Repository navigation
Roll up the open dependency bumps; fix the two code scanning alerts - #100
Merged
Merged
Conversation
Bumps [typescript-eslint](https://github.com/typescript-eslint/typescript-eslint/tree/HEAD/packages/typescript-eslint) from 8.71.2 to 8.72.0. - [Release notes](https://github.com/typescript-eslint/typescript-eslint/releases) - [Changelog](https://github.com/typescript-eslint/typescript-eslint/blob/main/packages/typescript-eslint/CHANGELOG.md) - [Commits](https://github.com/typescript-eslint/typescript-eslint/commits/v8.72.0/packages/typescript-eslint) --- updated-dependencies: - dependency-name: typescript-eslint dependency-version: 8.72.0 dependency-type: direct:development update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] <support@github.com>
Bumps [knip](https://github.com/webpro-nl/knip/tree/HEAD/packages/knip) from 6.42.0 to 6.43.0. - [Release notes](https://github.com/webpro-nl/knip/releases) - [Commits](https://github.com/webpro-nl/knip/commits/knip@6.43.0/packages/knip) --- updated-dependencies: - dependency-name: knip dependency-version: 6.43.0 dependency-type: direct:development update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] <support@github.com>
Bumps [preact](https://github.com/preactjs/preact) from 11.0.1 to 11.0.2. - [Release notes](https://github.com/preactjs/preact/releases) - [Commits](preactjs/preact@11.0.1...11.0.2) --- updated-dependencies: - dependency-name: preact dependency-version: 11.0.2 dependency-type: direct:production update-type: version-update:semver-patch ... Signed-off-by: dependabot[bot] <support@github.com>
Bumps [github/codeql-action/analyze](https://github.com/github/codeql-action) from 4.39.0 to 4.39.1. - [Release notes](https://github.com/github/codeql-action/releases) - [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md) - [Commits](github/codeql-action@6f2ac81...9b32540) --- updated-dependencies: - dependency-name: github/codeql-action/analyze dependency-version: 4.39.1 dependency-type: direct:production update-type: version-update:semver-patch ... Signed-off-by: dependabot[bot] <support@github.com>
Bumps [zizmorcore/zizmor-action](https://github.com/zizmorcore/zizmor-action) from 0.7.1 to 0.8.0. - [Release notes](https://github.com/zizmorcore/zizmor-action/releases) - [Commits](zizmorcore/zizmor-action@85b2b9f...53290ba) --- updated-dependencies: - dependency-name: zizmorcore/zizmor-action dependency-version: 0.8.0 dependency-type: direct:production update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] <support@github.com>
Bumps [github/codeql-action/upload-sarif](https://github.com/github/codeql-action) from 4.39.0 to 4.39.1. - [Release notes](https://github.com/github/codeql-action/releases) - [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md) - [Commits](github/codeql-action@6f2ac81...9b32540) --- updated-dependencies: - dependency-name: github/codeql-action/upload-sarif dependency-version: 4.39.1 dependency-type: direct:production update-type: version-update:semver-patch ... Signed-off-by: dependabot[bot] <support@github.com>
Bumps [github/codeql-action/init](https://github.com/github/codeql-action) from 4.39.0 to 4.39.1. - [Release notes](https://github.com/github/codeql-action/releases) - [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md) - [Commits](github/codeql-action@6f2ac81...9b32540) --- updated-dependencies: - dependency-name: github/codeql-action/init dependency-version: 4.39.1 dependency-type: direct:production update-type: version-update:semver-patch ... Signed-off-by: dependabot[bot] <support@github.com>
…/codeql-action/upload-sarif-4.39.1' into chore/deps-rollup
…core/zizmor-action-0.8.0' into chore/deps-rollup
…/codeql-action/analyze-4.39.1' into chore/deps-rollup
…to chore/deps-rollup
… chore/deps-rollup
…-8.72.0' into chore/deps-rollup
…EDITS_CODE Scorecard's Vulnerabilities check flagged minimatch 10.2.6 (GHSA-g3hv-75wg-m249), pulled in by eslint and typescript-eslint, which ask for ^10; the fix is only in 11.0.1. An override takes it to ^11.0.4. Those packages use only new Minimatch(), match() and minimatch(), which 11 keeps. docs/decisions.md says why, and when to drop it. CodeQL flagged EDITS_CODE in the protect-tests hook as unused. The acceptance-test refusal now checks it, as its comment says; the phases reaching that line were already exactly these four, so nothing changes. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Merges the seven open Dependabot PRs. They merged cleanly, and the combined
bun.lockinstalls with--frozen-lockfile:Code scanning:
@eslint/config-arrayand typescript-eslint, which all ask for^10. Anoverridesentry takes it to^11.0.4. All three use onlynew Minimatch(),.match()andminimatch(), which v11 keeps. v11 removed onlymakeRe,regexp,ASTanddebug, and none of the three use them. I checked by hand: eslint still skips an ignored folder and still reports an error insrc/. Why the override exists, and when to drop it, is indocs/decisions.md.EDITS_CODEintemplates/hooks/loopstra-protect-tests.ts). The acceptance-test refusal now checksEDITS_CODE, as its comment says. The phases that reached that line were already exactly those four, so behaviour is unchanged.Not covered here: Dependabot alerts #1–#6 (undici and ip-address bundled inside npm 11.21.1 in
.github/npm). They wait on npm 11.21.2 (npm/cli#10179).Test plan
bun run check(typecheck, lint, deadcode, 2203 tests) passes locally🤖 Generated with Claude Code