are using a self-hosted runner. --------- Co-authored-by: Parker Brown <17183625+parkerbxyz@users.noreply.github.com> (cherry picked from commit 6178938)
Undici has added native support for proxy handling, so it is no longer necessary for us to have our own custom proxy handling. Reverts actions#102 and resolves actions#134. (cherry picked from commit cda91bf)
BREAKING CHANGE: Custom proxy handling has been removed. If you use HTTP_PROXY or HTTPS_PROXY, you must now also set NODE_USE_ENV_PROXY=1 on the action step.
(cherry picked from commit c2937b0)
AVA stores snapshots in a binary format (`.snap`), which produces no meaningful diffs and bloats Git history. This replaces AVA with the built-in `node:test` module, whose snapshot support generates human-readable text files that are easy to diff and review in pull requests. The migration also replaces `@sinonjs/fake-timers` and `execa` with Node.js built-ins (`node:test` mock timers and `node:child_process`), removing three dev dependencies total. - **`tests/index.js`**: Rewritten to use `node:test` with a custom snapshot serializer that renders strings with actual newlines. Uses subtests for labeled `stderr`/`stdout` snapshots, and only snapshots non-empty output. - **`tests/main-repo-skew.test.js`**: Replace `@sinonjs/fake-timers` with `mock.timers.enable()` from `node:test`. - **`tests/README.md`**: Updated documentation to reflect `node --test` and the new snapshot file. - **`package.json`**: Remove `ava`, `@sinonjs/fake-timers`, and `execa` from devDependencies. Update test script to `c8 --100 node --test tests/index.js`. - **`tests/index.js.snapshot`**: New text-based snapshot file replacing binary `tests/snapshots/index.js.snap`. - **`tests/snapshots/`**: Deleted. All 22 test scenarios (66 subtests) pass with 100% code coverage. Closes actions#344 --------- Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com> (cherry picked from commit f863ba5)
Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com> (cherry picked from commit e295338)
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> (cherry picked from commit b87c921)
Remove unused dotenv.\n\nCo-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> (cherry picked from commit adb92d1)
Regenerate dist bundles and package-lock.json after replaying the release-v3 changes onto next.\n\nCo-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
# [3.0.0](actions/create-github-app-token@v2.2.2...v3.0.0) (2026-03-14) * feat!: node 24 support ([actions#275](actions#275)) ([2e564a0](actions@2e564a0)) * fix!: require `NODE_USE_ENV_PROXY` for proxy support ([actions#342](actions#342)) ([4451bcb](actions@4451bcb)) ### Bug Fixes * remove custom proxy handling ([actions#143](actions#143)) ([dce0ab0](actions@dce0ab0)) ### BREAKING CHANGES * Custom proxy handling has been removed. If you use HTTP_PROXY or HTTPS_PROXY, you must now also set NODE_USE_ENV_PROXY=1 on the action step. * Requires [Actions Runner v2.327.1](https://github.com/actions/runner/releases/tag/v2.327.1) or later if you are using a self-hosted runner.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
3 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Sync Upstream Changes
This pull request applies all changes from the upstream repository
actions/create-github-app-tokenup to and including commitf8d387b.This ensures that
rmd-actions/create-github-app-tokenis up to date with the latest changes from upstream.🤖 This pull request was managed through automation. Please do not modify or close this PR manually.