actions/create-github-app-token
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity
250 Commits 10 Branches 73 Tags
main
Commit Graph

250 Commits

This Branch
This Branch
All Branches
Author SHA1 Message Date
claude-ceo-assistant a10bdc03bd chore: remove upstream CI workflows (mirror inertization per internal#233) 2026-05-10 14:28:25 +00:00
claude-ceo-assistant 091978f914 chore: remove upstream CI workflows (mirror inertization per internal#233) 2026-05-10 14:28:24 +00:00
claude-ceo-assistant 3a213a9eee chore: remove upstream CI workflows (mirror inertization per internal#233) 2026-05-10 14:28:24 +00:00
claude-ceo-assistant b7bfa13b25 chore: remove upstream CI workflows (mirror inertization per internal#233) 2026-05-10 14:28:23 +00:00
dependabot[bot] c9aabb8372 build(deps-dev): bump yaml from 2.8.3 to 2.8.4 in the development-dependencies group (#371) 
Bumps the development-dependencies group with 1 update:
[yaml](https://github.com/eemeli/yaml).

Updates `yaml` from 2.8.3 to 2.8.4
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/eemeli/yaml/releases">yaml's
releases</a>.</em></p>
<blockquote>
<h2>v2.8.4</h2>
<ul>
<li>Disable alias resolution with <code>maxAliasCount:0</code> (<a
href="https://redirect.github.com/eemeli/yaml/issues/677">#677</a>)</li>
<li>Handle invalid unicode escapes (e1a1a77)</li>
<li>Apply <code>minFractionDigits</code> only to decimal strings (<a
href="https://redirect.github.com/eemeli/yaml/issues/676">#676</a>)</li>
</ul>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/eemeli/yaml/commit/ccdf7439587544f64223429498a1d9ec514eaac1"><code>ccdf743</code></a>
2.8.4</li>
<li><a
href="https://github.com/eemeli/yaml/commit/f625789dbd971c936ff66fe5c49e368062ae7b41"><code>f625789</code></a>
fix: Disable alias resolution with maxAliasCount:0 (<a
href="https://redirect.github.com/eemeli/yaml/issues/677">#677</a>)</li>
<li><a
href="https://github.com/eemeli/yaml/commit/e1a1a7735ff2e9717b87af36795bcd280f85f55d"><code>e1a1a77</code></a>
fix: Handle invalid unicode escapes</li>
<li><a
href="https://github.com/eemeli/yaml/commit/a163ea009c57ab9f1054ca39b24b6ef4c1e9fdbe"><code>a163ea0</code></a>
style: Satify Prettier</li>
<li><a
href="https://github.com/eemeli/yaml/commit/b2a5a6c615673056917aaa04d657802945e81425"><code>b2a5a6c</code></a>
fix: Apply minFractionDigits only to decimal strings (<a
href="https://redirect.github.com/eemeli/yaml/issues/676">#676</a>)</li>
<li><a
href="https://github.com/eemeli/yaml/commit/93c951b3478b4bb061d7b5227fd64f46d3f9df7f"><code>93c951b</code></a>
chore: Bump JSR version to v2.8.3 (<a
href="https://redirect.github.com/eemeli/yaml/issues/673">#673</a>)</li>
<li><a
href="https://github.com/eemeli/yaml/commit/0f226a3f9dfe31dca0b165e0601d233d9a642527"><code>0f226a3</code></a>
docs: Add trailingComma ToString option</li>
<li>See full diff in <a
href="https://github.com/eemeli/yaml/compare/v2.8.3...v2.8.4">compare
view</a></li>
</ul>
</details>
<br />


[![Dependabot compatibility
score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=yaml&package-manager=npm_and_yarn&previous-version=2.8.3&new-version=2.8.4)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)

Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.

[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)

---

<details>
<summary>Dependabot commands and options</summary>
<br />

You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot show <dependency name> ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore <dependency name> major version` will close this
group update PR and stop Dependabot creating any more for the specific
dependency's major version (unless you unignore this specific
dependency's major version or upgrade to it yourself)
- `@dependabot ignore <dependency name> minor version` will close this
group update PR and stop Dependabot creating any more for the specific
dependency's minor version (unless you unignore this specific
dependency's minor version or upgrade to it yourself)
- `@dependabot ignore <dependency name>` will close this group update PR
and stop Dependabot creating any more for the specific dependency
(unless you unignore this specific dependency or upgrade to it yourself)
- `@dependabot unignore <dependency name>` will remove all of the ignore
conditions of the specified dependency
- `@dependabot unignore <dependency name> <ignore condition>` will
remove the ignore condition of the specified dependency and ignore
conditions


</details>

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
 2026-05-08 14:51:43 -07:00
dependabot[bot] e02e816e55 build(deps-dev): bump undici from 7.24.6 to 8.2.0 (#366) 
Bumps [undici](https://github.com/nodejs/undici) from 7.24.6 to 8.2.0.
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/nodejs/undici/releases">undici's
releases</a>.</em></p>
<blockquote>
<h2>v8.2.0</h2>
<h2>What's Changed</h2>
<ul>
<li>chore: use native addAbortListener by <a
href="https://github.com/trivikr"><code>@​trivikr</code></a> in <a
href="https://redirect.github.com/nodejs/undici/pull/5021">nodejs/undici#5021</a></li>
<li>fix: fix the logic for the UNDICI_NO_WASM_SIMD environment variable
by <a
href="https://github.com/ShenHongFei"><code>@​ShenHongFei</code></a> in
<a
href="https://redirect.github.com/nodejs/undici/pull/5026">nodejs/undici#5026</a></li>
<li>fix(http2): send body for non-expectsPayload methods with content by
<a href="https://github.com/mcollina"><code>@​mcollina</code></a> in <a
href="https://redirect.github.com/nodejs/undici/pull/5030">nodejs/undici#5030</a></li>
<li>fix(fetch): correct 'navigator' typo to 'navigate' in fetchFinale by
<a
href="https://github.com/deepview-autofix"><code>@​deepview-autofix</code></a>
in <a
href="https://redirect.github.com/nodejs/undici/pull/5044">nodejs/undici#5044</a></li>
<li>fix(webidl): correct signed integer bounds in ConvertToInt by <a
href="https://github.com/deepview-autofix"><code>@​deepview-autofix</code></a>
in <a
href="https://redirect.github.com/nodejs/undici/pull/5038">nodejs/undici#5038</a></li>
<li>fix(fetch): use || for CRLF check in multipart formdata-parser by <a
href="https://github.com/deepview-autofix"><code>@​deepview-autofix</code></a>
in <a
href="https://redirect.github.com/nodejs/undici/pull/5049">nodejs/undici#5049</a></li>
<li>fix(websocket): correct argument order in WebSocketStream UTF-8
failure by <a
href="https://github.com/deepview-autofix"><code>@​deepview-autofix</code></a>
in <a
href="https://redirect.github.com/nodejs/undici/pull/5050">nodejs/undici#5050</a></li>
<li>fix(pool): propagate useH2c to connector when connections &gt; 1 by
<a href="https://github.com/SAY-5"><code>@​SAY-5</code></a> in <a
href="https://redirect.github.com/nodejs/undici/pull/5031">nodejs/undici#5031</a></li>
<li>fix(cache): return immutable staleAt in milliseconds by <a
href="https://github.com/deepview-autofix"><code>@​deepview-autofix</code></a>
in <a
href="https://redirect.github.com/nodejs/undici/pull/5048">nodejs/undici#5048</a></li>
<li>fix(socks5-proxy-agent): use per-origin pools to prevent
cross-origin routing by <a
href="https://github.com/deepview-autofix"><code>@​deepview-autofix</code></a>
in <a
href="https://redirect.github.com/nodejs/undici/pull/5041">nodejs/undici#5041</a></li>
<li>fix(cache): evict oldest entries first in SqliteCacheStore prune by
<a
href="https://github.com/deepview-autofix"><code>@​deepview-autofix</code></a>
in <a
href="https://redirect.github.com/nodejs/undici/pull/5039">nodejs/undici#5039</a></li>
<li>fix(socks5): correctly expand IPv6 '::' compressed notation by <a
href="https://github.com/deepview-autofix"><code>@​deepview-autofix</code></a>
in <a
href="https://redirect.github.com/nodejs/undici/pull/5046">nodejs/undici#5046</a></li>
<li>Remove unused func and unnecessary shim by <a
href="https://github.com/tsctx"><code>@​tsctx</code></a> in <a
href="https://redirect.github.com/nodejs/undici/pull/5053">nodejs/undici#5053</a></li>
<li>fix: reject malformed content-length request headers by <a
href="https://github.com/trivikr"><code>@​trivikr</code></a> in <a
href="https://redirect.github.com/nodejs/undici/pull/5060">nodejs/undici#5060</a></li>
<li>fix(request): reject NaN highWaterMark during option validation by
<a href="https://github.com/trivikr"><code>@​trivikr</code></a> in <a
href="https://redirect.github.com/nodejs/undici/pull/5062">nodejs/undici#5062</a></li>
<li>docs: fix broken links in docsify sidebar by <a
href="https://github.com/maruthang"><code>@​maruthang</code></a> in <a
href="https://redirect.github.com/nodejs/undici/pull/5065">nodejs/undici#5065</a></li>
<li>fix(fetch): prefer filename* over filename in multipart form-data by
<a href="https://github.com/maruthang"><code>@​maruthang</code></a> in
<a
href="https://redirect.github.com/nodejs/undici/pull/5068">nodejs/undici#5068</a></li>
<li>fix(http2): reject websocket upgrades on non-200 responses by <a
href="https://github.com/trivikr"><code>@​trivikr</code></a> in <a
href="https://redirect.github.com/nodejs/undici/pull/5072">nodejs/undici#5072</a></li>
<li>feat: support username-only proxy authentication in ProxyAgent by <a
href="https://github.com/rossilor95"><code>@​rossilor95</code></a> in <a
href="https://redirect.github.com/nodejs/undici/pull/4935">nodejs/undici#4935</a></li>
<li>build(deps): bump uWebSockets.js from v20.58.0 to v20.64.0 in
/benchmarks by <a
href="https://github.com/dependabot"><code>@​dependabot</code></a>[bot]
in <a
href="https://redirect.github.com/nodejs/undici/pull/5083">nodejs/undici#5083</a></li>
<li>fix(client-h2): stop double-decrementing kOpenStreams on stream
timeout by <a href="https://github.com/SAY-5"><code>@​SAY-5</code></a>
in <a
href="https://redirect.github.com/nodejs/undici/pull/5076">nodejs/undici#5076</a></li>
<li>fix(http2): reject upgrade streams closed before response headers by
<a href="https://github.com/trivikr"><code>@​trivikr</code></a> in <a
href="https://redirect.github.com/nodejs/undici/pull/5069">nodejs/undici#5069</a></li>
<li>fix(http2): allow GET and HEAD request bodies over h2 by <a
href="https://github.com/trivikr"><code>@​trivikr</code></a> in <a
href="https://redirect.github.com/nodejs/undici/pull/5058">nodejs/undici#5058</a></li>
<li>fix(cache): include query in cache key when opts.path is undefined
by <a href="https://github.com/maruthang"><code>@​maruthang</code></a>
in <a
href="https://redirect.github.com/nodejs/undici/pull/5081">nodejs/undici#5081</a></li>
<li>fix: avoid premature cleanup of dispatcher in Agent by <a
href="https://github.com/bienzaaron"><code>@​bienzaaron</code></a> in <a
href="https://redirect.github.com/nodejs/undici/pull/5034">nodejs/undici#5034</a></li>
<li>fix(http2): record ping failures on the socket by <a
href="https://github.com/trivikr"><code>@​trivikr</code></a> in <a
href="https://redirect.github.com/nodejs/undici/pull/5075">nodejs/undici#5075</a></li>
<li>add undici security policy by <a
href="https://github.com/mcollina"><code>@​mcollina</code></a> in <a
href="https://redirect.github.com/nodejs/undici/pull/5056">nodejs/undici#5056</a></li>
<li>fix(mock): make filterCalls AND operator actually intersect results
by <a
href="https://github.com/deepview-autofix"><code>@​deepview-autofix</code></a>
in <a
href="https://redirect.github.com/nodejs/undici/pull/5045">nodejs/undici#5045</a></li>
<li>fix(socks5): enforce authenticated state before CONNECT by <a
href="https://github.com/trivikr"><code>@​trivikr</code></a> in <a
href="https://redirect.github.com/nodejs/undici/pull/5097">nodejs/undici#5097</a></li>
<li>fix(cache): skip expired sqlite vary entries during lookup by <a
href="https://github.com/trivikr"><code>@​trivikr</code></a> in <a
href="https://redirect.github.com/nodejs/undici/pull/5095">nodejs/undici#5095</a></li>
<li>fix: enforce maxCachedSessions in TLS session cache by <a
href="https://github.com/trivikr"><code>@​trivikr</code></a> in <a
href="https://redirect.github.com/nodejs/undici/pull/5102">nodejs/undici#5102</a></li>
<li>fix(socks5): encode embedded IPv4 tails in IPv6 literals correctly
by <a href="https://github.com/trivikr"><code>@​trivikr</code></a> in <a
href="https://redirect.github.com/nodejs/undici/pull/5099">nodejs/undici#5099</a></li>
<li>fix: handle invalid HTTP/2 connection headers (<a
href="https://redirect.github.com/nodejs/undici/issues/4356">#4356</a>)
by <a href="https://github.com/mcollina"><code>@​mcollina</code></a> in
<a
href="https://redirect.github.com/nodejs/undici/pull/5101">nodejs/undici#5101</a></li>
<li>fix(interceptor): add throwOnMaxRedirect to types and interceptor
opts by <a
href="https://github.com/maruthang"><code>@​maruthang</code></a> in <a
href="https://redirect.github.com/nodejs/undici/pull/5066">nodejs/undici#5066</a></li>
<li>fix(websocket): avoid double-closing canceled stream readers by <a
href="https://github.com/colinaaa"><code>@​colinaaa</code></a> in <a
href="https://redirect.github.com/nodejs/undici/pull/5105">nodejs/undici#5105</a></li>
<li>fix(cache): persist vary when updating sqlite cache entries by <a
href="https://github.com/trivikr"><code>@​trivikr</code></a> in <a
href="https://redirect.github.com/nodejs/undici/pull/5109">nodejs/undici#5109</a></li>
<li>refactor(h1): track HEAD keep-alive override as boolean by <a
href="https://github.com/trivikr"><code>@​trivikr</code></a> in <a
href="https://redirect.github.com/nodejs/undici/pull/5110">nodejs/undici#5110</a></li>
<li>client: cache llhttp wasm buffer view by <a
href="https://github.com/trivikr"><code>@​trivikr</code></a> in <a
href="https://redirect.github.com/nodejs/undici/pull/5115">nodejs/undici#5115</a></li>
<li>deps: update llhttp to 9.3.1 by <a
href="https://github.com/mcollina"><code>@​mcollina</code></a> in <a
href="https://redirect.github.com/nodejs/undici/pull/5113">nodejs/undici#5113</a></li>
<li>fix(http2): preserve accepted streams after GOAWAY by <a
href="https://github.com/trivikr"><code>@​trivikr</code></a> in <a
href="https://redirect.github.com/nodejs/undici/pull/5090">nodejs/undici#5090</a></li>
<li>fix: reuse parser WeakRef for timeout callbacks by <a
href="https://github.com/trivikr"><code>@​trivikr</code></a> in <a
href="https://redirect.github.com/nodejs/undici/pull/5125">nodejs/undici#5125</a></li>
<li>fix: stop buffering data after SOCKS5 connect by <a
href="https://github.com/trivikr"><code>@​trivikr</code></a> in <a
href="https://redirect.github.com/nodejs/undici/pull/5118">nodejs/undici#5118</a></li>
<li>perf(http2): avoid response header reserialization by <a
href="https://github.com/trivikr"><code>@​trivikr</code></a> in <a
href="https://redirect.github.com/nodejs/undici/pull/5085">nodejs/undici#5085</a></li>
<li>fix(cache): enforce sqlite maxCount after insert by <a
href="https://github.com/trivikr"><code>@​trivikr</code></a> in <a
href="https://redirect.github.com/nodejs/undici/pull/5112">nodejs/undici#5112</a></li>
<li>perf: reduce EventSourceStream parser allocations by <a
href="https://github.com/trivikr"><code>@​trivikr</code></a> in <a
href="https://redirect.github.com/nodejs/undici/pull/5032">nodejs/undici#5032</a></li>
<li>types(dispatcher): use OutgoingHttpHeaders for request headers by <a
href="https://github.com/maruthang"><code>@​maruthang</code></a> in <a
href="https://redirect.github.com/nodejs/undici/pull/5067">nodejs/undici#5067</a></li>
<li>cleanup: delete redundant .gitkeep file by <a
href="https://github.com/shivarm"><code>@​shivarm</code></a> in <a
href="https://redirect.github.com/nodejs/undici/pull/5133">nodejs/undici#5133</a></li>
<li>fix(http2): respect peer max concurrent streams by <a
href="https://github.com/trivikr"><code>@​trivikr</code></a> in <a
href="https://redirect.github.com/nodejs/undici/pull/5135">nodejs/undici#5135</a></li>
</ul>
<!-- raw HTML omitted -->
</blockquote>
<p>... (truncated)</p>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/nodejs/undici/commit/bf684f7de01616708a33a5d1c092177622394442"><code>bf684f7</code></a>
Bumped v8.2.0 (<a
href="https://redirect.github.com/nodejs/undici/issues/5152">#5152</a>)</li>
<li><a
href="https://github.com/nodejs/undici/commit/0ca054aa8524ed52709ebf15e94e187f4a18ebcf"><code>0ca054a</code></a>
fix: replace stale pool clients under connection limit (<a
href="https://redirect.github.com/nodejs/undici/issues/5145">#5145</a>)</li>
<li><a
href="https://github.com/nodejs/undici/commit/7af90e9721f882bb5fc97606e3f95217ca849994"><code>7af90e9</code></a>
perf: avoid redundant scans in BalancedPool dispatcher selection (<a
href="https://redirect.github.com/nodejs/undici/issues/5146">#5146</a>)</li>
<li><a
href="https://github.com/nodejs/undici/commit/abb9d06ba7b882d336129898f9e89176f1c8f1c3"><code>abb9d06</code></a>
fix: validate H2CClient maxConcurrentStreams option (<a
href="https://redirect.github.com/nodejs/undici/issues/5143">#5143</a>)</li>
<li><a
href="https://github.com/nodejs/undici/commit/72a75913138bc6197bf0620a1291f7c2e764c430"><code>72a7591</code></a>
perf(http2): avoid cloning headers when removing status (<a
href="https://redirect.github.com/nodejs/undici/issues/5127">#5127</a>)</li>
<li><a
href="https://github.com/nodejs/undici/commit/96fd5e9da9b19a4d49eb9e67534f73f4cfa1c677"><code>96fd5e9</code></a>
fix(cache): allow streamed entries at maxEntrySize limit (<a
href="https://redirect.github.com/nodejs/undici/issues/5129">#5129</a>)</li>
<li><a
href="https://github.com/nodejs/undici/commit/f41e53f112659ec37b6fa8db4e4f39388b9e6ca6"><code>f41e53f</code></a>
perf: use byteLength property for binary body chunks (<a
href="https://redirect.github.com/nodejs/undici/issues/5126">#5126</a>)</li>
<li><a
href="https://github.com/nodejs/undici/commit/bec49615931e3df3df4f75956b35c3f7f1fd05ca"><code>bec4961</code></a>
chore(deps): add lockfile (<a
href="https://redirect.github.com/nodejs/undici/issues/5139">#5139</a>)</li>
<li><a
href="https://github.com/nodejs/undici/commit/86f1242cfc86364fe5c30d7e0fc1deec8d52954b"><code>86f1242</code></a>
perf(http2): reduce writeH2 per-request callback allocations (<a
href="https://redirect.github.com/nodejs/undici/issues/5138">#5138</a>)</li>
<li><a
href="https://github.com/nodejs/undici/commit/cad3f70a86b95966a3e368f9f7118377858b8c3e"><code>cad3f70</code></a>
perf(client): parse h1 content-length statelessly (<a
href="https://redirect.github.com/nodejs/undici/issues/5124">#5124</a>)</li>
<li>Additional commits viewable in <a
href="https://github.com/nodejs/undici/compare/v7.24.6...v8.2.0">compare
view</a></li>
</ul>
</details>
<br />

---------

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: Parker Brown <17183625+parkerbxyz@users.noreply.github.com>
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
 2026-05-08 14:40:33 -07:00
dependabot[bot] 8d835bfd37 build(deps-dev): bump esbuild from 0.27.4 to 0.28.0 in the development-dependencies group (#365) 
Bumps the development-dependencies group with 1 update:
[esbuild](https://github.com/evanw/esbuild).

Updates `esbuild` from 0.27.4 to 0.28.0
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/evanw/esbuild/releases">esbuild's
releases</a>.</em></p>
<blockquote>
<h2>v0.28.0</h2>
<ul>
<li>
<p>Add support for <code>with { type: 'text' }</code> imports (<a
href="https://redirect.github.com/evanw/esbuild/issues/4435">#4435</a>)</p>
<p>The <a href="https://github.com/tc39/proposal-import-text">import
text</a> proposal has reached stage 3 in the TC39 process, which means
that it's recommended for implementation. It has also already been
implemented by <a
href="https://docs.deno.com/examples/importing_text/">Deno</a> and <a
href="https://bun.com/docs/guides/runtime/import-html">Bun</a>. So with
this release, esbuild also adds support for it. This behaves exactly the
same as esbuild's existing <a
href="https://esbuild.github.io/content-types/#text"><code>text</code>
loader</a>. Here's an example:</p>
<pre lang="js"><code>import string from './example.txt' with { type:
'text' }
console.log(string)
</code></pre>
</li>
<li>
<p>Add integrity checks to fallback download path (<a
href="https://redirect.github.com/evanw/esbuild/issues/4343">#4343</a>)</p>
<p>Installing esbuild via npm is somewhat complicated with several
different edge cases (see <a
href="https://esbuild.github.io/getting-started/#additional-npm-flags">esbuild's
documentation</a> for details). If the regular installation of esbuild's
platform-specific package fails, esbuild's install script attempts to
download the platform-specific package itself (first with the
<code>npm</code> command, and then with a HTTP request to
<code>registry.npmjs.org</code> as a last resort).</p>
<p>This last resort path previously didn't have any integrity checks.
With this release, esbuild will now verify that the hash of the
downloaded binary matches the expected hash for the current release.
This means the hashes for all of esbuild's platform-specific binary
packages will now be embedded in the top-level <code>esbuild</code>
package. Hopefully this should work without any problems. But just in
case, this change is being done as a breaking change release.</p>
</li>
<li>
<p>Update the Go compiler from 1.25.7 to 1.26.1</p>
<p>This upgrade should not affect anything. However, there have been
some significant internal changes to the Go compiler, so esbuild could
potentially behave differently in certain edge cases:</p>
<ul>
<li>It now uses the <a
href="https://go.dev/doc/go1.26#new-garbage-collector">new garbage
collector</a> that comes with Go 1.26.</li>
<li>The Go compiler is now more aggressive with allocating memory on the
stack.</li>
<li>The executable format that the Go linker uses has undergone several
changes.</li>
<li>The WebAssembly build now unconditionally makes use of the sign
extension and non-trapping floating-point to integer conversion
instructions.</li>
</ul>
<p>You can read the <a href="https://go.dev/doc/go1.26">Go 1.26 release
notes</a> for more information.</p>
</li>
</ul>
<h2>v0.27.7</h2>
<ul>
<li>
<p>Fix lowering of define semantics for TypeScript parameter properties
(<a
href="https://redirect.github.com/evanw/esbuild/issues/4421">#4421</a>)</p>
<p>The previous release incorrectly generated class fields for
TypeScript parameter properties even when the configured target
environment does not support class fields. With this release, the
generated class fields will now be correctly lowered in this case:</p>
<pre lang="ts"><code>// Original code
class Foo {
  constructor(public x = 1) {}
  y = 2
}
<p>// Old output (with --loader=ts --target=es2021)<br />
class Foo {<br />
constructor(x = 1) {<br />
this.x = x;<br />
__publicField(this, &quot;y&quot;, 2);<br />
}<br />
x;<br />
}</p>
<p>// New output (with --loader=ts --target=es2021)<br />
class Foo {<br />
</code></pre></p>
</li>
</ul>
<!-- raw HTML omitted -->
</blockquote>
<p>... (truncated)</p>
</details>
<details>
<summary>Changelog</summary>
<p><em>Sourced from <a
href="https://github.com/evanw/esbuild/blob/main/CHANGELOG.md">esbuild's
changelog</a>.</em></p>
<blockquote>
<h2>0.28.0</h2>
<ul>
<li>
<p>Add support for <code>with { type: 'text' }</code> imports (<a
href="https://redirect.github.com/evanw/esbuild/issues/4435">#4435</a>)</p>
<p>The <a href="https://github.com/tc39/proposal-import-text">import
text</a> proposal has reached stage 3 in the TC39 process, which means
that it's recommended for implementation. It has also already been
implemented by <a
href="https://docs.deno.com/examples/importing_text/">Deno</a> and <a
href="https://bun.com/docs/guides/runtime/import-html">Bun</a>. So with
this release, esbuild also adds support for it. This behaves exactly the
same as esbuild's existing <a
href="https://esbuild.github.io/content-types/#text"><code>text</code>
loader</a>. Here's an example:</p>
<pre lang="js"><code>import string from './example.txt' with { type:
'text' }
console.log(string)
</code></pre>
</li>
<li>
<p>Add integrity checks to fallback download path (<a
href="https://redirect.github.com/evanw/esbuild/issues/4343">#4343</a>)</p>
<p>Installing esbuild via npm is somewhat complicated with several
different edge cases (see <a
href="https://esbuild.github.io/getting-started/#additional-npm-flags">esbuild's
documentation</a> for details). If the regular installation of esbuild's
platform-specific package fails, esbuild's install script attempts to
download the platform-specific package itself (first with the
<code>npm</code> command, and then with a HTTP request to
<code>registry.npmjs.org</code> as a last resort).</p>
<p>This last resort path previously didn't have any integrity checks.
With this release, esbuild will now verify that the hash of the
downloaded binary matches the expected hash for the current release.
This means the hashes for all of esbuild's platform-specific binary
packages will now be embedded in the top-level <code>esbuild</code>
package. Hopefully this should work without any problems. But just in
case, this change is being done as a breaking change release.</p>
</li>
<li>
<p>Update the Go compiler from 1.25.7 to 1.26.1</p>
<p>This upgrade should not affect anything. However, there have been
some significant internal changes to the Go compiler, so esbuild could
potentially behave differently in certain edge cases:</p>
<ul>
<li>It now uses the <a
href="https://go.dev/doc/go1.26#new-garbage-collector">new garbage
collector</a> that comes with Go 1.26.</li>
<li>The Go compiler is now more aggressive with allocating memory on the
stack.</li>
<li>The executable format that the Go linker uses has undergone several
changes.</li>
<li>The WebAssembly build now unconditionally makes use of the sign
extension and non-trapping floating-point to integer conversion
instructions.</li>
</ul>
<p>You can read the <a href="https://go.dev/doc/go1.26">Go 1.26 release
notes</a> for more information.</p>
</li>
</ul>
<h2>0.27.7</h2>
<ul>
<li>
<p>Fix lowering of define semantics for TypeScript parameter properties
(<a
href="https://redirect.github.com/evanw/esbuild/issues/4421">#4421</a>)</p>
<p>The previous release incorrectly generated class fields for
TypeScript parameter properties even when the configured target
environment does not support class fields. With this release, the
generated class fields will now be correctly lowered in this case:</p>
<pre lang="ts"><code>// Original code
class Foo {
  constructor(public x = 1) {}
  y = 2
}
<p>// Old output (with --loader=ts --target=es2021)<br />
class Foo {<br />
constructor(x = 1) {<br />
this.x = x;<br />
__publicField(this, &quot;y&quot;, 2);<br />
}<br />
x;<br />
}</p>
<p></code></pre></p>
</li>
</ul>
<!-- raw HTML omitted -->
</blockquote>
<p>... (truncated)</p>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/evanw/esbuild/commit/6a794dff68e6a43539f6da671e3080efdf11ca70"><code>6a794df</code></a>
publish 0.28.0 to npm</li>
<li><a
href="https://github.com/evanw/esbuild/commit/64ee0ea63b2ff303caafc9610c388dc72c882c23"><code>64ee0ea</code></a>
fix <a
href="https://redirect.github.com/evanw/esbuild/issues/4435">#4435</a>:
support <code>with { type: text }</code> imports</li>
<li><a
href="https://github.com/evanw/esbuild/commit/ef65aeeaacdb71eade186f888975b1de89574314"><code>ef65aee</code></a>
fix sort order in <code>snapshots_packagejson.txt</code></li>
<li><a
href="https://github.com/evanw/esbuild/commit/1a26a8ecbc39aaf1379c524a0274a08fbcbed655"><code>1a26a8e</code></a>
try to fix <code>test-old-ts</code>, also shuffle CI tasks</li>
<li><a
href="https://github.com/evanw/esbuild/commit/556ce6c1fc00d7c0917fbfada01ed8e5251bc510"><code>556ce6c</code></a>
use <code>''</code> instead of <code>null</code> to omit build
hashes</li>
<li><a
href="https://github.com/evanw/esbuild/commit/8e675a81a473ea69a46a69792f1386bb110dd877"><code>8e675a8</code></a>
ci: allow missing binary hashes for tests</li>
<li><a
href="https://github.com/evanw/esbuild/commit/7067763b904fe8a522fa840a4a48c5fbd4c395e0"><code>7067763</code></a>
Reapply &quot;update go 1.25.7 =&gt; 1.26.1&quot;</li>
<li><a
href="https://github.com/evanw/esbuild/commit/39473a952ab3b450d0578b698a8b8d2a02332e0d"><code>39473a9</code></a>
fix <a
href="https://redirect.github.com/evanw/esbuild/issues/4343">#4343</a>:
integrity check for binary download</li>
<li><a
href="https://github.com/evanw/esbuild/commit/2025c9ff6ab15ba6b0f9d074fd732250cc46e4a3"><code>2025c9f</code></a>
publish 0.27.7 to npm</li>
<li><a
href="https://github.com/evanw/esbuild/commit/c6b586e4904f47e8d5f783a2813660c13e2672e7"><code>c6b586e</code></a>
fix typo in <code>Makefile</code> for
<code>@esbuild/win32-x64</code></li>
<li>Additional commits viewable in <a
href="https://github.com/evanw/esbuild/compare/v0.27.4...v0.28.0">compare
view</a></li>
</ul>
</details>
<br />


[![Dependabot compatibility
score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=esbuild&package-manager=npm_and_yarn&previous-version=0.27.4&new-version=0.28.0)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)

Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.

[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)

---

<details>
<summary>Dependabot commands and options</summary>
<br />

You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot show <dependency name> ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore <dependency name> major version` will close this
group update PR and stop Dependabot creating any more for the specific
dependency's major version (unless you unignore this specific
dependency's major version or upgrade to it yourself)
- `@dependabot ignore <dependency name> minor version` will close this
group update PR and stop Dependabot creating any more for the specific
dependency's minor version (unless you unignore this specific
dependency's minor version or upgrade to it yourself)
- `@dependabot ignore <dependency name>` will close this group update PR
and stop Dependabot creating any more for the specific dependency
(unless you unignore this specific dependency or upgrade to it yourself)
- `@dependabot unignore <dependency name>` will remove all of the ignore
conditions of the specified dependency
- `@dependabot unignore <dependency name> <ignore condition>` will
remove the ignore condition of the specified dependency and ignore
conditions


</details>

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
 2026-05-08 12:30:30 -07:00
Stefan 952a2a7073 feat: add support for enterprise-level GitHub Apps (#263) 
This pull request adds support for generating GitHub App installation
tokens for enterprise-level installations.

### What changed

- Added a new `enterprise` input to `action.yml`.
- Wired `enterprise` through `main.js` and `lib/main.js`.
- Added validation so `enterprise` cannot be combined with `owner` or
`repositories`.
- Implemented enterprise installation lookup using the direct GitHub API
route `GET /enterprises/{enterprise}/installation`, then used the
returned installation ID to mint an installation token through
`@octokit/auth-app`.
- Updated `README.md` with enterprise installation usage and input
documentation.
- Updated `dist/main.cjs` for the bundled action.
- Shared token creation retry behavior across repository, owner, and
enterprise paths so server errors and transient network errors are
retried, while client errors fail immediately.

### Tests

Added focused test coverage for:

- enterprise token creation
- enterprise token creation with explicit permissions
- enterprise installation not found
- mutual exclusivity with `owner`
- mutual exclusivity with `repositories`
- owner installation client errors are not retried
- transient network errors are retried during token creation

### Notes

- This keeps the existing repository-scoped token behavior unchanged.
- Owner, repository, and enterprise token creation now share the same
retry policy: server errors and recognized transient network errors are
retried, while client errors fail immediately. This intentionally fixes
the previous owner-path behavior that retried client errors.

Refs:
-
https://github.blog/changelog/2025-07-01-enterprise-level-access-for-github-apps-and-installation-automation-apis/
-
https://docs.github.com/en/rest/apps/apps?apiVersion=2022-11-28#get-an-enterprise-installation-for-the-authenticated-app

---------

Co-authored-by: Parker Brown <17183625+parkerbxyz@users.noreply.github.com>
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>
 2026-05-08 11:56:11 -07:00
dependabot[bot] 43e5c345bf fix(deps): bump @actions/core from 3.0.0 to 3.0.1 in the production-dependencies group (#364) 
Bumps the production-dependencies group with 1 update:
[@actions/core](https://github.com/actions/toolkit/tree/HEAD/packages/core).

Updates `@actions/core` from 3.0.0 to 3.0.1
<details>
<summary>Changelog</summary>
<p><em>Sourced from <a
href="https://github.com/actions/toolkit/blob/main/packages/core/RELEASES.md"><code>@​actions/core</code>'s
changelog</a>.</em></p>
<blockquote>
<h2>3.0.1</h2>
<ul>
<li>Bump <code>undici</code> from <code>6.23.0</code> to
<code>6.24.1</code> <a
href="https://redirect.github.com/actions/toolkit/pull/2348">#2348</a></li>
</ul>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li>See full diff in <a
href="https://github.com/actions/toolkit/commits/HEAD/packages/core">compare
view</a></li>
</ul>
</details>
<br />


[![Dependabot compatibility
score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=@actions/core&package-manager=npm_and_yarn&previous-version=3.0.0&new-version=3.0.1)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)

Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.

[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)

---

<details>
<summary>Dependabot commands and options</summary>
<br />

You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot show <dependency name> ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore <dependency name> major version` will close this
group update PR and stop Dependabot creating any more for the specific
dependency's major version (unless you unignore this specific
dependency's major version or upgrade to it yourself)
- `@dependabot ignore <dependency name> minor version` will close this
group update PR and stop Dependabot creating any more for the specific
dependency's minor version (unless you unignore this specific
dependency's minor version or upgrade to it yourself)
- `@dependabot ignore <dependency name>` will close this group update PR
and stop Dependabot creating any more for the specific dependency
(unless you unignore this specific dependency or upgrade to it yourself)
- `@dependabot unignore <dependency name>` will remove all of the ignore
conditions of the specified dependency
- `@dependabot unignore <dependency name> <ignore condition>` will
remove the ignore condition of the specified dependency and ignore
conditions


</details>

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
 2026-05-07 19:09:31 -07:00
Parker Brown 6dbbbb1419 ci: use existing release tag format (#369) 
## Summary

This updates the release-please manifest configuration to use the
repository's existing `vX.Y.Z` tag format. Without this setting,
manifest mode looks for component-prefixed tags like
`create-github-app-token-v3.1.1`, which do not exist in this repository
and can cause release-please to include already-released commits in a
new release PR.

## Changes

- Sets `include-component-in-tag` to `false` for stable releases.
- Sets `include-component-in-tag` to `false` for beta prereleases.

This should make release-please use tags like `v3.1.1` as the previous
release boundary.

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
 2026-05-07 18:58:55 -07:00
Parker Brown 6be28c6ca7 ci: migrate releases to release-please (#367) 
## Summary

This updates release automation so the repository can enforce signed
commits. Release version and changelog updates now happen through
release-please PRs instead of direct workflow commits, which allows them
to use the repository's normal signed-commit path.

## Changes

- Replaces semantic-release configuration with release-please manifest
configuration for stable releases and beta prereleases.
- Builds committed `dist/**` assets from the trusted release workflow
after release-please creates or updates a release PR, then commits those
assets back to the release PR branch.
- Keeps floating major version tags, such as `v3`, updated with the
GitHub API after a release is created.

---------

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
 2026-05-07 18:13:10 -07:00
Josh Johanning 7989d206df docs: use APP_ prefix instead of reserved GITHUB_ prefix (#363) 
Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com>
 2026-04-21 09:56:11 -07:00
semantic-release-bot 1b10c78c78 build(release): 3.1.1 [skip ci] 
## [3.1.1](https://github.com/actions/create-github-app-token/compare/v3.1.0...v3.1.1) (2026-04-11)

### Bug Fixes

* improve error message when app identifier is empty ([#362](https://github.com/actions/create-github-app-token/issues/362)) ([07e2b76](https://github.com/actions/create-github-app-token/commit/07e2b760664f080c40eec4eacf7477256582db36)), closes [#249](https://github.com/actions/create-github-app-token/issues/249)
v3.1.1 v3 		2026-04-11 06:43:26 +00:00
Parker Brown 07e2b76066 fix: improve error message when app identifier is empty (#362) 
When `client-id` (or the deprecated `app-id`) resolves to an empty
string, for example because a secret or variable is not available in the
workflow context, the error message from `@octokit/auth-app` is not very
helpful:

```
[@octokit/auth-app] appId option is required
```

A validation check was added recently to catch this earlier, but its
message could be more informative:

```
Either 'client-id' or 'app-id' input must be set
```

This updates the message to clarify that the value resolved to empty and
nudges users toward checking their secret or variable availability:

```
The 'client-id' input must be set to a non-empty string. If using a secret or variable, ensure it is available in this workflow context.
```

Closes #249

---------

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>
 2026-04-10 23:42:53 -07:00
Parker Brown ea0121618b ci: remove publish-immutable-action workflow (#361) 
The `publish-immutable-action` workflow uses `actions/publish-immutable-action@v0.0.4`. The Immutable Actions Publishing feature (OCI-based) has been paused with no GA timeline. This removes the workflow; it can be re-added when the feature becomes generally available.

To fully address #352, the repository-level **immutable releases** setting has also be enabled. This [feature](https://github.blog/changelog/2025-10-28-immutable-releases-are-now-generally-available/) locks release tags and assets after publication, directly preventing the class of attack described in [GHSA-mrrh-fwg8-r2c3](https://github.com/advisories/GHSA-mrrh-fwg8-r2c3).

The existing release workflow is compatible with immutable releases. Build artifacts are committed via `@semantic-release/git` before the tag is created, and major version tags (`v3`, etc.) are plain git tags (not releases) so they remain updatable.
 2026-04-10 23:01:59 -07:00
semantic-release-bot 7bd0371149 build(release): 3.1.0 [skip ci] 
# [3.1.0](https://github.com/actions/create-github-app-token/compare/v3.0.0...v3.1.0) (2026-04-11)

### Bug Fixes

* **deps:** bump p-retry from 7.1.1 to 8.0.0 ([#357](https://github.com/actions/create-github-app-token/issues/357)) ([3bbe07d](https://github.com/actions/create-github-app-token/commit/3bbe07d928e2d6c30bf3e37c6b89edbc4045facf))

### Features

* add `client-id` input and deprecate `app-id` ([#353](https://github.com/actions/create-github-app-token/issues/353)) ([e6bd4e6](https://github.com/actions/create-github-app-token/commit/e6bd4e6970172bed9fe138b2eaf4cbffa4cca8f9))
* update permission inputs ([#358](https://github.com/actions/create-github-app-token/issues/358)) ([076e948](https://github.com/actions/create-github-app-token/commit/076e9480ca6e9633bff412d05eff0fc2f1e7d2be))
v3.1.0 		2026-04-11 00:39:23 +00:00
Copilot e6bd4e6970 feat: add client-id input and deprecate app-id (#353) 
GitHub now recommends using a GitHub App's Client ID for authentication.
This PR adds a first-class `client-id` input, keeps `app-id` available
for compatibility, and makes the migration path explicit in both runtime
behavior and documentation.

### Action inputs

- Adds a new `client-id` input
- Removes `required` from `app-id`
- Marks `app-id` as deprecated in `action.yml`

### Runtime behavior

- Updates input parsing to prefer `client-id`
- Falls back to `app-id` for existing workflows
- Adds a clear error when neither `client-id` nor `app-id` is provided

### Docs

- Updates the README to recommend `client-id`
- Switches usage examples to `client-id`
- Documents that `app-id` is deprecated and that `client-id` takes
precedence if both are set

### Regression coverage

- Adds a focused test proving a client-ID-shaped value works through the
new `client-id` input
- Adds coverage for the missing-ID validation path
- Updates snapshots to lock in the new metadata and runtime behavior

### Resulting usage

Users can migrate to the new input name directly:

```yaml
- uses: actions/create-github-app-token@v3
  with:
    client-id: ${{ vars.GITHUB_APP_CLIENT_ID }}
    private-key: ${{ secrets.GITHUB_APP_PRIVATE_KEY }}
```

---------

Co-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com>
Co-authored-by: parkerbxyz <17183625+parkerbxyz@users.noreply.github.com>
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
 2026-04-10 17:36:03 -07:00
dependabot[bot] 076e9480ca feat: update permission inputs (#358) 
Bumps [@octokit/openapi](https://github.com/octokit/openapi) from 21.0.0
to 22.0.0.
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/octokit/openapi/releases"><code>@​octokit/openapi</code>'s
releases</a>.</em></p>
<blockquote>
<h2>v22.0.0</h2>
<h1><a
href="https://github.com/octokit/openapi/compare/v21.0.0...v22.0.0">22.0.0</a>
(2025-12-09)</h1>
<h3>Features</h3>
<ul>
<li>drop projects-classic endpoints, add GitHub API endpoints: cache
limits (retention &amp; storage) for repos/orgs/enterprises, billing
budgets &amp; usage, artifacts deployment metadata, and projectsV2
drafts &amp; fields (<a
href="https://redirect.github.com/octokit/openapi/issues/518">#518</a>)
(<a
href="https://github.com/octokit/openapi/commit/b0c44a4ab1b07a5524890cef1e8321cfc430bebb">b0c44a4</a>)</li>
</ul>
<h3>BREAKING CHANGES</h3>
<ul>
<li>Removed <code>/orgs/{org}/projects</code></li>
<li>Removed <code>/orgs/{org}/settings/billing/actions</code></li>
<li>Removed <code>/orgs/{org}/settings/billing/packages</code></li>
<li>Removed
<code>/orgs/{org}/settings/billing/shared-storage</code></li>
<li>Removed <code>/orgs/{org}/teams/{team_slug}/projects</code></li>
<li>Removed
<code>/orgs/{org}/teams/{team_slug}/projects/{project_id}</code></li>
<li>Removed <code>/projects/columns/{column_id}</code></li>
<li>Removed <code>/projects/columns/{column_id}/moves</code></li>
<li>Removed <code>/projects/{project_id}</code></li>
<li>Removed <code>/projects/{project_id}/collaborators</code></li>
<li>Removed
<code>/projects/{project_id}/collaborators/{username}</code></li>
<li>Removed
<code>/projects/{project_id}/collaborators/{username}/permission</code></li>
<li>Removed <code>/repos/{owner}/{repo}/projects</code></li>
<li>Removed <code>/teams/{team_id}/projects</code></li>
<li>Removed <code>/teams/{team_id}/projects/{project_id}</code></li>
<li>Removed <code>/user/projects</code></li>
<li>Removed <code>/users/{username}/projects</code></li>
<li>Removed <code>/users/{username}/settings/billing/actions</code></li>
<li>Removed
<code>/users/{username}/settings/billing/packages</code></li>
<li>Removed
<code>/users/{username}/settings/billing/shared-storage</code></li>
</ul>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/octokit/openapi/commit/6f63b86ab7d2057cb62574681918a34b3d43f66b"><code>6f63b86</code></a>
build(deps): lock file maintenance (<a
href="https://redirect.github.com/octokit/openapi/issues/520">#520</a>)</li>
<li><a
href="https://github.com/octokit/openapi/commit/b0c44a4ab1b07a5524890cef1e8321cfc430bebb"><code>b0c44a4</code></a>
feat: drop projects-classic endpoints, add GitHub API endpoints: cache
limits...</li>
<li><a
href="https://github.com/octokit/openapi/commit/a8043eb055618a1a9a779b6807bba796d9664604"><code>a8043eb</code></a>
ci(action): update actions/checkout action to v6 (<a
href="https://redirect.github.com/octokit/openapi/issues/519">#519</a>)</li>
<li><a
href="https://github.com/octokit/openapi/commit/af315cd293aac70c81874623769bdb091da614be"><code>af315cd</code></a>
build(deps): lock file maintenance (<a
href="https://redirect.github.com/octokit/openapi/issues/514">#514</a>)</li>
<li><a
href="https://github.com/octokit/openapi/commit/170f3965b9432f4171117aacb6b88339d5c2a937"><code>170f396</code></a>
build(deps-dev): bump js-yaml from 4.1.0 to 4.1.1 (<a
href="https://redirect.github.com/octokit/openapi/issues/516">#516</a>)</li>
<li><a
href="https://github.com/octokit/openapi/commit/077a1b94a2e77bf56fa07ed8dc112055958b97ab"><code>077a1b9</code></a>
build(deps): lock file maintenance (<a
href="https://redirect.github.com/octokit/openapi/issues/508">#508</a>)</li>
<li><a
href="https://github.com/octokit/openapi/commit/cfca956d308018be25c1405b52c6a4b8c924bdd6"><code>cfca956</code></a>
ci(action): update github/codeql-action action to v4 (<a
href="https://redirect.github.com/octokit/openapi/issues/510">#510</a>)</li>
<li><a
href="https://github.com/octokit/openapi/commit/f15da93d54d4de07c1025b0984c5613a8ddd8acd"><code>f15da93</code></a>
ci(action): update peter-evans/create-or-update-comment action to v5 (<a
href="https://redirect.github.com/octokit/openapi/issues/509">#509</a>)</li>
<li><a
href="https://github.com/octokit/openapi/commit/64bef332f5e1b11ead74082d8aaf0376409de9d0"><code>64bef33</code></a>
chore(deps): update dependency map-obj to v6 (<a
href="https://redirect.github.com/octokit/openapi/issues/507">#507</a>)</li>
<li><a
href="https://github.com/octokit/openapi/commit/4e8e223e564f467a455d7f39de15a0fb233f189e"><code>4e8e223</code></a>
chore(deps): update dependency github-enterprise-server-versions to v3
(<a
href="https://redirect.github.com/octokit/openapi/issues/511">#511</a>)</li>
<li>Additional commits viewable in <a
href="https://github.com/octokit/openapi/compare/v21.0.0...v22.0.0">compare
view</a></li>
</ul>
</details>
<details>
<summary>Maintainer changes</summary>
<p>This version was pushed to npm by [GitHub Actions](<a
href="https://www.npmjs.com/~GitHub">https://www.npmjs.com/~GitHub</a>
Actions), a new releaser for <code>@​octokit/openapi</code> since your
current version.</p>
</details>
<br />

Resolves https://github.com/github/gh-aw/issues/18921.

---------

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
 2026-04-10 17:35:53 -07:00
dependabot[bot] 3bbe07d928 fix(deps): bump p-retry from 7.1.1 to 8.0.0 (#357) 
Bumps [p-retry](https://github.com/sindresorhus/p-retry) from 7.1.1 to
8.0.0.
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/sindresorhus/p-retry/releases">p-retry's
releases</a>.</em></p>
<blockquote>
<h2>v8.0.0</h2>
<h3>Breaking</h3>
<ul>
<li>Require Node.js 22  85cdece</li>
<li>Change retry callback order  616306e
<ul>
<li>Callback order changed from <code>onFailedAttempt</code> →
<code>shouldConsumeRetry</code> → <code>shouldRetry</code> to
<code>shouldConsumeRetry</code> → <code>onFailedAttempt</code> →
<code>shouldRetry</code>.</li>
<li>Consumption decisions are now made before failure notifications and
retry decisions.</li>
</ul>
</li>
</ul>
<h3>Improvements</h3>
<ul>
<li>Add <a
href="https://github.com/sindresorhus/p-retry#retrydelay"><code>retryDelay</code></a>
to <code>onFailedAttempt</code> context (<a
href="https://redirect.github.com/sindresorhus/p-retry/issues/66">#66</a>)
96cce98</li>
<li>Fix <code>TypeError</code> retry handling  f011d2e</li>
<li>Harden retry timing and callback validation  9d47b60</li>
</ul>
<hr />
<p><a
href="https://github.com/sindresorhus/p-retry/compare/v7.1.1...v8.0.0">https://github.com/sindresorhus/p-retry/compare/v7.1.1...v8.0.0</a></p>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/sindresorhus/p-retry/commit/35681f6c70f8ca2bdcb9542281147679184269fa"><code>35681f6</code></a>
8.0.0</li>
<li><a
href="https://github.com/sindresorhus/p-retry/commit/9d47b60e2c8fb324d35cce1987b8591464de24fe"><code>9d47b60</code></a>
Harden retry timing and callback validation</li>
<li><a
href="https://github.com/sindresorhus/p-retry/commit/f011d2e837166f1bea3e739e59754caed4a2dde6"><code>f011d2e</code></a>
Fix <code>TypeError</code> retry handling</li>
<li><a
href="https://github.com/sindresorhus/p-retry/commit/85cdece1c48f3c3fe09d995d86bf59c0d0e4b44f"><code>85cdece</code></a>
Require Node.js 22</li>
<li><a
href="https://github.com/sindresorhus/p-retry/commit/616306ee84f828ffa17f0f02ae4e589815d4f767"><code>616306e</code></a>
Change retry callback order</li>
<li><a
href="https://github.com/sindresorhus/p-retry/commit/96cce98ea2f95c78a4abd780498b2d6af32ac7a4"><code>96cce98</code></a>
Add <code>retryDelay</code> to <code>onFailedAttempt</code> context</li>
<li>See full diff in <a
href="https://github.com/sindresorhus/p-retry/compare/v7.1.1...v8.0.0">compare
view</a></li>
</ul>
</details>
<br />


[![Dependabot compatibility
score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=p-retry&package-manager=npm_and_yarn&previous-version=7.1.1&new-version=8.0.0)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)

Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.

[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)

---

<details>
<summary>Dependabot commands and options</summary>
<br />

You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot show <dependency name> ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore this major version` will close this PR and stop
Dependabot creating any more for this major version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this minor version` will close this PR and stop
Dependabot creating any more for this minor version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this dependency` will close this PR and stop
Dependabot creating any more for this dependency (unless you reopen the
PR or upgrade to it yourself)


</details>

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
 2026-04-10 17:35:43 -07:00
dependabot[bot] 28a99e369c build(deps-dev): bump c8 from 10.1.3 to 11.0.0 
Bumps [c8](https://github.com/bcoe/c8) from 10.1.3 to 11.0.0.
- [Release notes](https://github.com/bcoe/c8/releases)
- [Changelog](https://github.com/bcoe/c8/blob/main/CHANGELOG.md)
- [Commits](https://github.com/bcoe/c8/compare/v10.1.3...v11.0.0)

---
updated-dependencies:
- dependency-name: c8
  dependency-version: 11.0.0
  dependency-type: direct:development
  update-type: version-update:semver-major
...

Signed-off-by: dependabot[bot] <support@github.com>
 2026-04-10 15:51:15 -07:00
dependabot[bot] 4df50600ef build(deps-dev): bump open-cli from 8.0.0 to 9.0.0 
Bumps [open-cli](https://github.com/sindresorhus/open-cli) from 8.0.0 to 9.0.0.
- [Release notes](https://github.com/sindresorhus/open-cli/releases)
- [Commits](https://github.com/sindresorhus/open-cli/compare/v8.0.0...v9.0.0)

---
updated-dependencies:
- dependency-name: open-cli
  dependency-version: 9.0.0
  dependency-type: direct:development
  update-type: version-update:semver-major
...

Signed-off-by: dependabot[bot] <support@github.com>
 2026-04-10 15:44:18 -07:00
dependabot[bot] 4843c538d9 build(deps-dev): bump the development-dependencies group with 3 updates 
Bumps the development-dependencies group with 3 updates: [esbuild](https://github.com/evanw/esbuild), [undici](https://github.com/nodejs/undici) and [yaml](https://github.com/eemeli/yaml).


Updates `esbuild` from 0.27.3 to 0.27.4
- [Release notes](https://github.com/evanw/esbuild/releases)
- [Changelog](https://github.com/evanw/esbuild/blob/main/CHANGELOG.md)
- [Commits](https://github.com/evanw/esbuild/compare/v0.27.3...v0.27.4)

Updates `undici` from 7.24.1 to 7.24.6
- [Release notes](https://github.com/nodejs/undici/releases)
- [Commits](https://github.com/nodejs/undici/compare/v7.24.1...v7.24.6)

Updates `yaml` from 2.8.2 to 2.8.3
- [Release notes](https://github.com/eemeli/yaml/releases)
- [Commits](https://github.com/eemeli/yaml/compare/v2.8.2...v2.8.3)

---
updated-dependencies:
- dependency-name: esbuild
  dependency-version: 0.27.4
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: development-dependencies
- dependency-name: undici
  dependency-version: 7.24.6
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: development-dependencies
- dependency-name: yaml
  dependency-version: 2.8.3
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: development-dependencies
...

Signed-off-by: dependabot[bot] <support@github.com>
 2026-04-10 15:42:14 -07:00
semantic-release-bot f8d387b68d build(release): 3.0.0 [skip ci] 
# [3.0.0](https://github.com/actions/create-github-app-token/compare/v2.2.2...v3.0.0) (2026-03-14)

* feat!: node 24 support ([#275](https://github.com/actions/create-github-app-token/issues/275)) ([2e564a0](https://github.com/actions/create-github-app-token/commit/2e564a0bb8e7cc2b907b2401a2afe177882d4325))
* fix!: require `NODE_USE_ENV_PROXY` for proxy support ([#342](https://github.com/actions/create-github-app-token/issues/342)) ([4451bcb](https://github.com/actions/create-github-app-token/commit/4451bcbc139f8124b0bf04f968ea2586b17df458))

### Bug Fixes

* remove custom proxy handling ([#143](https://github.com/actions/create-github-app-token/issues/143)) ([dce0ab0](https://github.com/actions/create-github-app-token/commit/dce0ab05f36f30b22fd14289fd36655c618e4e8e))

### BREAKING CHANGES

* Custom proxy handling has been removed. If you use HTTP_PROXY or HTTPS_PROXY, you must now also set NODE_USE_ENV_PROXY=1 on the action step.
* Requires [Actions Runner v2.327.1](https://github.com/actions/runner/releases/tag/v2.327.1) or later if you are using a self-hosted runner.
v3.0.0 		2026-03-14 00:22:10 +00:00
Parker Brown d2129bd463 style: remove extra blank line in release workflow 
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
 2026-03-13 17:21:42 -07:00
Parker Brown 77b94efc3e build: refresh generated artifacts 
Regenerate dist bundles and package-lock.json after replaying the release-v3 changes onto next.\n\nCo-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
 2026-03-13 17:21:42 -07:00
Parker Brown 3ab4c66898 chore: move undici to devDependencies 
Remove unused dotenv.\n\nCo-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

(cherry picked from commit adb92d10e9c33600f78e8d1670c5f24c078447f8)
 2026-03-13 17:21:42 -07:00
Parker Brown 739cf66feb docs: update README action versions 
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
(cherry picked from commit b87c921a8e196a5881f0387a9685c0fa784ebde0)
 2026-03-13 17:21:42 -07:00
Parker Brown db40289976 build(deps): bump actions versions in test.yml 
Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com>
(cherry picked from commit e295338c8bf0bfa10348b7311d00869c5c272447)
 2026-03-13 17:21:42 -07:00
Parker Brown 496a7ac4eb test: migrate from AVA to Node.js native test runner (#346) 
AVA stores snapshots in a binary format (`.snap`), which produces no
meaningful diffs and bloats Git history. This replaces AVA with the
built-in `node:test` module, whose snapshot support generates
human-readable text files that are easy to diff and review in pull
requests.

The migration also replaces `@sinonjs/fake-timers` and `execa` with
Node.js built-ins (`node:test` mock timers and `node:child_process`),
removing three dev dependencies total.

- **`tests/index.js`**: Rewritten to use `node:test` with a custom
snapshot serializer that renders strings with actual newlines. Uses
subtests for labeled `stderr`/`stdout` snapshots, and only snapshots
non-empty output.
- **`tests/main-repo-skew.test.js`**: Replace `@sinonjs/fake-timers`
with `mock.timers.enable()` from `node:test`.
- **`tests/README.md`**: Updated documentation to reflect `node --test`
and the new snapshot file.
- **`package.json`**: Remove `ava`, `@sinonjs/fake-timers`, and `execa`
from devDependencies. Update test script to `c8 --100 node --test
tests/index.js`.
- **`tests/index.js.snapshot`**: New text-based snapshot file replacing
binary `tests/snapshots/index.js.snap`.
- **`tests/snapshots/`**: Deleted.

All 22 test scenarios (66 subtests) pass with 100% code coverage.

Closes #344

---------

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com>
(cherry picked from commit f863ba5554)
 2026-03-13 17:21:42 -07:00
Parker Brown 3870dc3051 Rename end-to-end proxy job in test workflow 
(cherry picked from commit c2937b00bd)
 2026-03-13 17:21:42 -07:00
Parker Brown 4451bcbc13 fix!: require NODE_USE_ENV_PROXY for proxy support (#342) 
BREAKING CHANGE: Custom proxy handling has been removed. If you use HTTP_PROXY or HTTPS_PROXY, you must now also set NODE_USE_ENV_PROXY=1 on the action step.
 2026-03-13 17:21:42 -07:00
Parker Brown dce0ab05f3 fix: remove custom proxy handling (#143) 
Undici has added native support for proxy handling, so it is no longer necessary for us to have our own custom proxy handling.

Reverts #102 and resolves #134.

(cherry picked from commit cda91bf2b9)
 2026-03-13 17:21:42 -07:00
Salman Chishti 2e564a0bb8 feat!: node 24 support (#275) 
BREAKING CHANGE: Requires [Actions Runner v2.327.1](https://github.com/actions/runner/releases/tag/v2.327.1) or later if you are using a self-hosted runner.

---------

Co-authored-by: Parker Brown <17183625+parkerbxyz@users.noreply.github.com>
(cherry picked from commit 61789386cb)
 2026-03-13 17:21:42 -07:00
semantic-release-bot fee1f7d63c build(release): 2.2.2 [skip ci] 
## [2.2.2](https://github.com/actions/create-github-app-token/compare/v2.2.1...v2.2.2) (2026-03-13)

### Bug Fixes

* **deps:** bump @actions/core from 1.11.1 to 3.0.0 ([#337](https://github.com/actions/create-github-app-token/issues/337)) ([b044133](https://github.com/actions/create-github-app-token/commit/b04413352d4644ac2131b9a90c074f5e93ca18a1))
* **deps:** bump minimatch from 9.0.5 to 9.0.9 ([#335](https://github.com/actions/create-github-app-token/issues/335)) ([5cbc656](https://github.com/actions/create-github-app-token/commit/5cbc65624c9ddc4589492bda7c8b146223e8c3e4))
* **deps:** bump the production-dependencies group with 4 updates ([#336](https://github.com/actions/create-github-app-token/issues/336)) ([6bda5bc](https://github.com/actions/create-github-app-token/commit/6bda5bc1410576b9a0879ce6076d53345485bba9))
* **deps:** bump undici from 7.16.0 to 7.18.2 ([#323](https://github.com/actions/create-github-app-token/issues/323)) ([b4f638f](https://github.com/actions/create-github-app-token/commit/b4f638f48ee0dcdbb0bc646c48e4cb2a2de847fe))
v2 v2.2.2 		2026-03-13 22:51:54 +00:00
dependabot[bot] 6bda5bc141 fix(deps): bump the production-dependencies group with 4 updates (#336) 
Bumps the production-dependencies group with 4 updates:
[@octokit/auth-app](https://github.com/octokit/auth-app.js),
[@octokit/request](https://github.com/octokit/request.js),
[p-retry](https://github.com/sindresorhus/p-retry) and
[undici](https://github.com/nodejs/undici).

Updates `@octokit/auth-app` from 8.1.2 to 8.2.0
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/octokit/auth-app.js/releases"><code>@​octokit/auth-app</code>'s
releases</a>.</em></p>
<blockquote>
<h2>v8.2.0</h2>
<h1><a
href="https://github.com/octokit/auth-app.js/compare/v8.1.2...v8.2.0">8.2.0</a>
(2026-02-03)</h1>
<h3>Features</h3>
<ul>
<li>handling exp is too far in the future (<a
href="https://redirect.github.com/octokit/auth-app.js/issues/699">#699</a>)
(<a
href="https://github.com/octokit/auth-app.js/commit/6201580be6cc3f0967c7454d5de92db35e353041">6201580</a>)</li>
<li>Add enterprise installation route to JWT-authenticated routes (<a
href="https://redirect.github.com/octokit/auth-app.js/issues/736">#736</a>)
(<a
href="https://github.com/octokit/auth-app.js/commit/5b218af8ee91347b25ef944aac76932e45b997d0">5b218af</a>)</li>
</ul>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/octokit/auth-app.js/commit/6201580be6cc3f0967c7454d5de92db35e353041"><code>6201580</code></a>
feat: handling exp is too far in the future (<a
href="https://redirect.github.com/octokit/auth-app.js/issues/699">#699</a>)</li>
<li><a
href="https://github.com/octokit/auth-app.js/commit/5b218af8ee91347b25ef944aac76932e45b997d0"><code>5b218af</code></a>
Add enterprise installation route to JWT-authenticated routes (<a
href="https://redirect.github.com/octokit/auth-app.js/issues/736">#736</a>)</li>
<li><a
href="https://github.com/octokit/auth-app.js/commit/4486c10028249f4f2ffaabeafde986edca92e7b5"><code>4486c10</code></a>
build(deps-dev): bump vite from 7.1.7 to 7.1.11 (<a
href="https://redirect.github.com/octokit/auth-app.js/issues/728">#728</a>)</li>
<li><a
href="https://github.com/octokit/auth-app.js/commit/e1fecc4ea8c5475da1a1d9c6c119c9322087dbd4"><code>e1fecc4</code></a>
build(deps): bump glob from 10.4.5 to 10.5.0 (<a
href="https://redirect.github.com/octokit/auth-app.js/issues/733">#733</a>)</li>
<li>See full diff in <a
href="https://github.com/octokit/auth-app.js/compare/v8.1.2...v8.2.0">compare
view</a></li>
</ul>
</details>
<details>
<summary>Maintainer changes</summary>
<p>This version was pushed to npm by [GitHub Actions](<a
href="https://www.npmjs.com/~GitHub">https://www.npmjs.com/~GitHub</a>
Actions), a new releaser for <code>@​octokit/auth-app</code> since your
current version.</p>
</details>
<br />

Updates `@octokit/request` from 10.0.7 to 10.0.8
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/octokit/request.js/releases"><code>@​octokit/request</code>'s
releases</a>.</em></p>
<blockquote>
<h2>v10.0.8</h2>
<h2><a
href="https://github.com/octokit/request.js/compare/v10.0.7...v10.0.8">10.0.8</a>
(2026-02-20)</h2>
<h3>Bug Fixes</h3>
<ul>
<li>use <code>json-with-bigint</code> instead of built-in JSON methods
in order to properly support int64's (<a
href="https://redirect.github.com/octokit/request.js/issues/798">#798</a>)
(<a
href="https://github.com/octokit/request.js/commit/f13f5d9814cec9e51cdbe57e3864f9a7f95a9731">f13f5d9</a>)</li>
</ul>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/octokit/request.js/commit/f13f5d9814cec9e51cdbe57e3864f9a7f95a9731"><code>f13f5d9</code></a>
fix: use <code>json-with-bigint</code> instead of built-in JSON methods
in order to prop...</li>
<li><a
href="https://github.com/octokit/request.js/commit/9ba6ae0fd2eff35a6c29a9f032eca6e9ba002976"><code>9ba6ae0</code></a>
Document that unsuccessful HTTP status code result in an exception (<a
href="https://redirect.github.com/octokit/request.js/issues/795">#795</a>)</li>
<li><a
href="https://github.com/octokit/request.js/commit/7160b8201ee183d57e3572c9ac78aa3f241c9468"><code>7160b82</code></a>
chore(deps): replace glob with tinyglobby (<a
href="https://redirect.github.com/octokit/request.js/issues/791">#791</a>)</li>
<li><a
href="https://github.com/octokit/request.js/commit/ab8018b6d42de25adb305e3ea5ea840ee2805481"><code>ab8018b</code></a>
ci(action): update peter-evans/create-or-update-comment action to v5 (<a
href="https://redirect.github.com/octokit/request.js/issues/776">#776</a>)</li>
<li><a
href="https://github.com/octokit/request.js/commit/fb916e454df205980835281368da81a003cde30d"><code>fb916e4</code></a>
build(deps): bump vite from 6.3.4 to 6.4.1 (<a
href="https://redirect.github.com/octokit/request.js/issues/780">#780</a>)</li>
<li><a
href="https://github.com/octokit/request.js/commit/e1eb7693969a87cbdde278c82a7474b8acec9207"><code>e1eb769</code></a>
chore(deps): update dependency esbuild to ^0.27.0 (<a
href="https://redirect.github.com/octokit/request.js/issues/784">#784</a>)</li>
<li>See full diff in <a
href="https://github.com/octokit/request.js/compare/v10.0.7...v10.0.8">compare
view</a></li>
</ul>
</details>
<details>
<summary>Maintainer changes</summary>
<p>This version was pushed to npm by [GitHub Actions](<a
href="https://www.npmjs.com/~GitHub">https://www.npmjs.com/~GitHub</a>
Actions), a new releaser for <code>@​octokit/request</code> since your
current version.</p>
</details>
<br />

Updates `p-retry` from 7.1.0 to 7.1.1
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/sindresorhus/p-retry/releases">p-retry's
releases</a>.</em></p>
<blockquote>
<h2>v7.1.1</h2>
<ul>
<li>Fix delayed abort when signal is already aborted before delay phase
2aba573</li>
</ul>
<hr />
<p><a
href="https://github.com/sindresorhus/p-retry/compare/v7.1.0...v7.1.1">https://github.com/sindresorhus/p-retry/compare/v7.1.0...v7.1.1</a></p>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/sindresorhus/p-retry/commit/0b1e29877422c40b59cad4a4c938dcf44fe512ce"><code>0b1e298</code></a>
7.1.1</li>
<li><a
href="https://github.com/sindresorhus/p-retry/commit/2aba573c0fdca165c4d95262f51ae56902f2f892"><code>2aba573</code></a>
Fix delayed abort when signal is already aborted before delay phase</li>
<li><a
href="https://github.com/sindresorhus/p-retry/commit/6ac326b188834f4af5a54cedc114f67f0f510613"><code>6ac326b</code></a>
Minor tweak</li>
<li>See full diff in <a
href="https://github.com/sindresorhus/p-retry/compare/v7.1.0...v7.1.1">compare
view</a></li>
</ul>
</details>
<br />

Updates `undici` from 7.16.0 to 7.22.0
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/nodejs/undici/releases">undici's
releases</a>.</em></p>
<blockquote>
<h2>v7.22.0</h2>
<h2>What's Changed</h2>
<ul>
<li>docs: fix syntax highlighting in WebSocket.md by <a
href="https://github.com/styfle"><code>@​styfle</code></a> in <a
href="https://redirect.github.com/nodejs/undici/pull/4814">nodejs/undici#4814</a></li>
<li>fix: use OR operator in includesCredentials per WHATWG URL Standard
by <a href="https://github.com/jackhax"><code>@​jackhax</code></a> in <a
href="https://redirect.github.com/nodejs/undici/pull/4816">nodejs/undici#4816</a></li>
<li>feat(dispatcher/env-http-proxy-agent): strip leading dot and
asterisk by <a
href="https://github.com/SuperOleg39"><code>@​SuperOleg39</code></a> in
<a
href="https://redirect.github.com/nodejs/undici/pull/4676">nodejs/undici#4676</a></li>
<li>fix: route WebSocket upgrades through onRequestUpgrade by <a
href="https://github.com/mcollina"><code>@​mcollina</code></a> in <a
href="https://redirect.github.com/nodejs/undici/pull/4787">nodejs/undici#4787</a></li>
<li>build(deps-dev): bump esbuild from 0.25.12 to 0.27.3 by <a
href="https://github.com/dependabot"><code>@​dependabot</code></a>[bot]
in <a
href="https://redirect.github.com/nodejs/undici/pull/4821">nodejs/undici#4821</a></li>
<li>fix(deduplicate): do not deduplicate non-safe methods by default by
<a href="https://github.com/mcollina"><code>@​mcollina</code></a> in <a
href="https://redirect.github.com/nodejs/undici/pull/4818">nodejs/undici#4818</a></li>
<li>feat: Support async cache stores in revalidation by <a
href="https://github.com/marcopiraccini"><code>@​marcopiraccini</code></a>
in <a
href="https://redirect.github.com/nodejs/undici/pull/4826">nodejs/undici#4826</a></li>
</ul>
<h2>New Contributors</h2>
<ul>
<li><a href="https://github.com/jackhax"><code>@​jackhax</code></a> made
their first contribution in <a
href="https://redirect.github.com/nodejs/undici/pull/4816">nodejs/undici#4816</a></li>
<li><a
href="https://github.com/marcopiraccini"><code>@​marcopiraccini</code></a>
made their first contribution in <a
href="https://redirect.github.com/nodejs/undici/pull/4826">nodejs/undici#4826</a></li>
</ul>
<p><strong>Full Changelog</strong>: <a
href="https://github.com/nodejs/undici/compare/v7.21.0...v7.22.0">https://github.com/nodejs/undici/compare/v7.21.0...v7.22.0</a></p>
<h2>v7.21.0</h2>
<h2>What's Changed</h2>
<ul>
<li>build(deps): bump actions/setup-node from 6.0.0 to 6.2.0 by <a
href="https://github.com/dependabot"><code>@​dependabot</code></a>[bot]
in <a
href="https://redirect.github.com/nodejs/undici/pull/4796">nodejs/undici#4796</a></li>
<li>test: restore global dispatcher after fetch tests by <a
href="https://github.com/mcollina"><code>@​mcollina</code></a> in <a
href="https://redirect.github.com/nodejs/undici/pull/4790">nodejs/undici#4790</a></li>
<li>Add missing <code>close</code> method to WebSocketStream interface
by <a href="https://github.com/piotr-cz"><code>@​piotr-cz</code></a> in
<a
href="https://redirect.github.com/nodejs/undici/pull/4802">nodejs/undici#4802</a></li>
<li>fix: error stream instead of canceling by <a
href="https://github.com/KhafraDev"><code>@​KhafraDev</code></a> in <a
href="https://redirect.github.com/nodejs/undici/pull/4804">nodejs/undici#4804</a></li>
<li>Fix clientTtl cleanup race in Agent by <a
href="https://github.com/mcollina"><code>@​mcollina</code></a> in <a
href="https://redirect.github.com/nodejs/undici/pull/4807">nodejs/undici#4807</a></li>
<li>feat(<a
href="https://redirect.github.com/nodejs/undici/issues/4230">#4230</a>):
Implement pingInterval for dispatching PING frames by <a
href="https://github.com/metcoder95"><code>@​metcoder95</code></a> in <a
href="https://redirect.github.com/nodejs/undici/pull/4296">nodejs/undici#4296</a></li>
<li>fix: handle undefined __filename in bundled environments by <a
href="https://github.com/mcollina"><code>@​mcollina</code></a> in <a
href="https://redirect.github.com/nodejs/undici/pull/4812">nodejs/undici#4812</a></li>
<li>fix: set finalizer only for fetch responses by <a
href="https://github.com/tsctx"><code>@​tsctx</code></a> in <a
href="https://redirect.github.com/nodejs/undici/pull/4803">nodejs/undici#4803</a></li>
</ul>
<h2>New Contributors</h2>
<ul>
<li><a href="https://github.com/piotr-cz"><code>@​piotr-cz</code></a>
made their first contribution in <a
href="https://redirect.github.com/nodejs/undici/pull/4802">nodejs/undici#4802</a></li>
</ul>
<p><strong>Full Changelog</strong>: <a
href="https://github.com/nodejs/undici/compare/v7.20.0...v7.21.0">https://github.com/nodejs/undici/compare/v7.20.0...v7.21.0</a></p>
<h2>v7.20.0</h2>
<h2>What's Changed</h2>
<ul>
<li>fix: preserve fetch stack traces by <a
href="https://github.com/mcollina"><code>@​mcollina</code></a> in <a
href="https://redirect.github.com/nodejs/undici/pull/4778">nodejs/undici#4778</a></li>
<li>Fix error handling in MockPool example by <a
href="https://github.com/dave-kennedy"><code>@​dave-kennedy</code></a>
in <a
href="https://redirect.github.com/nodejs/undici/pull/4781">nodejs/undici#4781</a></li>
<li>feat: expose statusText in request() ResponseData by <a
href="https://github.com/domenic"><code>@​domenic</code></a> in <a
href="https://redirect.github.com/nodejs/undici/pull/4784">nodejs/undici#4784</a></li>
<li>test: reduce retry-after invalid date flake by <a
href="https://github.com/mcollina"><code>@​mcollina</code></a> in <a
href="https://redirect.github.com/nodejs/undici/pull/4788">nodejs/undici#4788</a></li>
<li>extractBody fixes by <a
href="https://github.com/KhafraDev"><code>@​KhafraDev</code></a> in <a
href="https://redirect.github.com/nodejs/undici/pull/4791">nodejs/undici#4791</a></li>
<li>fix: MockAgent delayed response with AbortSignal (<a
href="https://redirect.github.com/nodejs/undici/issues/4693">#4693</a>)
by <a href="https://github.com/mcollina"><code>@​mcollina</code></a> in
<a
href="https://redirect.github.com/nodejs/undici/pull/4772">nodejs/undici#4772</a></li>
<li>fix: onParserTimeout potentially accessing undefined by <a
href="https://github.com/vbfox"><code>@​vbfox</code></a> in <a
href="https://redirect.github.com/nodejs/undici/pull/4758">nodejs/undici#4758</a></li>
</ul>
<h2>New Contributors</h2>
<ul>
<li><a
href="https://github.com/dave-kennedy"><code>@​dave-kennedy</code></a>
made their first contribution in <a
href="https://redirect.github.com/nodejs/undici/pull/4781">nodejs/undici#4781</a></li>
<li><a href="https://github.com/vbfox"><code>@​vbfox</code></a> made
their first contribution in <a
href="https://redirect.github.com/nodejs/undici/pull/4758">nodejs/undici#4758</a></li>
</ul>
<p><strong>Full Changelog</strong>: <a
href="https://github.com/nodejs/undici/compare/v7.19.2...v7.20.0">https://github.com/nodejs/undici/compare/v7.19.2...v7.20.0</a></p>
<h2>v7.19.2</h2>
<h2>What's Changed</h2>
<!-- raw HTML omitted -->
</blockquote>
<p>... (truncated)</p>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/nodejs/undici/commit/0a236106a3a3e1b0aab424f71de2a68ca2c1d37b"><code>0a23610</code></a>
Bumped v7.22.0 (<a
href="https://redirect.github.com/nodejs/undici/issues/4829">#4829</a>)</li>
<li><a
href="https://github.com/nodejs/undici/commit/f3c5c614901e4ba29f2f60730c3d4f28e60a5186"><code>f3c5c61</code></a>
feat: Support async cache stores in revalidation (<a
href="https://redirect.github.com/nodejs/undici/issues/4826">#4826</a>)</li>
<li><a
href="https://github.com/nodejs/undici/commit/9b78a44eb21cabe0451263ef8e3cfc7ad8e40876"><code>9b78a44</code></a>
fix(deduplicate): avoid deduping methods not in methods option (<a
href="https://redirect.github.com/nodejs/undici/issues/4818">#4818</a>)</li>
<li><a
href="https://github.com/nodejs/undici/commit/0ce57bad2c171a16c043c8234317ef5383f86e0b"><code>0ce57ba</code></a>
build(deps-dev): bump esbuild from 0.25.12 to 0.27.3 (<a
href="https://redirect.github.com/nodejs/undici/issues/4821">#4821</a>)</li>
<li><a
href="https://github.com/nodejs/undici/commit/2453caf93824997c24383e5a84fddbfa783113b0"><code>2453caf</code></a>
fix: route websocket upgrades through new handler API (<a
href="https://redirect.github.com/nodejs/undici/issues/4787">#4787</a>)</li>
<li><a
href="https://github.com/nodejs/undici/commit/4658cdf5eacf3f6692ec96811a0e49e6b9bc060a"><code>4658cdf</code></a>
feat(dispatcher/env-http-proxy-agent): strip leading dot and asterisk
(<a
href="https://redirect.github.com/nodejs/undici/issues/4676">#4676</a>)</li>
<li><a
href="https://github.com/nodejs/undici/commit/a821c5669fa653364649d8fb7b36957702c548f5"><code>a821c56</code></a>
fix: use OR operator in includesCredentials per WHATWG URL Standard (<a
href="https://redirect.github.com/nodejs/undici/issues/4816">#4816</a>)</li>
<li><a
href="https://github.com/nodejs/undici/commit/b3326b58969e2370a7da77d80dbad4df2f36ca1e"><code>b3326b5</code></a>
docs: fix syntax highlighting in WebSocket.md (<a
href="https://redirect.github.com/nodejs/undici/issues/4814">#4814</a>)</li>
<li><a
href="https://github.com/nodejs/undici/commit/393c0da68691a6da8ea0a774e38bcce2889be89e"><code>393c0da</code></a>
Bumped v7.21.0 (<a
href="https://redirect.github.com/nodejs/undici/issues/4813">#4813</a>)</li>
<li><a
href="https://github.com/nodejs/undici/commit/47f9b9664759d18d30c3c8f321425bee102e1df3"><code>47f9b96</code></a>
fix: set finalizer only for fetch responses (<a
href="https://redirect.github.com/nodejs/undici/issues/4803">#4803</a>)</li>
<li>Additional commits viewable in <a
href="https://github.com/nodejs/undici/compare/v7.16.0...v7.22.0">compare
view</a></li>
</ul>
</details>
<br />


Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.

[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)

---

<details>
<summary>Dependabot commands and options</summary>
<br />

You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot show <dependency name> ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore <dependency name> major version` will close this
group update PR and stop Dependabot creating any more for the specific
dependency's major version (unless you unignore this specific
dependency's major version or upgrade to it yourself)
- `@dependabot ignore <dependency name> minor version` will close this
group update PR and stop Dependabot creating any more for the specific
dependency's minor version (unless you unignore this specific
dependency's minor version or upgrade to it yourself)
- `@dependabot ignore <dependency name>` will close this group update PR
and stop Dependabot creating any more for the specific dependency
(unless you unignore this specific dependency or upgrade to it yourself)
- `@dependabot unignore <dependency name>` will remove all of the ignore
conditions of the specified dependency
- `@dependabot unignore <dependency name> <ignore condition>` will
remove the ignore condition of the specified dependency and ignore
conditions


</details>

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: Parker Brown <17183625+parkerbxyz@users.noreply.github.com>
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
 2026-03-13 15:51:23 -07:00
dependabot[bot] b04413352d fix(deps): bump @actions/core from 1.11.1 to 3.0.0 (#337) 
Bumps
[@actions/core](https://github.com/actions/toolkit/tree/HEAD/packages/core)
from 1.11.1 to 3.0.0.
<details>
<summary>Changelog</summary>
<p><em>Sourced from <a
href="https://github.com/actions/toolkit/blob/main/packages/core/RELEASES.md"><code>@​actions/core</code>'s
changelog</a>.</em></p>
<blockquote>
<h2>3.0.0</h2>
<ul>
<li><strong>Breaking change</strong>: Package is now ESM-only
<ul>
<li>CommonJS consumers must use dynamic <code>import()</code> instead of
<code>require()</code></li>
</ul>
</li>
</ul>
<h2>2.0.3</h2>
<ul>
<li>Bump <code>@actions/http-client</code> to <code>3.0.2</code></li>
</ul>
<h2>2.0.1</h2>
<ul>
<li>Bump <code>@​actions/exec</code> from 1.1.1 to 2.0.0 <a
href="https://redirect.github.com/actions/toolkit/pull/2199">#2199</a></li>
</ul>
<h2>2.0.0</h2>
<ul>
<li>Add support for Node 24 <a
href="https://redirect.github.com/actions/toolkit/pull/2110">#2110</a></li>
<li>Bump <code>@​actions/http-client</code> from 2.0.1 to 3.0.0</li>
</ul>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li>See full diff in <a
href="https://github.com/actions/toolkit/commits/HEAD/packages/core">compare
view</a></li>
</ul>
</details>
<details>
<summary>Maintainer changes</summary>
<p>This version was pushed to npm by [GitHub Actions](<a
href="https://www.npmjs.com/~GitHub">https://www.npmjs.com/~GitHub</a>
Actions), a new releaser for <code>@​actions/core</code> since your
current version.</p>
</details>
<br />


[![Dependabot compatibility
score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=@actions/core&package-manager=npm_and_yarn&previous-version=1.11.1&new-version=3.0.0)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)

Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.

[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)

---

<details>
<summary>Dependabot commands and options</summary>
<br />

You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot show <dependency name> ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore this major version` will close this PR and stop
Dependabot creating any more for this major version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this minor version` will close this PR and stop
Dependabot creating any more for this minor version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this dependency` will close this PR and stop
Dependabot creating any more for this dependency (unless you reopen the
PR or upgrade to it yourself)


</details>

---------

Co-authored-by: Parker Brown <17183625+parkerbxyz@users.noreply.github.com>
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
 2026-03-13 15:51:23 -07:00
dependabot[bot] 5cbc65624c fix(deps): bump minimatch from 9.0.5 to 9.0.9 (#335) 
Bumps [minimatch](https://github.com/isaacs/minimatch) from 9.0.5 to
9.0.9.
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/isaacs/minimatch/commit/8a10e473e2e0ff03c2d4de308f257093af2bce21"><code>8a10e47</code></a>
9.0.9</li>
<li><a
href="https://github.com/isaacs/minimatch/commit/c6f180636cebd4de2f9af7ef29ca4c9bf2eeef02"><code>c6f1806</code></a>
brace-expansion@2</li>
<li><a
href="https://github.com/isaacs/minimatch/commit/446cfa3e2aa3ef45bd4a27fa4418221e158489f6"><code>446cfa3</code></a>
9.0.8</li>
<li><a
href="https://github.com/isaacs/minimatch/commit/8fa151ab95fd4e2acd6e1a81f10d02dc7c1098d3"><code>8fa151a</code></a>
docs: add warning about ReDoS</li>
<li><a
href="https://github.com/isaacs/minimatch/commit/71b78a2a4cad3a40af08a39c065e71bbf69ea7f7"><code>71b78a2</code></a>
fix partial matching of globstar patterns</li>
<li><a
href="https://github.com/isaacs/minimatch/commit/2de496f6d9362dd92460f35ffa6ff8de2907244b"><code>2de496f</code></a>
9.0.7</li>
<li><a
href="https://github.com/isaacs/minimatch/commit/0d4616de9193bf1d359271662e92657bb51b2f75"><code>0d4616d</code></a>
limit nested extglob recursion, flatten extglobs</li>
<li><a
href="https://github.com/isaacs/minimatch/commit/7117ef381e74deace1c62a74d2298c8fe61d10ca"><code>7117ef3</code></a>
9.0.6</li>
<li><a
href="https://github.com/isaacs/minimatch/commit/2418458b7fe82e0a1fd1a1b6f618c41c90b9848a"><code>2418458</code></a>
update deps, do not checkin dist</li>
<li><a
href="https://github.com/isaacs/minimatch/commit/1d1f531009d5e4a86083de37e5ef3f301e073986"><code>1d1f531</code></a>
update deps</li>
<li>Additional commits viewable in <a
href="https://github.com/isaacs/minimatch/compare/v9.0.5...v9.0.9">compare
view</a></li>
</ul>
</details>
<br />


[![Dependabot compatibility
score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=minimatch&package-manager=npm_and_yarn&previous-version=9.0.5&new-version=9.0.9)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)

Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.

[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)

---

<details>
<summary>Dependabot commands and options</summary>
<br />

You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot show <dependency name> ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore this major version` will close this PR and stop
Dependabot creating any more for this major version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this minor version` will close this PR and stop
Dependabot creating any more for this minor version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this dependency` will close this PR and stop
Dependabot creating any more for this dependency (unless you reopen the
PR or upgrade to it yourself)
You can disable automated security fix PRs for this repo from the
[Security Alerts
page](https://github.com/actions/create-github-app-token/network/alerts).

</details>

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
 2026-03-13 15:51:23 -07:00
dependabot[bot] b4f638f48e fix(deps): bump undici from 7.16.0 to 7.18.2 (#323) 
Bumps [undici](https://github.com/nodejs/undici) from 7.16.0 to 7.18.2.
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/nodejs/undici/releases">undici's
releases</a>.</em></p>
<blockquote>
<h2>v7.18.2</h2>
<h2>⚠️ Security Release</h2>
<p>This fixes <a
href="https://github.com/nodejs/undici/security/advisories/GHSA-g9mf-h72j-4rw9">https://github.com/nodejs/undici/security/advisories/GHSA-g9mf-h72j-4rw9</a>
and CVE-2026-22036.</p>
<h2>What's Changed</h2>
<ul>
<li>fix(decompress): limit Content-Encoding chain to 5 to prevent
resourc… by <a
href="https://github.com/mcollina"><code>@​mcollina</code></a> in <a
href="https://redirect.github.com/nodejs/undici/pull/4729">nodejs/undici#4729</a></li>
</ul>
<p><strong>Full Changelog</strong>: <a
href="https://github.com/nodejs/undici/compare/v7.18.1...v7.18.2">https://github.com/nodejs/undici/compare/v7.18.1...v7.18.2</a></p>
<h2>v7.18.1</h2>
<h2>What's Changed</h2>
<ul>
<li>Test and Fix running without SSL by <a
href="https://github.com/mcollina"><code>@​mcollina</code></a> in <a
href="https://redirect.github.com/nodejs/undici/pull/4727">nodejs/undici#4727</a></li>
<li>docs: add security warning for strictContentLength option by <a
href="https://github.com/mcollina"><code>@​mcollina</code></a> in <a
href="https://redirect.github.com/nodejs/undici/pull/4726">nodejs/undici#4726</a></li>
<li>build(deps): bump step-security/harden-runner from 2.13.1 to 2.14.0
by <a
href="https://github.com/dependabot"><code>@​dependabot</code></a>[bot]
in <a
href="https://redirect.github.com/nodejs/undici/pull/4718">nodejs/undici#4718</a></li>
<li>build(deps): bump actions/checkout from 6.0.0 to 6.0.1 by <a
href="https://github.com/dependabot"><code>@​dependabot</code></a>[bot]
in <a
href="https://redirect.github.com/nodejs/undici/pull/4719">nodejs/undici#4719</a></li>
</ul>
<p><strong>Full Changelog</strong>: <a
href="https://github.com/nodejs/undici/compare/v7.18.0...v7.18.1">https://github.com/nodejs/undici/compare/v7.18.0...v7.18.1</a></p>
<h2>v7.18.0</h2>
<h2>What's Changed</h2>
<p><strong>Full Changelog</strong>: <a
href="https://github.com/nodejs/undici/compare/v7.17.0...v7.18.0">https://github.com/nodejs/undici/compare/v7.17.0...v7.18.0</a></p>
<h2>v7.17.0</h2>
<h2>What's Changed</h2>
<ul>
<li>chore: extract infra and encoding methods by <a
href="https://github.com/Uzlopak"><code>@​Uzlopak</code></a> in <a
href="https://redirect.github.com/nodejs/undici/pull/4523">nodejs/undici#4523</a></li>
<li>ci: remove h2 by <a
href="https://github.com/Uzlopak"><code>@​Uzlopak</code></a> in <a
href="https://redirect.github.com/nodejs/undici/pull/4534">nodejs/undici#4534</a></li>
<li>ci: make nodejs-shared wf reusable, install binaryen for wasm-opt,
test on node-nightly by <a
href="https://github.com/Uzlopak"><code>@​Uzlopak</code></a> in <a
href="https://redirect.github.com/nodejs/undici/pull/4535">nodejs/undici#4535</a></li>
<li>ci: fix nightly shared library case by <a
href="https://github.com/Uzlopak"><code>@​Uzlopak</code></a> in <a
href="https://redirect.github.com/nodejs/undici/pull/4543">nodejs/undici#4543</a></li>
<li>test: consume bodies of fetch responses to fix failing macos 20 ci
by <a href="https://github.com/Uzlopak"><code>@​Uzlopak</code></a> in <a
href="https://redirect.github.com/nodejs/undici/pull/4528">nodejs/undici#4528</a></li>
<li>docs: add Cache Interceptor example to README by <a
href="https://github.com/tawseefnabi"><code>@​tawseefnabi</code></a> in
<a
href="https://redirect.github.com/nodejs/undici/pull/4393">nodejs/undici#4393</a></li>
<li>test: remove node20 version check by <a
href="https://github.com/Uzlopak"><code>@​Uzlopak</code></a> in <a
href="https://redirect.github.com/nodejs/undici/pull/4544">nodejs/undici#4544</a></li>
<li>types: use MessagePort instance type in MessageEvent by <a
href="https://github.com/Renegade334"><code>@​Renegade334</code></a> in
<a
href="https://redirect.github.com/nodejs/undici/pull/4546">nodejs/undici#4546</a></li>
<li>ci: set write permissions on job level by <a
href="https://github.com/Uzlopak"><code>@​Uzlopak</code></a> in <a
href="https://redirect.github.com/nodejs/undici/pull/4537">nodejs/undici#4537</a></li>
<li>lint: activate n/no-process-exit by <a
href="https://github.com/Uzlopak"><code>@​Uzlopak</code></a> in <a
href="https://redirect.github.com/nodejs/undici/pull/4548">nodejs/undici#4548</a></li>
<li>ci: run benchmarks on pull_requests and by pushing on specific
branches only by <a
href="https://github.com/Uzlopak"><code>@​Uzlopak</code></a> in <a
href="https://redirect.github.com/nodejs/undici/pull/4536">nodejs/undici#4536</a></li>
<li>chore: activate n/prefer-node-protocol to enforce
<code>'node:'</code> prefix for requiring node built-ins by <a
href="https://github.com/Uzlopak"><code>@​Uzlopak</code></a> in <a
href="https://redirect.github.com/nodejs/undici/pull/4547">nodejs/undici#4547</a></li>
<li>feat(H2): correct CONNECT behaviour by <a
href="https://github.com/metcoder95"><code>@​metcoder95</code></a> in <a
href="https://redirect.github.com/nodejs/undici/pull/4541">nodejs/undici#4541</a></li>
<li>test: fix plans by <a
href="https://github.com/Uzlopak"><code>@​Uzlopak</code></a> in <a
href="https://redirect.github.com/nodejs/undici/pull/4550">nodejs/undici#4550</a></li>
<li>feat: add runtime feature &quot;detection&quot; by <a
href="https://github.com/Uzlopak"><code>@​Uzlopak</code></a> in <a
href="https://redirect.github.com/nodejs/undici/pull/4545">nodejs/undici#4545</a></li>
<li>perf: use less promises in extractBody by <a
href="https://github.com/Uzlopak"><code>@​Uzlopak</code></a> in <a
href="https://redirect.github.com/nodejs/undici/pull/4458">nodejs/undici#4458</a></li>
<li>fix(proxy-agent): add missing return after callback-call by <a
href="https://github.com/Uzlopak"><code>@​Uzlopak</code></a> in <a
href="https://redirect.github.com/nodejs/undici/pull/4553">nodejs/undici#4553</a></li>
<li>fix: remove redundant line in retry-handler by <a
href="https://github.com/Uzlopak"><code>@​Uzlopak</code></a> in <a
href="https://redirect.github.com/nodejs/undici/pull/4554">nodejs/undici#4554</a></li>
<li>ci: add no-wasm-simd option by <a
href="https://github.com/Uzlopak"><code>@​Uzlopak</code></a> in <a
href="https://redirect.github.com/nodejs/undici/pull/4533">nodejs/undici#4533</a></li>
<li>fix: use lazyloaders for runtime feature detection by <a
href="https://github.com/Uzlopak"><code>@​Uzlopak</code></a> in <a
href="https://redirect.github.com/nodejs/undici/pull/4557">nodejs/undici#4557</a></li>
<li>fix: minor changes in dispatcher-base.js and types for Dispatcher by
<a href="https://github.com/Uzlopak"><code>@​Uzlopak</code></a> in <a
href="https://redirect.github.com/nodejs/undici/pull/4556">nodejs/undici#4556</a></li>
</ul>
<!-- raw HTML omitted -->
</blockquote>
<p>... (truncated)</p>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/nodejs/undici/commit/7e5cb2d7468633b48679627061d696a0bb45f651"><code>7e5cb2d</code></a>
Bumped v7.18.2 (<a
href="https://redirect.github.com/nodejs/undici/issues/4730">#4730</a>)</li>
<li><a
href="https://github.com/nodejs/undici/commit/b04e3cbb569c1596f86c108e9b52c79d8475dcb3"><code>b04e3cb</code></a>
fix(decompress): limit Content-Encoding chain to 5 to prevent resource
exhaus...</li>
<li><a
href="https://github.com/nodejs/undici/commit/2bcb77bbc27f966ac86e31154161792a4a8dadf5"><code>2bcb77b</code></a>
Bumped v7.18.1 (<a
href="https://redirect.github.com/nodejs/undici/issues/4728">#4728</a>)</li>
<li><a
href="https://github.com/nodejs/undici/commit/58a12b7f19f5d4b186c90aed2e3a55a3ba37decf"><code>58a12b7</code></a>
build(deps): bump actions/checkout from 6.0.0 to 6.0.1 (<a
href="https://redirect.github.com/nodejs/undici/issues/4719">#4719</a>)</li>
<li><a
href="https://github.com/nodejs/undici/commit/5fa2930582cab9c387df5cb2ddef44cb42bdf4a9"><code>5fa2930</code></a>
build(deps): bump step-security/harden-runner from 2.13.1 to 2.14.0 (<a
href="https://redirect.github.com/nodejs/undici/issues/4718">#4718</a>)</li>
<li><a
href="https://github.com/nodejs/undici/commit/fbbe283fc4054c35ad21316bcf65996b0929ed58"><code>fbbe283</code></a>
docs: add security warning for strictContentLength option (<a
href="https://redirect.github.com/nodejs/undici/issues/4726">#4726</a>)</li>
<li><a
href="https://github.com/nodejs/undici/commit/ce12d9e5dc1a72724cbef8ac43219ba9643b9142"><code>ce12d9e</code></a>
fix: do not crash if Node.js is compiled without SSL (<a
href="https://redirect.github.com/nodejs/undici/issues/4727">#4727</a>)</li>
<li><a
href="https://github.com/nodejs/undici/commit/ebe3e33ea4d25402e0dc12dcc67902fdb7f231d4"><code>ebe3e33</code></a>
Bumped v7.18.0 (<a
href="https://redirect.github.com/nodejs/undici/issues/4725">#4725</a>)</li>
<li><a
href="https://github.com/nodejs/undici/commit/4e9b88b1c78349a956babef1151add83866f2dfb"><code>4e9b88b</code></a>
fix: limit Content-Encoding chain to 5 to prevent resource
exhaustion</li>
<li><a
href="https://github.com/nodejs/undici/commit/d5607677d444553183b0a637f687d20167427b36"><code>d560767</code></a>
Bumped v7.17.0 (<a
href="https://redirect.github.com/nodejs/undici/issues/4724">#4724</a>)</li>
<li>Additional commits viewable in <a
href="https://github.com/nodejs/undici/compare/v7.16.0...v7.18.2">compare
view</a></li>
</ul>
</details>
<br />


[![Dependabot compatibility
score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=undici&package-manager=npm_and_yarn&previous-version=7.16.0&new-version=7.18.2)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)

You can trigger a rebase of this PR by commenting `@dependabot rebase`.

[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)

---

<details>
<summary>Dependabot commands and options</summary>
<br />

You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot merge` will merge this PR after your CI passes on it
- `@dependabot squash and merge` will squash and merge this PR after
your CI passes on it
- `@dependabot cancel merge` will cancel a previously requested merge
and block automerging
- `@dependabot reopen` will reopen this PR if it is closed
- `@dependabot close` will close this PR and stop Dependabot recreating
it. You can achieve the same result by closing it manually
- `@dependabot show <dependency name> ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore this major version` will close this PR and stop
Dependabot creating any more for this major version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this minor version` will close this PR and stop
Dependabot creating any more for this minor version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this dependency` will close this PR and stop
Dependabot creating any more for this dependency (unless you reopen the
PR or upgrade to it yourself)
You can disable automated security fix PRs for this repo from the
[Security Alerts
page](https://github.com/actions/create-github-app-token/network/alerts).

</details>

> **Note**
> Automatic rebases have been disabled on this pull request as it has
been open for over 30 days.

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
 2026-03-13 15:51:23 -07:00
dependabot[bot] efd9eb0674 build(deps-dev): bump tar from 7.4.3 to 7.5.11 (#341) 
Bumps [tar](https://github.com/isaacs/node-tar) from 7.4.3 to 7.5.11.
<details>
<summary>Changelog</summary>
<p><em>Sourced from <a
href="https://github.com/isaacs/node-tar/blob/main/CHANGELOG.md">tar's
changelog</a>.</em></p>
<blockquote>
<h1>Changelog</h1>
<h2>7.5</h2>
<ul>
<li>Added <code>zstd</code> compression support.</li>
<li>Consistent TOCTOU behavior in sync t.list</li>
<li>Only read from ustar block if not specified in Pax</li>
<li>Fix sync tar.list when file size reduces while reading</li>
<li>Sanitize absolute linkpaths properly</li>
<li>Prevent writing hardlink entries to the archive ahead of their
file target</li>
</ul>
<h2>7.4</h2>
<ul>
<li>Deprecate <code>onentry</code> in favor of <code>onReadEntry</code>
for clarity.</li>
</ul>
<h2>7.3</h2>
<ul>
<li>Add <code>onWriteEntry</code> option</li>
</ul>
<h2>7.2</h2>
<ul>
<li>DRY the command definitions into a single <code>makeCommand</code>
method,
and update the type signatures to more appropriately infer the
return type from the options and arguments provided.</li>
</ul>
<h2>7.1</h2>
<ul>
<li>Update minipass to v7.1.0</li>
<li>Update the type definitions of <code>write()</code> and
<code>end()</code> methods on
<code>Unpack</code> and <code>Parser</code> classes to be compatible
with the
NodeJS.WritableStream type in the latest versions of
<code>@types/node</code>.</li>
</ul>
<h2>7.0</h2>
<ul>
<li>Drop support for node &lt;18</li>
<li>Rewrite in TypeScript, provide ESM and CommonJS hybrid
interface</li>
<li>Add tree-shake friendly exports, like
<code>import('tar/create')</code>
and <code>import('tar/read-entry')</code> to get individual functions or
classes.</li>
<li>Add <code>chmod</code> option that defaults to false, and deprecate
<code>noChmod</code>. That is, reverse the default option regarding
explicitly setting file system modes to match tar entry
settings.</li>
<li>Add <code>processUmask</code> option to avoid having to call
<code>process.umask()</code> when <code>chmod: true</code> (or
<code>noChmod: false</code>) is
set.</li>
</ul>
<!-- raw HTML omitted -->
</blockquote>
<p>... (truncated)</p>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/isaacs/node-tar/commit/bf776f673164215074b62749e0fe80e5834588f4"><code>bf776f6</code></a>
7.5.11</li>
<li><a
href="https://github.com/isaacs/node-tar/commit/f48b5fa3b7985ddab96dc0f2125a4ffc9911b6ad"><code>f48b5fa</code></a>
prevent escaping symlinks with drive-relative paths</li>
<li><a
href="https://github.com/isaacs/node-tar/commit/97cff15d3539a37a4095eb3d287147d9d77c2dc3"><code>97cff15</code></a>
docs: more security info</li>
<li><a
href="https://github.com/isaacs/node-tar/commit/2b72abc1d47c3570e1ad95c9ab557fc4c2e6e4b1"><code>2b72abc</code></a>
7.5.10</li>
<li><a
href="https://github.com/isaacs/node-tar/commit/7bc755dd85e623c0279e08eb3784909e6d7e4b9f"><code>7bc755d</code></a>
parse root off paths before sanitizing .. parts</li>
<li><a
href="https://github.com/isaacs/node-tar/commit/c8cb84629dee649feedde03f2f4ea48f2e44e778"><code>c8cb846</code></a>
update deps</li>
<li><a
href="https://github.com/isaacs/node-tar/commit/1f0c2c9006b10199cf2686f8ef43e79a1773e1aa"><code>1f0c2c9</code></a>
7.5.9</li>
<li><a
href="https://github.com/isaacs/node-tar/commit/fbb08518bf290733b68ca4d4135f75becf73fd75"><code>fbb0851</code></a>
build minified version as default export</li>
<li><a
href="https://github.com/isaacs/node-tar/commit/6b8eba0ef367ac937e703238daa6df94ae6f823f"><code>6b8eba0</code></a>
7.5.8</li>
<li><a
href="https://github.com/isaacs/node-tar/commit/2cb1120bcefe28d7ecc719b41441ade59c52e384"><code>2cb1120</code></a>
fix(unpack): improve UnpackSync symlink error &quot;into&quot; path
accuracy</li>
<li>Additional commits viewable in <a
href="https://github.com/isaacs/node-tar/compare/v7.4.3...v7.5.11">compare
view</a></li>
</ul>
</details>
<details>
<summary>Maintainer changes</summary>
<p>This version was pushed to npm by <a
href="https://www.npmjs.com/~isaacs">isaacs</a>, a new releaser for tar
since your current version.</p>
</details>
<details>
<summary>Install script changes</summary>
<p>This version adds <code>prepare</code> script that runs during
installation. Review the package contents before updating.</p>
</details>
<br />


[![Dependabot compatibility
score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=tar&package-manager=npm_and_yarn&previous-version=7.4.3&new-version=7.5.11)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)

Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.

[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)

---

<details>
<summary>Dependabot commands and options</summary>
<br />

You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot show <dependency name> ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore this major version` will close this PR and stop
Dependabot creating any more for this major version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this minor version` will close this PR and stop
Dependabot creating any more for this minor version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this dependency` will close this PR and stop
Dependabot creating any more for this dependency (unless you reopen the
PR or upgrade to it yourself)
You can disable automated security fix PRs for this repo from the
[Security Alerts
page](https://github.com/actions/create-github-app-token/network/alerts).

</details>

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
 2026-03-12 23:03:34 -07:00
dependabot[bot] 340567cb0e build(deps-dev): bump the development-dependencies group across 1 directory with 5 updates (#334) 
Bumps the development-dependencies group with 5 updates in the /
directory:

| Package | From | To |
| --- | --- | --- |
| [@sinonjs/fake-timers](https://github.com/sinonjs/fake-timers) |
`15.0.0` | `15.1.0` |
| [dotenv](https://github.com/motdotla/dotenv) | `17.2.3` | `17.3.1` |
| [esbuild](https://github.com/evanw/esbuild) | `0.25.10` | `0.27.3` |
| [execa](https://github.com/sindresorhus/execa) | `9.6.0` | `9.6.1` |
| [yaml](https://github.com/eemeli/yaml) | `2.8.1` | `2.8.2` |


Updates `@sinonjs/fake-timers` from 15.0.0 to 15.1.0
<details>
<summary>Changelog</summary>
<p><em>Sourced from <a
href="https://github.com/sinonjs/fake-timers/blob/main/CHANGELOG.md"><code>@​sinonjs/fake-timers</code>'s
changelog</a>.</em></p>
<blockquote>
<h1>15.1.0 / 2025-12-18</h1>
<ul>
<li>Include stacktrace clear native timers warning (<a
href="https://redirect.github.com/sinonjs/fake-timers/issues/529">#529</a>)</li>
<li>docs: Update <code>setTickMode</code> docs to mention sinon APIs,
not jest (<a
href="https://redirect.github.com/sinonjs/fake-timers/issues/527">#527</a>)</li>
</ul>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/sinonjs/fake-timers/commit/307815db063b5001f946488292c0093a991c3062"><code>307815d</code></a>
15.1.0</li>
<li><a
href="https://github.com/sinonjs/fake-timers/commit/d4d0eed1c9432f07f2b4a0dcbba58b388e1fc8c6"><code>d4d0eed</code></a>
Updated release files for 15.1.0</li>
<li><a
href="https://github.com/sinonjs/fake-timers/commit/88145ac11337176d19aadf9dbe0d7a4cd6410abb"><code>88145ac</code></a>
Commit lock file</li>
<li><a
href="https://github.com/sinonjs/fake-timers/commit/4296cb900cd7ea54cff9fec2d346ba73a4be0f60"><code>4296cb9</code></a>
Update all</li>
<li><a
href="https://github.com/sinonjs/fake-timers/commit/c623931fa954dbcb564e65b32a463ea0b2224aff"><code>c623931</code></a>
adjustment: only do check on V8 engines</li>
<li><a
href="https://github.com/sinonjs/fake-timers/commit/d1983d2842886bb01486984b8611082710eb97d6"><code>d1983d2</code></a>
Include stacktrace clear native timers warning (<a
href="https://redirect.github.com/sinonjs/fake-timers/issues/529">#529</a>)</li>
<li><a
href="https://github.com/sinonjs/fake-timers/commit/73f52d814aa35e3e702757ca555f7ddaa12e7f53"><code>73f52d8</code></a>
docs: Update <code>setTickMode</code> docs to mention sinon APIs, not
jest (<a
href="https://redirect.github.com/sinonjs/fake-timers/issues/527">#527</a>)</li>
<li>See full diff in <a
href="https://github.com/sinonjs/fake-timers/compare/v15.0.0...v15.1.0">compare
view</a></li>
</ul>
</details>
<br />

Updates `dotenv` from 17.2.3 to 17.3.1
<details>
<summary>Changelog</summary>
<p><em>Sourced from <a
href="https://github.com/motdotla/dotenv/blob/master/CHANGELOG.md">dotenv's
changelog</a>.</em></p>
<blockquote>
<h2><a
href="https://github.com/motdotla/dotenv/compare/v17.3.0...v17.3.1">17.3.1</a>
(2026-02-12)</h2>
<h3>Changed</h3>
<ul>
<li>Fix as2 example command in README and update spanish README</li>
</ul>
<h2><a
href="https://github.com/motdotla/dotenv/compare/v17.2.4...v17.3.0">17.3.0</a>
(2026-02-12)</h2>
<h3>Added</h3>
<ul>
<li>Add a new README section on dotenv’s approach to the agentic
future.</li>
</ul>
<h3>Changed</h3>
<ul>
<li>Rewrite README to get humans started more quickly with less noise
while simultaneously making more accessible for llms and agents to go
deeper into details.</li>
</ul>
<h2><a
href="https://github.com/motdotla/dotenv/compare/v17.2.3...v17.2.4">17.2.4</a>
(2026-02-05)</h2>
<h3>Changed</h3>
<ul>
<li>Make <code>DotenvPopulateInput</code> accept
<code>NodeJS.ProcessEnv</code> type (<a
href="https://redirect.github.com/motdotla/dotenv/pull/915">#915</a>)</li>
</ul>
<ul>
<li>Give back to dotenv by checking out my newest project <a
href="https://github.com/vestauth/vestauth">vestauth</a>. It is auth for
agents. Thank you for using my software.</li>
</ul>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/motdotla/dotenv/commit/7bc16a41c9efd4cf4ab8a4614d0ace7fd240b27b"><code>7bc16a4</code></a>
17.3.1</li>
<li><a
href="https://github.com/motdotla/dotenv/commit/27303fd56321a166d698f0482e0f4d0c51e51c1e"><code>27303fd</code></a>
update README-es</li>
<li><a
href="https://github.com/motdotla/dotenv/commit/6379eb2cae43c27656df8d93509b2c14366811ec"><code>6379eb2</code></a>
update README</li>
<li><a
href="https://github.com/motdotla/dotenv/commit/b6d7339fd085a290669af8e601331c13b4dd2920"><code>b6d7339</code></a>
fix spelling</li>
<li><a
href="https://github.com/motdotla/dotenv/commit/5febe352d4dd499bfaa73de808a56bf03a268b6b"><code>5febe35</code></a>
17.3.0</li>
<li><a
href="https://github.com/motdotla/dotenv/commit/f61f3832c438078fc5d6552f59fac0c0205eca98"><code>f61f383</code></a>
changelog 🪵</li>
<li><a
href="https://github.com/motdotla/dotenv/commit/dec94ad828acba99e3a8570ecf12a1081f9c189c"><code>dec94ad</code></a>
update README</li>
<li><a
href="https://github.com/motdotla/dotenv/commit/485695052c82c26024fbb8568babb0770756dd06"><code>4856950</code></a>
update README</li>
<li><a
href="https://github.com/motdotla/dotenv/commit/6351887077957c5ee74c3528bccbf5512b184b2e"><code>6351887</code></a>
update README</li>
<li><a
href="https://github.com/motdotla/dotenv/commit/23bd017381f1ab5e4fcdeaebe2e134aaef644a4c"><code>23bd017</code></a>
update README</li>
<li>Additional commits viewable in <a
href="https://github.com/motdotla/dotenv/compare/v17.2.3...v17.3.1">compare
view</a></li>
</ul>
</details>
<br />

Updates `esbuild` from 0.25.10 to 0.27.3
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/evanw/esbuild/releases">esbuild's
releases</a>.</em></p>
<blockquote>
<h2>v0.27.3</h2>
<ul>
<li>
<p>Preserve URL fragments in data URLs (<a
href="https://redirect.github.com/evanw/esbuild/issues/4370">#4370</a>)</p>
<p>Consider the following HTML, CSS, and SVG:</p>
<ul>
<li>
<p><code>index.html</code>:</p>
<pre lang="html"><code>&lt;!DOCTYPE html&gt;
&lt;html&gt;
&lt;head&gt;&lt;link rel=&quot;stylesheet&quot;
href=&quot;icons.css&quot;&gt;&lt;/head&gt;
&lt;body&gt;&lt;div
class=&quot;triangle&quot;&gt;&lt;/div&gt;&lt;/body&gt;
&lt;/html&gt;
</code></pre>
</li>
<li>
<p><code>icons.css</code>:</p>
<pre lang="css"><code>.triangle {
  width: 10px;
  height: 10px;
  background: currentColor;
  clip-path: url(./triangle.svg#x);
}
</code></pre>
</li>
<li>
<p><code>triangle.svg</code>:</p>
<pre lang="xml"><code>&lt;svg
xmlns=&quot;http://www.w3.org/2000/svg&quot;&gt;
  &lt;defs&gt;
    &lt;clipPath id=&quot;x&quot;&gt;
      &lt;path d=&quot;M0 0H10V10Z&quot;/&gt;
    &lt;/clipPath&gt;
  &lt;/defs&gt;
&lt;/svg&gt;
</code></pre>
</li>
</ul>
<p>The CSS uses a URL fragment (the <code>#x</code>) to reference the
<code>clipPath</code> element in the SVG file. Previously esbuild's CSS
bundler didn't preserve the URL fragment when bundling the SVG using the
<code>dataurl</code> loader, which broke the bundled CSS. With this
release, esbuild will now preserve the URL fragment in the bundled
CSS:</p>
<pre lang="css"><code>/* icons.css */
.triangle {
  width: 10px;
  height: 10px;
  background: currentColor;
clip-path: url('data:image/svg+xml,&lt;svg
xmlns=&quot;http://www.w3.org/2000/svg&quot;&gt;&lt;defs&gt;&lt;clipPath
id=&quot;x&quot;&gt;&lt;path d=&quot;M0
0H10V10Z&quot;/&gt;&lt;/clipPath&gt;&lt;/defs&gt;&lt;/svg&gt;#x');
}
</code></pre>
</li>
</ul>
<!-- raw HTML omitted -->
</blockquote>
<p>... (truncated)</p>
</details>
<details>
<summary>Changelog</summary>
<p><em>Sourced from <a
href="https://github.com/evanw/esbuild/blob/main/CHANGELOG.md">esbuild's
changelog</a>.</em></p>
<blockquote>
<h2>0.27.3</h2>
<ul>
<li>
<p>Preserve URL fragments in data URLs (<a
href="https://redirect.github.com/evanw/esbuild/issues/4370">#4370</a>)</p>
<p>Consider the following HTML, CSS, and SVG:</p>
<ul>
<li>
<p><code>index.html</code>:</p>
<pre lang="html"><code>&lt;!DOCTYPE html&gt;
&lt;html&gt;
&lt;head&gt;&lt;link rel=&quot;stylesheet&quot;
href=&quot;icons.css&quot;&gt;&lt;/head&gt;
&lt;body&gt;&lt;div
class=&quot;triangle&quot;&gt;&lt;/div&gt;&lt;/body&gt;
&lt;/html&gt;
</code></pre>
</li>
<li>
<p><code>icons.css</code>:</p>
<pre lang="css"><code>.triangle {
  width: 10px;
  height: 10px;
  background: currentColor;
  clip-path: url(./triangle.svg#x);
}
</code></pre>
</li>
<li>
<p><code>triangle.svg</code>:</p>
<pre lang="xml"><code>&lt;svg
xmlns=&quot;http://www.w3.org/2000/svg&quot;&gt;
  &lt;defs&gt;
    &lt;clipPath id=&quot;x&quot;&gt;
      &lt;path d=&quot;M0 0H10V10Z&quot;/&gt;
    &lt;/clipPath&gt;
  &lt;/defs&gt;
&lt;/svg&gt;
</code></pre>
</li>
</ul>
<p>The CSS uses a URL fragment (the <code>#x</code>) to reference the
<code>clipPath</code> element in the SVG file. Previously esbuild's CSS
bundler didn't preserve the URL fragment when bundling the SVG using the
<code>dataurl</code> loader, which broke the bundled CSS. With this
release, esbuild will now preserve the URL fragment in the bundled
CSS:</p>
<pre lang="css"><code>/* icons.css */
.triangle {
  width: 10px;
  height: 10px;
  background: currentColor;
clip-path: url('data:image/svg+xml,&lt;svg
xmlns=&quot;http://www.w3.org/2000/svg&quot;&gt;&lt;defs&gt;&lt;clipPath
id=&quot;x&quot;&gt;&lt;path d=&quot;M0
0H10V10Z&quot;/&gt;&lt;/clipPath&gt;&lt;/defs&gt;&lt;/svg&gt;#x');
}
</code></pre>
</li>
</ul>
<!-- raw HTML omitted -->
</blockquote>
<p>... (truncated)</p>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/evanw/esbuild/commit/9129e00e6c36a3e374820cb5e3fc2cd319c8ab85"><code>9129e00</code></a>
publish 0.27.3 to npm</li>
<li><a
href="https://github.com/evanw/esbuild/commit/e20e4115acda9c9f052fdd1ec8d7d5c5489e837b"><code>e20e411</code></a>
small fix to release notes</li>
<li><a
href="https://github.com/evanw/esbuild/commit/0dc0f2dee556460bd7b81d5bbbae5a2f86449ab6"><code>0dc0f2d</code></a>
fix <a
href="https://redirect.github.com/evanw/esbuild/issues/4322">#4322</a>:
parse and print CSS <code>@scope</code> rules</li>
<li><a
href="https://github.com/evanw/esbuild/commit/55fe39164cd3429fcb92c6f358a8dfe2f6e6e559"><code>55fe391</code></a>
update firefox css gradient support</li>
<li><a
href="https://github.com/evanw/esbuild/commit/2c35297c7ad249a51b9cc3974fa91f74dc13f68c"><code>2c35297</code></a>
update gradient lowering transform</li>
<li><a
href="https://github.com/evanw/esbuild/commit/9209e4445abe7610018f0f758fd5d1fa13ec3ea8"><code>9209e44</code></a>
Update Go to 1.25.7 (<a
href="https://redirect.github.com/evanw/esbuild/issues/4388">#4388</a>)</li>
<li><a
href="https://github.com/evanw/esbuild/commit/e8d861b68cf8c3c3a4806ec87444ee48b9af1ade"><code>e8d861b</code></a>
close <a
href="https://redirect.github.com/evanw/esbuild/issues/4374">#4374</a>:
compat table for the <code>using</code> feature</li>
<li><a
href="https://github.com/evanw/esbuild/commit/19b8887368396934957abd75f316cc069d6cc067"><code>19b8887</code></a>
no longer need <code>williamkapke/node-compat-table</code></li>
<li><a
href="https://github.com/evanw/esbuild/commit/7e442189722b54bc6c574ae1148e1014d99e5f32"><code>7e44218</code></a>
the <code>kangax/compat-table</code> repo moved to a new url</li>
<li><a
href="https://github.com/evanw/esbuild/commit/23b9338ed5efbdfa29d59b8b0d8088b1761fdc39"><code>23b9338</code></a>
run <code>make update-compat-table</code></li>
<li>Additional commits viewable in <a
href="https://github.com/evanw/esbuild/compare/v0.25.10...v0.27.3">compare
view</a></li>
</ul>
</details>
<details>
<summary>Maintainer changes</summary>
<p>This version was pushed to npm by [GitHub Actions](<a
href="https://www.npmjs.com/~GitHub">https://www.npmjs.com/~GitHub</a>
Actions), a new releaser for esbuild since your current version.</p>
</details>
<br />

Updates `execa` from 9.6.0 to 9.6.1
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/sindresorhus/execa/releases">execa's
releases</a>.</em></p>
<blockquote>
<h2>v9.6.1</h2>
<ul>
<li>Fix <code>VerboseOption</code> type not being properly exported (<a
href="https://redirect.github.com/sindresorhus/execa/issues/1215">#1215</a>)
7891c39</li>
</ul>
<hr />
<p><a
href="https://github.com/sindresorhus/execa/compare/v9.6.0...v9.6.1">https://github.com/sindresorhus/execa/compare/v9.6.0...v9.6.1</a></p>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/sindresorhus/execa/commit/84e1f36b2c31a463e3efbd37c7505da9438a05c9"><code>84e1f36</code></a>
9.6.1</li>
<li><a
href="https://github.com/sindresorhus/execa/commit/7891c39441c5a6d0fca4be696c0c1cf0b746fa1e"><code>7891c39</code></a>
Fix <code>VerboseOption</code> type not being properly exported (<a
href="https://redirect.github.com/sindresorhus/execa/issues/1215">#1215</a>)</li>
<li><a
href="https://github.com/sindresorhus/execa/commit/103095f2c9a459ae3500fa7d861f162c21a94b3a"><code>103095f</code></a>
Meta tweaks</li>
<li><a
href="https://github.com/sindresorhus/execa/commit/23ec6f0569b3e42af43294dc807494ebe896e980"><code>23ec6f0</code></a>
Fix CI tests related to <code>.kill(0)</code> (<a
href="https://redirect.github.com/sindresorhus/execa/issues/1212">#1212</a>)</li>
<li><a
href="https://github.com/sindresorhus/execa/commit/9a2cb79b1120f3b476aa8a452ceaeb71bfa19a2d"><code>9a2cb79</code></a>
Meta tweaks</li>
<li><a
href="https://github.com/sindresorhus/execa/commit/e7cafebf55e19485a9d4bdf5af9ed5d2c82fe0d8"><code>e7cafeb</code></a>
[docs] TTY control is lost only on the FD that uses mixed inherit. (<a
href="https://redirect.github.com/sindresorhus/execa/issues/1209">#1209</a>)</li>
<li><a
href="https://github.com/sindresorhus/execa/commit/5587ae1dcb9b258b0d9667219100b197de50594f"><code>5587ae1</code></a>
Fix CI tests (<a
href="https://redirect.github.com/sindresorhus/execa/issues/1207">#1207</a>)</li>
<li><a
href="https://github.com/sindresorhus/execa/commit/3e8fa32d498dcc57f1da447524bdb6b521fbd603"><code>3e8fa32</code></a>
[docs] A process is not a TTY usually, just connected to one. (<a
href="https://redirect.github.com/sindresorhus/execa/issues/1208">#1208</a>)</li>
<li><a
href="https://github.com/sindresorhus/execa/commit/c468672a7f212e9040c4405e99f9428d3253a76a"><code>c468672</code></a>
[docs] Transforms: Summary: Fix example command and output. (<a
href="https://redirect.github.com/sindresorhus/execa/issues/1206">#1206</a>)</li>
<li>See full diff in <a
href="https://github.com/sindresorhus/execa/compare/v9.6.0...v9.6.1">compare
view</a></li>
</ul>
</details>
<br />

Updates `yaml` from 2.8.1 to 2.8.2
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/eemeli/yaml/releases">yaml's
releases</a>.</em></p>
<blockquote>
<h2>v2.8.2</h2>
<ul>
<li>Serialize -0 as -0 (<a
href="https://redirect.github.com/eemeli/yaml/issues/638">#638</a>)</li>
<li>Do not double newlines for empty map values (<a
href="https://redirect.github.com/eemeli/yaml/issues/642">#642</a>)</li>
</ul>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/eemeli/yaml/commit/086fa6b5bae325da18734750cddee231ce578930"><code>086fa6b</code></a>
2.8.2</li>
<li><a
href="https://github.com/eemeli/yaml/commit/95f01e98032ddf199b42bb3ba0737303b35ef752"><code>95f01e9</code></a>
chore: Add funding to package.json</li>
<li><a
href="https://github.com/eemeli/yaml/commit/152e204a9255064cc0af4f70b7fa0ac25e324a42"><code>152e204</code></a>
style: Apply updated Prettier rules &amp; satisfy updated ESLint</li>
<li><a
href="https://github.com/eemeli/yaml/commit/3f3378c3bff1663a41f413dbf3c65b9bbb292db7"><code>3f3378c</code></a>
chore: Drop unused dependency cross-env</li>
<li><a
href="https://github.com/eemeli/yaml/commit/f0b9af7b6fba48e0fe4b4a85a64cb3339e5dd7aa"><code>f0b9af7</code></a>
chore: Update to <code>@​rollup/plugin-replace</code> v6</li>
<li><a
href="https://github.com/eemeli/yaml/commit/e3cafc70ca0dfac449f25cfa60a426f68c23e061"><code>e3cafc7</code></a>
chore: Update to eslint-config-prettier v10</li>
<li><a
href="https://github.com/eemeli/yaml/commit/553c1b56f1f3a6b23b6f0358322dfbacfc3e80cb"><code>553c1b5</code></a>
chore: Refresh lockfile</li>
<li><a
href="https://github.com/eemeli/yaml/commit/70a8db37c3bd8d6db6e8dddd4a1e9e6fc5a9a3b0"><code>70a8db3</code></a>
fix: Do not double newlines for empty map values (<a
href="https://redirect.github.com/eemeli/yaml/issues/642">#642</a>)</li>
<li><a
href="https://github.com/eemeli/yaml/commit/92821f2b8164f9831ff5a51f6e5a575e06365742"><code>92821f2</code></a>
ci: Limit action permissions to minimum required</li>
<li><a
href="https://github.com/eemeli/yaml/commit/95285f82a888781d4ff010b26f9beb6d13778422"><code>95285f8</code></a>
fix: Serialize -0 as -0 (fixes <a
href="https://redirect.github.com/eemeli/yaml/issues/638">#638</a>)</li>
<li>Additional commits viewable in <a
href="https://github.com/eemeli/yaml/compare/v2.8.1...v2.8.2">compare
view</a></li>
</ul>
</details>
<br />


Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.

[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)

---

<details>
<summary>Dependabot commands and options</summary>
<br />

You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot show <dependency name> ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore <dependency name> major version` will close this
group update PR and stop Dependabot creating any more for the specific
dependency's major version (unless you unignore this specific
dependency's major version or upgrade to it yourself)
- `@dependabot ignore <dependency name> minor version` will close this
group update PR and stop Dependabot creating any more for the specific
dependency's minor version (unless you unignore this specific
dependency's minor version or upgrade to it yourself)
- `@dependabot ignore <dependency name>` will close this group update PR
and stop Dependabot creating any more for the specific dependency
(unless you unignore this specific dependency or upgrade to it yourself)
- `@dependabot unignore <dependency name>` will remove all of the ignore
conditions of the specified dependency
- `@dependabot unignore <dependency name> <ignore condition>` will
remove the ignore condition of the specified dependency and ignore
conditions


</details>

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
 2026-03-12 23:03:00 -07:00
dependabot[bot] 5c1e00d1af build(deps-dev): bump lodash from 4.17.21 to 4.17.23 (#327) 
Bumps [lodash](https://github.com/lodash/lodash) from 4.17.21 to
4.17.23.
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/lodash/lodash/commit/dec55b7a3b382da075e2eac90089b4cd00a26cbb"><code>dec55b7</code></a>
Bump main to v4.17.23 (<a
href="https://redirect.github.com/lodash/lodash/issues/6088">#6088</a>)</li>
<li><a
href="https://github.com/lodash/lodash/commit/19c9251b3631d7cf220b43bc757eb33f1084f117"><code>19c9251</code></a>
fix: setCacheHas JSDoc return type should be boolean (<a
href="https://redirect.github.com/lodash/lodash/issues/6071">#6071</a>)</li>
<li><a
href="https://github.com/lodash/lodash/commit/b5e672995ae26929d111a6e94589f8d03fb8e578"><code>b5e6729</code></a>
jsdoc: Add -0 and BigInt zeros to _.compact falsey values list (<a
href="https://redirect.github.com/lodash/lodash/issues/6062">#6062</a>)</li>
<li><a
href="https://github.com/lodash/lodash/commit/edadd452146f7e4bad4ea684e955708931d84d81"><code>edadd45</code></a>
Prevent prototype pollution on baseUnset function</li>
<li><a
href="https://github.com/lodash/lodash/commit/4879a7a7d0a4494b0e83c7fa21bcc9fc6e7f1a6d"><code>4879a7a</code></a>
doc: fix autoLink function, conversion of source links (<a
href="https://redirect.github.com/lodash/lodash/issues/6056">#6056</a>)</li>
<li><a
href="https://github.com/lodash/lodash/commit/9648f692b0fc7c2f6a7a763d754377200126c2e8"><code>9648f69</code></a>
chore: remove <code>yarn.lock</code> file (<a
href="https://redirect.github.com/lodash/lodash/issues/6053">#6053</a>)</li>
<li><a
href="https://github.com/lodash/lodash/commit/dfa407db0bf5b200f2c7a9e4f06830ceaf074be9"><code>dfa407d</code></a>
ci: remove legacy configuration files (<a
href="https://redirect.github.com/lodash/lodash/issues/6052">#6052</a>)</li>
<li><a
href="https://github.com/lodash/lodash/commit/156e1965ae78b121a88f81178ab81632304e8d64"><code>156e196</code></a>
feat: add renovate setup (<a
href="https://redirect.github.com/lodash/lodash/issues/6039">#6039</a>)</li>
<li><a
href="https://github.com/lodash/lodash/commit/933e1061b8c344d3fc742cdc400175d5ffc99bce"><code>933e106</code></a>
ci: add pipeline for Bun (<a
href="https://redirect.github.com/lodash/lodash/issues/6023">#6023</a>)</li>
<li><a
href="https://github.com/lodash/lodash/commit/072a807ff7ad8ffc7c1d2c3097266e815d138e20"><code>072a807</code></a>
docs: update links related to Open JS Foundation (<a
href="https://redirect.github.com/lodash/lodash/issues/5968">#5968</a>)</li>
<li>Additional commits viewable in <a
href="https://github.com/lodash/lodash/compare/4.17.21...4.17.23">compare
view</a></li>
</ul>
</details>
<br />


[![Dependabot compatibility
score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=lodash&package-manager=npm_and_yarn&previous-version=4.17.21&new-version=4.17.23)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)

You can trigger a rebase of this PR by commenting `@dependabot rebase`.

[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)

---

<details>
<summary>Dependabot commands and options</summary>
<br />

You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot merge` will merge this PR after your CI passes on it
- `@dependabot squash and merge` will squash and merge this PR after
your CI passes on it
- `@dependabot cancel merge` will cancel a previously requested merge
and block automerging
- `@dependabot reopen` will reopen this PR if it is closed
- `@dependabot close` will close this PR and stop Dependabot recreating
it. You can achieve the same result by closing it manually
- `@dependabot show <dependency name> ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore this major version` will close this PR and stop
Dependabot creating any more for this major version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this minor version` will close this PR and stop
Dependabot creating any more for this minor version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this dependency` will close this PR and stop
Dependabot creating any more for this dependency (unless you reopen the
PR or upgrade to it yourself)
You can disable automated security fix PRs for this repo from the
[Security Alerts
page](https://github.com/actions/create-github-app-token/network/alerts).

</details>

> **Note**
> Automatic rebases have been disabled on this pull request as it has
been open for over 30 days.

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
 2026-03-12 23:01:31 -07:00
dependabot[bot] 64cd9c9a45 build(deps): bump stefanzweifel/git-auto-commit-action from 6.0.1 to 7.1.0 (#317) 
Bumps
[stefanzweifel/git-auto-commit-action](https://github.com/stefanzweifel/git-auto-commit-action)
from 6.0.1 to 7.1.0.
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/stefanzweifel/git-auto-commit-action/releases">stefanzweifel/git-auto-commit-action's
releases</a>.</em></p>
<blockquote>
<h2>v7.1.0</h2>
<h2>Added</h2>
<ul>
<li>Add skip_push input option (<a
href="https://redirect.github.com/stefanzweifel/git-auto-commit-action/pull/401">#401</a>)
<a
href="https://github.com/@kvanzuijlen"><code>@​kvanzuijlen</code></a></li>
</ul>
<h2>Changes</h2>
<ul>
<li>docs: fix typo in README.md (<a
href="https://redirect.github.com/stefanzweifel/git-auto-commit-action/pull/400">#400</a>)
<a
href="https://github.com/@GideonBear"><code>@​GideonBear</code></a></li>
</ul>
<h2>Dependency Updates</h2>
<ul>
<li>Bump actions/checkout from 5 to 6 (<a
href="https://redirect.github.com/stefanzweifel/git-auto-commit-action/pull/399">#399</a>)
[@<a href="https://github.com/apps/dependabot">dependabot[bot]</a>](<a
href="https://github.com/@%5Bdependabot%5Bbot%5D%5D(https://github.com/apps/dependabot)">https://github.com/@[dependabot[bot]](https://github.com/apps/dependabot)</a>)</li>
<li>Bump bats from 1.12.0 to 1.13.0 (<a
href="https://redirect.github.com/stefanzweifel/git-auto-commit-action/pull/398">#398</a>)
[@<a href="https://github.com/apps/dependabot">dependabot[bot]</a>](<a
href="https://github.com/@%5Bdependabot%5Bbot%5D%5D(https://github.com/apps/dependabot)">https://github.com/@[dependabot[bot]](https://github.com/apps/dependabot)</a>)</li>
</ul>
<h2>v7.0.0</h2>
<h2>Added</h2>
<ul>
<li>Restore skip_fetch, skip_checkout, create_branch (<a
href="https://redirect.github.com/stefanzweifel/git-auto-commit-action/pull/388">#388</a>)
<a
href="https://github.com/@stefanzweifel"><code>@​stefanzweifel</code></a></li>
<li>Restore Detached State Detection (<a
href="https://redirect.github.com/stefanzweifel/git-auto-commit-action/pull/393">#393</a>)
<a
href="https://github.com/@stefanzweifel"><code>@​stefanzweifel</code></a></li>
<li>Add Support for Tag Messages (<a
href="https://redirect.github.com/stefanzweifel/git-auto-commit-action/pull/391">#391</a>)
<a
href="https://github.com/@EliasBoulharts"><code>@​EliasBoulharts</code></a></li>
</ul>
<h2>Changed</h2>
<ul>
<li>Run Action on Node 24 (<a
href="https://redirect.github.com/stefanzweifel/git-auto-commit-action/pull/389">#389</a>)
<a
href="https://github.com/@stefanzweifel"><code>@​stefanzweifel</code></a></li>
</ul>
<h2>Dependency Updates</h2>
<ul>
<li>Bump actions/checkout from 4 to 5 (<a
href="https://redirect.github.com/stefanzweifel/git-auto-commit-action/pull/386">#386</a>)
[@<a href="https://github.com/apps/dependabot">dependabot[bot]</a>](<a
href="https://github.com/@%5Bdependabot%5Bbot%5D%5D(https://github.com/apps/dependabot)">https://github.com/@[dependabot[bot]](https://github.com/apps/dependabot)</a>)</li>
</ul>
</blockquote>
</details>
<details>
<summary>Changelog</summary>
<p><em>Sourced from <a
href="https://github.com/stefanzweifel/git-auto-commit-action/blob/master/CHANGELOG.md">stefanzweifel/git-auto-commit-action's
changelog</a>.</em></p>
<blockquote>
<h1>Changelog</h1>
<p>All notable changes to this project will be documented in this
file.</p>
<p>The format is based on <a
href="http://keepachangelog.com/en/1.0.0/">Keep a Changelog</a>
and this project adheres to <a
href="http://semver.org/spec/v2.0.0.html">Semantic Versioning</a>.</p>
<h2><a
href="https://github.com/stefanzweifel/git-auto-commit-action/compare/v7.1.0...HEAD">Unreleased</a></h2>
<blockquote>
<p>TBD</p>
</blockquote>
<h2><a
href="https://github.com/stefanzweifel/git-auto-commit-action/compare/v7.0.0...v7.1.0">v7.1.0</a>
- 2025-12-17</h2>
<h3>Added</h3>
<ul>
<li>Add skip_push input option (<a
href="https://redirect.github.com/stefanzweifel/git-auto-commit-action/pull/401">#401</a>)
<a
href="https://github.com/@kvanzuijlen"><code>@​kvanzuijlen</code></a></li>
</ul>
<h3>Changes</h3>
<ul>
<li>docs: fix typo in README.md (<a
href="https://redirect.github.com/stefanzweifel/git-auto-commit-action/pull/400">#400</a>)
<a
href="https://github.com/@GideonBear"><code>@​GideonBear</code></a></li>
</ul>
<h3>Dependency Updates</h3>
<ul>
<li>Bump actions/checkout from 5 to 6 (<a
href="https://redirect.github.com/stefanzweifel/git-auto-commit-action/pull/399">#399</a>)
[@<a href="https://github.com/apps/dependabot">dependabot[bot]</a>](<a
href="https://github.com/@%5Bdependabot%5Bbot%5D%5D(https://github.com/apps/dependabot)">https://github.com/@[dependabot[bot]](https://github.com/apps/dependabot)</a>)</li>
<li>Bump bats from 1.12.0 to 1.13.0 (<a
href="https://redirect.github.com/stefanzweifel/git-auto-commit-action/pull/398">#398</a>)
[@<a href="https://github.com/apps/dependabot">dependabot[bot]</a>](<a
href="https://github.com/@%5Bdependabot%5Bbot%5D%5D(https://github.com/apps/dependabot)">https://github.com/@[dependabot[bot]](https://github.com/apps/dependabot)</a>)</li>
</ul>
<h2><a
href="https://github.com/stefanzweifel/git-auto-commit-action/compare/v6.0.1...v7.0.0">v7.0.0</a>
- 2025-10-12</h2>
<h3>Added</h3>
<ul>
<li>Restore skip_fetch, skip_checkout, create_branch (<a
href="https://redirect.github.com/stefanzweifel/git-auto-commit-action/pull/388">#388</a>)
<a
href="https://github.com/@stefanzweifel"><code>@​stefanzweifel</code></a></li>
<li>Restore Detached State Detection (<a
href="https://redirect.github.com/stefanzweifel/git-auto-commit-action/pull/393">#393</a>)
<a
href="https://github.com/@stefanzweifel"><code>@​stefanzweifel</code></a></li>
<li>Add Support for Tag Messages (<a
href="https://redirect.github.com/stefanzweifel/git-auto-commit-action/pull/391">#391</a>)
<a
href="https://github.com/@EliasBoulharts"><code>@​EliasBoulharts</code></a></li>
</ul>
<h3>Changed</h3>
<ul>
<li>Run Action on Node 24 (<a
href="https://redirect.github.com/stefanzweifel/git-auto-commit-action/pull/389">#389</a>)
<a
href="https://github.com/@stefanzweifel"><code>@​stefanzweifel</code></a></li>
</ul>
<h3>Dependency Updates</h3>
<ul>
<li>Bump actions/checkout from 4 to 5 (<a
href="https://redirect.github.com/stefanzweifel/git-auto-commit-action/pull/386">#386</a>)
[@<a href="https://github.com/apps/dependabot">dependabot[bot]</a>](<a
href="https://github.com/@%5Bdependabot%5Bbot%5D%5D(https://github.com/apps/dependabot)">https://github.com/@[dependabot[bot]](https://github.com/apps/dependabot)</a>)</li>
</ul>
<h2><a
href="https://github.com/stefanzweifel/git-auto-commit-action/compare/v6.0.0...v6.0.1">v6.0.1</a>
- 2025-06-11</h2>
<h3>Fixed</h3>
<ul>
<li>Disable Check if Repo is in Detached State (<a
href="https://redirect.github.com/stefanzweifel/git-auto-commit-action/pull/379">#379</a>)
<a
href="https://github.com/@stefanzweifel"><code>@​stefanzweifel</code></a></li>
</ul>
<h2><a
href="https://github.com/stefanzweifel/git-auto-commit-action/compare/v5.2.0...v6.0.0">v6.0.0</a>
- 2025-06-10</h2>
<!-- raw HTML omitted -->
</blockquote>
<p>... (truncated)</p>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/stefanzweifel/git-auto-commit-action/commit/04702edda442b2e678b25b537cec683a1493fcb9"><code>04702ed</code></a>
Bump actions/checkout from 5 to 6 (<a
href="https://redirect.github.com/stefanzweifel/git-auto-commit-action/issues/399">#399</a>)</li>
<li><a
href="https://github.com/stefanzweifel/git-auto-commit-action/commit/1e49d5001fa4bb7d02711af41f4af23c58ef1de8"><code>1e49d50</code></a>
Add skip_push input option (<a
href="https://redirect.github.com/stefanzweifel/git-auto-commit-action/issues/401">#401</a>)</li>
<li><a
href="https://github.com/stefanzweifel/git-auto-commit-action/commit/65c56779c90b0324ac2a7e7c31ec876b8db47914"><code>65c5677</code></a>
docs: fix typo in README.md (<a
href="https://redirect.github.com/stefanzweifel/git-auto-commit-action/issues/400">#400</a>)</li>
<li><a
href="https://github.com/stefanzweifel/git-auto-commit-action/commit/547c1409cec143c754e148a6fbdfa359db836cf6"><code>547c140</code></a>
Bump bats from 1.12.0 to 1.13.0 (<a
href="https://redirect.github.com/stefanzweifel/git-auto-commit-action/issues/398">#398</a>)</li>
<li><a
href="https://github.com/stefanzweifel/git-auto-commit-action/commit/8fa7f5a3c51038deaa521c22ae89fac24baad8e7"><code>8fa7f5a</code></a>
Update CHANGELOG</li>
<li><a
href="https://github.com/stefanzweifel/git-auto-commit-action/commit/28e16e81777b558cc906c8750092100bbb34c5e3"><code>28e16e8</code></a>
Release preparations for v7 (<a
href="https://redirect.github.com/stefanzweifel/git-auto-commit-action/issues/394">#394</a>)</li>
<li><a
href="https://github.com/stefanzweifel/git-auto-commit-action/commit/698fd76863f4609be5d51f1d1fe685aa92f062e9"><code>698fd76</code></a>
Merge pull request <a
href="https://redirect.github.com/stefanzweifel/git-auto-commit-action/issues/391">#391</a>
from EliasBoulharts/custom-tag-message</li>
<li><a
href="https://github.com/stefanzweifel/git-auto-commit-action/commit/c40819ab3b7619623b7d0d760f3296f014f245b8"><code>c40819a</code></a>
Update README</li>
<li><a
href="https://github.com/stefanzweifel/git-auto-commit-action/commit/d7ee275235b337d03e77815bd319db607e2b455b"><code>d7ee275</code></a>
Change internal variable names</li>
<li><a
href="https://github.com/stefanzweifel/git-auto-commit-action/commit/e8684eb0cd3714a844cb825cd29a0afcf6d66dbc"><code>e8684eb</code></a>
Fix Tests</li>
<li>Additional commits viewable in <a
href="https://github.com/stefanzweifel/git-auto-commit-action/compare/778341af668090896ca464160c2def5d1d1a3eb0...04702edda442b2e678b25b537cec683a1493fcb9">compare
view</a></li>
</ul>
</details>
<br />


[![Dependabot compatibility
score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=stefanzweifel/git-auto-commit-action&package-manager=github_actions&previous-version=6.0.1&new-version=7.1.0)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)

Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.

[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)

---

<details>
<summary>Dependabot commands and options</summary>
<br />

You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot merge` will merge this PR after your CI passes on it
- `@dependabot squash and merge` will squash and merge this PR after
your CI passes on it
- `@dependabot cancel merge` will cancel a previously requested merge
and block automerging
- `@dependabot reopen` will reopen this PR if it is closed
- `@dependabot close` will close this PR and stop Dependabot recreating
it. You can achieve the same result by closing it manually
- `@dependabot show <dependency name> ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore this major version` will close this PR and stop
Dependabot creating any more for this major version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this minor version` will close this PR and stop
Dependabot creating any more for this minor version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this dependency` will close this PR and stop
Dependabot creating any more for this dependency (unless you reopen the
PR or upgrade to it yourself)


</details>

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
 2026-03-12 23:00:55 -07:00
semantic-release-bot 29824e69f5 build(release): 2.2.1 [skip ci] 
## [2.2.1](https://github.com/actions/create-github-app-token/compare/v2.2.0...v2.2.1) (2025-12-05)

### Bug Fixes

* **deps:** bump the production-dependencies group with 2 updates ([#311](https://github.com/actions/create-github-app-token/issues/311)) ([b212e6a](https://github.com/actions/create-github-app-token/commit/b212e6a739dec02d8488610fbaf8f049f82ee999))
v2.2.1 		2025-12-05 22:53:03 +00:00
dependabot[bot] b212e6a739 fix(deps): bump the production-dependencies group with 2 updates (#311) 
Bumps the production-dependencies group with 2 updates:
[@octokit/auth-app](https://github.com/octokit/auth-app.js) and
[@octokit/request](https://github.com/octokit/request.js).

Updates `@octokit/auth-app` from 8.1.1 to 8.1.2
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/octokit/auth-app.js/releases"><code>@​octokit/auth-app</code>'s
releases</a>.</em></p>
<blockquote>
<h2>v8.1.2</h2>
<h2><a
href="https://github.com/octokit/auth-app.js/compare/v8.1.1...v8.1.2">8.1.2</a>
(2025-10-31)</h2>
<h3>Bug Fixes</h3>
<ul>
<li><strong>deps:</strong> update dependency
<code>@​octokit/types</code> to v16 (<a
href="https://redirect.github.com/octokit/auth-app.js/issues/731">#731</a>)
(<a
href="https://github.com/octokit/auth-app.js/commit/016958a122fcd868c36f5c82200e5dfd14a90266">016958a</a>)</li>
</ul>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/octokit/auth-app.js/commit/016958a122fcd868c36f5c82200e5dfd14a90266"><code>016958a</code></a>
fix(deps): update dependency <code>@​octokit/types</code> to v16 (<a
href="https://redirect.github.com/octokit/auth-app.js/issues/731">#731</a>)</li>
<li><a
href="https://github.com/octokit/auth-app.js/commit/6290a83e69d4b9912abe90e6a67108eb38e396df"><code>6290a83</code></a>
ci(action): update peter-evans/create-or-update-comment action to v5 (<a
href="https://redirect.github.com/octokit/auth-app.js/issues/723">#723</a>)</li>
<li><a
href="https://github.com/octokit/auth-app.js/commit/767ba94f5008c636b227cc429e8fad3fd9c81262"><code>767ba94</code></a>
ci(action): update actions/setup-node action to v6 (<a
href="https://redirect.github.com/octokit/auth-app.js/issues/727">#727</a>)</li>
<li><a
href="https://github.com/octokit/auth-app.js/commit/a6b03f2d5fd57f6d4dda580ce04ac39c5db2e95f"><code>a6b03f2</code></a>
ci(action): update github/codeql-action action to v4 (<a
href="https://redirect.github.com/octokit/auth-app.js/issues/726">#726</a>)</li>
<li><a
href="https://github.com/octokit/auth-app.js/commit/f6eb9c8e3403c385cc6a7494373b93eb5e1873c0"><code>f6eb9c8</code></a>
chore(deps): update dependency node to v24 (<a
href="https://redirect.github.com/octokit/auth-app.js/issues/730">#730</a>)</li>
<li><a
href="https://github.com/octokit/auth-app.js/commit/f50e21a0a071d4780e84bdf080396bde66268a74"><code>f50e21a</code></a>
ci(action): update actions/setup-node action to v5 (<a
href="https://redirect.github.com/octokit/auth-app.js/issues/718">#718</a>)</li>
<li><a
href="https://github.com/octokit/auth-app.js/commit/7f24cee3c5d05a614b89b87c84ccdd5d4aea37b1"><code>7f24cee</code></a>
build(deps): lock file maintenance (<a
href="https://redirect.github.com/octokit/auth-app.js/issues/719">#719</a>)</li>
<li>See full diff in <a
href="https://github.com/octokit/auth-app.js/compare/v8.1.1...v8.1.2">compare
view</a></li>
</ul>
</details>
<br />

Updates `@octokit/request` from 10.0.5 to 10.0.7
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/octokit/request.js/releases"><code>@​octokit/request</code>'s
releases</a>.</em></p>
<blockquote>
<h2>v10.0.7</h2>
<h2><a
href="https://github.com/octokit/request.js/compare/v10.0.6...v10.0.7">10.0.7</a>
(2025-11-13)</h2>
<h3>Bug Fixes</h3>
<ul>
<li><strong>readme:</strong> properly structure the options for custom
agent (<a
href="https://redirect.github.com/octokit/request.js/issues/786">#786</a>)
(<a
href="https://github.com/octokit/request.js/commit/f17c1c13c7cba81187c419da06b815ed741c950c">f17c1c1</a>),
closes <a
href="https://redirect.github.com/octokit/request.js/issues/785">#785</a></li>
</ul>
<h2>v10.0.6</h2>
<h2><a
href="https://github.com/octokit/request.js/compare/v10.0.5...v10.0.6">10.0.6</a>
(2025-10-30)</h2>
<h3>Bug Fixes</h3>
<ul>
<li><strong>deps:</strong> update dependency
<code>@​octokit/types</code> to v16 (<a
href="https://redirect.github.com/octokit/request.js/issues/783">#783</a>)
(<a
href="https://github.com/octokit/request.js/commit/1aeac5672c04bc508e46796660465b1b67cf397c">1aeac56</a>)</li>
</ul>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/octokit/request.js/commit/f17c1c13c7cba81187c419da06b815ed741c950c"><code>f17c1c1</code></a>
fix(readme): properly structure the options for custom agent (<a
href="https://redirect.github.com/octokit/request.js/issues/786">#786</a>)</li>
<li><a
href="https://github.com/octokit/request.js/commit/ea46fa9cd46f970fad5e286e6fdd2ea46929ac5d"><code>ea46fa9</code></a>
ci(action): update github/codeql-action action to v4 (<a
href="https://redirect.github.com/octokit/request.js/issues/778">#778</a>)</li>
<li><a
href="https://github.com/octokit/request.js/commit/8166d281814326b3e11d60b1895e623f2fd51c9e"><code>8166d28</code></a>
chore(deps): update vitest monorepo to v4 (major) (<a
href="https://redirect.github.com/octokit/request.js/issues/781">#781</a>)</li>
<li><a
href="https://github.com/octokit/request.js/commit/1aeac5672c04bc508e46796660465b1b67cf397c"><code>1aeac56</code></a>
fix(deps): update dependency <code>@​octokit/types</code> to v16 (<a
href="https://redirect.github.com/octokit/request.js/issues/783">#783</a>)</li>
<li><a
href="https://github.com/octokit/request.js/commit/b5b08a2ffde04d7c9ee3452ff86459836981e7f6"><code>b5b08a2</code></a>
ci(action): update actions/setup-node action to v6 (<a
href="https://redirect.github.com/octokit/request.js/issues/779">#779</a>)</li>
<li><a
href="https://github.com/octokit/request.js/commit/9a78123cc35f1c7cb5ac0e3cce4c2331ea5dca6e"><code>9a78123</code></a>
chore(deps): update dependency <code>@​types/node</code> to v24 (<a
href="https://redirect.github.com/octokit/request.js/issues/782">#782</a>)</li>
<li>See full diff in <a
href="https://github.com/octokit/request.js/compare/v10.0.5...v10.0.7">compare
view</a></li>
</ul>
</details>
<br />


Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.

[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)

---

<details>
<summary>Dependabot commands and options</summary>
<br />

You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot merge` will merge this PR after your CI passes on it
- `@dependabot squash and merge` will squash and merge this PR after
your CI passes on it
- `@dependabot cancel merge` will cancel a previously requested merge
and block automerging
- `@dependabot reopen` will reopen this PR if it is closed
- `@dependabot close` will close this PR and stop Dependabot recreating
it. You can achieve the same result by closing it manually
- `@dependabot show <dependency name> ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore <dependency name> major version` will close this
group update PR and stop Dependabot creating any more for the specific
dependency's major version (unless you unignore this specific
dependency's major version or upgrade to it yourself)
- `@dependabot ignore <dependency name> minor version` will close this
group update PR and stop Dependabot creating any more for the specific
dependency's minor version (unless you unignore this specific
dependency's minor version or upgrade to it yourself)
- `@dependabot ignore <dependency name>` will close this group update PR
and stop Dependabot creating any more for the specific dependency
(unless you unignore this specific dependency or upgrade to it yourself)
- `@dependabot unignore <dependency name>` will remove all of the ignore
conditions of the specified dependency
- `@dependabot unignore <dependency name> <ignore condition>` will
remove the ignore condition of the specified dependency and ignore
conditions


</details>

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
 2025-12-05 14:52:29 -08:00
Parker Brown 8efbf9bf0f ci: create stale workflow (#309) 
Introduces a GitHub Actions workflow that automatically marks issues and
pull requests as stale after 180 days of inactivity and closes them
after an additional 60 days. This helps keep the repository clean and
maintainable by prompting action on inactive items.
 2025-11-22 00:07:32 -08:00
semantic-release-bot 7e473efe3c build(release): 2.2.0 [skip ci] 
# [2.2.0](https://github.com/actions/create-github-app-token/compare/v2.1.4...v2.2.0) (2025-11-21)

### Bug Fixes

* **deps:** bump glob from 10.4.5 to 10.5.0 ([#305](https://github.com/actions/create-github-app-token/issues/305)) ([5480f43](https://github.com/actions/create-github-app-token/commit/5480f4325a18c025ee16d7e081413854624e9edc))
* **deps:** bump p-retry from 6.2.1 to 7.1.0 ([#294](https://github.com/actions/create-github-app-token/issues/294)) ([dce3be8](https://github.com/actions/create-github-app-token/commit/dce3be8b284f45e65caed11a610e2bef738d15b4))
* **deps:** bump the production-dependencies group with 2 updates ([#292](https://github.com/actions/create-github-app-token/issues/292)) ([55e2a4b](https://github.com/actions/create-github-app-token/commit/55e2a4b2ccaaa8364303e6ab9f77e31ad02298e5))

### Features

* update permission inputs ([#296](https://github.com/actions/create-github-app-token/issues/296)) ([d90aa53](https://github.com/actions/create-github-app-token/commit/d90aa532332d33f6dc9656fd4491a98441595a37))
v2.2.0 		2025-11-21 23:51:44 +00:00
dependabot[bot] dce3be8b28 fix(deps): bump p-retry from 6.2.1 to 7.1.0 (#294) 
Bumps [p-retry](https://github.com/sindresorhus/p-retry) from 6.2.1 to
7.1.0.
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/sindresorhus/p-retry/releases">p-retry's
releases</a>.</em></p>
<blockquote>
<h2>v7.0.0</h2>
<h3>Breaking</h3>
<ul>
<li>Require Node.js 20  3bdb53a</li>
<li><code>onFailedAttempt</code> and <code>shouldRetry</code> now
receive a <code>context</code> object instead of a decorated
<code>error</code> bff36bb
<ul>
<li>You must now must access the error as <code>object.error</code>
instead of <code>object</code>.</li>
<li>The use of <code>.attemptNumber</code> and <code>.retriesLeft</code>
did not change.</li>
</ul>
</li>
<li>Remove the <code>forever</code> option (<a
href="https://redirect.github.com/sindresorhus/p-retry/issues/79">#79</a>)
6a89827
<ul>
<li>Many use-cases can use <code>{retries: Infinity}</code> instead for
infinite retries.</li>
</ul>
</li>
</ul>
<h3>Improvements</h3>
<ul>
<li>Rewrite the package to not depend on the <code>retry</code> package
(<a
href="https://redirect.github.com/sindresorhus/p-retry/issues/79">#79</a>)
6a89827
<ul>
<li>This is a full rewrite, so test carefully.</li>
</ul>
</li>
<li>Add <a
href="https://github.com/sindresorhus/p-retry#makeretriablefunction-options"><code>makeRetriable</code></a>
method 1a81c1e</li>
</ul>
<hr />
<p><a
href="https://github.com/sindresorhus/p-retry/compare/v6.2.1...v7.0.0">https://github.com/sindresorhus/p-retry/compare/v6.2.1...v7.0.0</a></p>
<h2>v7.0.0-0</h2>
<h3>Breaking</h3>
<ul>
<li>Require Node.js 20  3bdb53a</li>
<li><code>onFailedAttempt</code> and <code>shouldRetry</code> now
receive a <code>context</code> object instead of a decorated
<code>error</code> bff36bb
<ul>
<li>You must now must access the error as <code>object.error</code>
instead of <code>object</code>.</li>
<li>The use of <code>.attemptNumber</code> and <code>.retriesLeft</code>
did not change.</li>
</ul>
</li>
<li>Remove the <code>forever</code> option (<a
href="https://redirect.github.com/sindresorhus/p-retry/issues/79">#79</a>)
6a89827
<ul>
<li>Many use-cases can use <code>{retries: Infinity}</code> instead for
infinite retries.</li>
</ul>
</li>
</ul>
<h3>Improvements</h3>
<ul>
<li>Rewrite the package to not depend on the <code>retry</code> package
(<a
href="https://redirect.github.com/sindresorhus/p-retry/issues/79">#79</a>)
6a89827
<ul>
<li>This is a full rewrite, so test carefully.</li>
</ul>
</li>
<li>Add <a
href="https://github.com/sindresorhus/p-retry?tab=readme-ov-file#makeretriablefunction-options"><code>makeRetriable</code></a>
method 1a81c1e</li>
</ul>
<hr />
<p><a
href="https://github.com/sindresorhus/p-retry/compare/v6.2.1...v7.0.0-0">https://github.com/sindresorhus/p-retry/compare/v6.2.1...v7.0.0-0</a></p>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/sindresorhus/p-retry/commit/e11ca9c9c4a8032182403871593a67a49e948568"><code>e11ca9c</code></a>
7.0.0</li>
<li><a
href="https://github.com/sindresorhus/p-retry/commit/81608ce107e17b388721ec6377b58e29c52ea55c"><code>81608ce</code></a>
Minor tweaks</li>
<li><a
href="https://github.com/sindresorhus/p-retry/commit/9ef6a73d71c875c06de0090774806eb5ef1b4a7d"><code>9ef6a73</code></a>
Clarify <code>shouldRetry</code> documentation (<a
href="https://redirect.github.com/sindresorhus/p-retry/issues/93">#93</a>)</li>
<li><a
href="https://github.com/sindresorhus/p-retry/commit/e05b1017e183db72962fbc8edb5fa1c86d33bc3c"><code>e05b101</code></a>
Fix code example typo (<a
href="https://redirect.github.com/sindresorhus/p-retry/issues/91">#91</a>)</li>
<li><a
href="https://github.com/sindresorhus/p-retry/commit/157d06eabbcae7066e8cbf430ad0da759a4ca9a1"><code>157d06e</code></a>
7.0.0-0</li>
<li><a
href="https://github.com/sindresorhus/p-retry/commit/bff36bb860a8ea8551982cd6bce5a2aaed4135fb"><code>bff36bb</code></a>
Stop decorating errors</li>
<li><a
href="https://github.com/sindresorhus/p-retry/commit/1a81c1e2d25718119d59ce33f9feeceb47a7436a"><code>1a81c1e</code></a>
Add <code>makeRetriable</code> method</li>
<li><a
href="https://github.com/sindresorhus/p-retry/commit/481105165809e0dd47679f5f576a0734bce7bcb9"><code>4811051</code></a>
Document mocking</li>
<li><a
href="https://github.com/sindresorhus/p-retry/commit/777d98f331affb8782eb50bee7d48e7c825224ca"><code>777d98f</code></a>
Document signal handling</li>
<li><a
href="https://github.com/sindresorhus/p-retry/commit/b4e52fcafab4592d353e1901c697f49605193496"><code>b4e52fc</code></a>
Add test for async stack traces</li>
<li>Additional commits viewable in <a
href="https://github.com/sindresorhus/p-retry/compare/v6.2.1...v7.0.0">compare
view</a></li>
</ul>
</details>
<br />


[![Dependabot compatibility
score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=p-retry&package-manager=npm_and_yarn&previous-version=6.2.1&new-version=7.0.0)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)

You can trigger a rebase of this PR by commenting `@dependabot rebase`.

[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)

---

<details>
<summary>Dependabot commands and options</summary>
<br />

You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot merge` will merge this PR after your CI passes on it
- `@dependabot squash and merge` will squash and merge this PR after
your CI passes on it
- `@dependabot cancel merge` will cancel a previously requested merge
and block automerging
- `@dependabot reopen` will reopen this PR if it is closed
- `@dependabot close` will close this PR and stop Dependabot recreating
it. You can achieve the same result by closing it manually
- `@dependabot show <dependency name> ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore this major version` will close this PR and stop
Dependabot creating any more for this major version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this minor version` will close this PR and stop
Dependabot creating any more for this minor version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this dependency` will close this PR and stop
Dependabot creating any more for this dependency (unless you reopen the
PR or upgrade to it yourself)


</details>

> **Note**
> Automatic rebases have been disabled on this pull request as it has
been open for over 30 days.

---------

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: Parker Brown <17183625+parkerbxyz@users.noreply.github.com>
 2025-11-21 15:50:07 -08:00
dependabot[bot] 5480f4325a fix(deps): bump glob from 10.4.5 to 10.5.0 (#305) 
Bumps [glob](https://github.com/isaacs/node-glob) from 10.4.5 to 10.5.0.
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/isaacs/node-glob/commit/56774ef73b495eb0b17cdd0f42921f5ef62297c1"><code>56774ef</code></a>
10.5.0</li>
<li><a
href="https://github.com/isaacs/node-glob/commit/1e4e297342a09f2aa0ced87fcd4a70ddc325d75f"><code>1e4e297</code></a>
bin: Do not expose filenames to shell expansion</li>
<li>See full diff in <a
href="https://github.com/isaacs/node-glob/compare/v10.4.5...v10.5.0">compare
view</a></li>
</ul>
</details>
<br />


[![Dependabot compatibility
score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=glob&package-manager=npm_and_yarn&previous-version=10.4.5&new-version=10.5.0)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)

Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.

[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)

---

<details>
<summary>Dependabot commands and options</summary>
<br />

You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot merge` will merge this PR after your CI passes on it
- `@dependabot squash and merge` will squash and merge this PR after
your CI passes on it
- `@dependabot cancel merge` will cancel a previously requested merge
and block automerging
- `@dependabot reopen` will reopen this PR if it is closed
- `@dependabot close` will close this PR and stop Dependabot recreating
it. You can achieve the same result by closing it manually
- `@dependabot show <dependency name> ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore this major version` will close this PR and stop
Dependabot creating any more for this major version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this minor version` will close this PR and stop
Dependabot creating any more for this minor version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this dependency` will close this PR and stop
Dependabot creating any more for this dependency (unless you reopen the
PR or upgrade to it yourself)
You can disable automated security fix PRs for this repo from the
[Security Alerts
page](https://github.com/actions/create-github-app-token/network/alerts).

</details>

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: Parker Brown <17183625+parkerbxyz@users.noreply.github.com>
 2025-11-21 15:49:59 -08:00
dependabot[bot] d90aa53233 feat: update permission inputs (#296) 
Bumps [@octokit/openapi](https://github.com/octokit/openapi) from 19.1.0
to 21.0.0.
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/octokit/openapi/releases"><code>@​octokit/openapi</code>'s
releases</a>.</em></p>
<blockquote>
<h2>v20.0.0</h2>
<h1><a
href="https://github.com/octokit/openapi/compare/v19.1.0...v20.0.0">20.0.0</a>
(2025-09-16)</h1>
<h3>chore</h3>
<ul>
<li><strong>deps:</strong> update dependency sort-keys to v6 (<a
href="https://redirect.github.com/octokit/openapi/issues/500">#500</a>)
(<a
href="https://github.com/octokit/openapi/commit/262f87fe9825559a2c6edb2bf6534eab4622ee28">262f87f</a>)</li>
</ul>
<h3>Features</h3>
<ul>
<li>new Projects v2 endpoints, new code scanning dismissal endpoints,
many other endpoints (<a
href="https://redirect.github.com/octokit/openapi/issues/503">#503</a>)
(<a
href="https://github.com/octokit/openapi/commit/0b92729176bd70d4d5274a765fa00107dfd5017d">0b92729</a>)</li>
</ul>
<h3>BREAKING CHANGES</h3>
<ul>
<li><strong>deps:</strong> Remove GHES 3.13</li>
</ul>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/octokit/openapi/commit/262f87fe9825559a2c6edb2bf6534eab4622ee28"><code>262f87f</code></a>
chore(deps): update dependency sort-keys to v6 (<a
href="https://redirect.github.com/octokit/openapi/issues/500">#500</a>)</li>
<li><a
href="https://github.com/octokit/openapi/commit/0b92729176bd70d4d5274a765fa00107dfd5017d"><code>0b92729</code></a>
feat: new Projects v2 endpoints, new code scanning dismissal endpoints,
many ...</li>
<li><a
href="https://github.com/octokit/openapi/commit/a74dd44fb2a8c3c20e7143eb71ddaf86b9b0e639"><code>a74dd44</code></a>
chore(deps): update dependency <code>@​octokit/core</code> to v7 (<a
href="https://redirect.github.com/octokit/openapi/issues/496">#496</a>)</li>
<li><a
href="https://github.com/octokit/openapi/commit/3a7a9ea8cc65a3f7fa27436a2072080b565ab207"><code>3a7a9ea</code></a>
build(deps): lock file maintenance (<a
href="https://redirect.github.com/octokit/openapi/issues/498">#498</a>)</li>
<li><a
href="https://github.com/octokit/openapi/commit/d6be26fc7e8cd0eb798a512c5107d16ccb2aacb4"><code>d6be26f</code></a>
ci(action): update actions/checkout action to v5 (<a
href="https://redirect.github.com/octokit/openapi/issues/499">#499</a>)</li>
<li><a
href="https://github.com/octokit/openapi/commit/6ae358ed6fb0a184cc75e2dab1f06079ff20d66b"><code>6ae358e</code></a>
ci(action): update actions/setup-node action to v5 (<a
href="https://redirect.github.com/octokit/openapi/issues/502">#502</a>)</li>
<li><a
href="https://github.com/octokit/openapi/commit/f02c5e21bac37e778aedac8ba39b4d62c4b6a7a5"><code>f02c5e2</code></a>
ci(action): update gr2m/release-notifier-action action to v2 (<a
href="https://redirect.github.com/octokit/openapi/issues/501">#501</a>)</li>
<li>See full diff in <a
href="https://github.com/octokit/openapi/compare/v19.1.0...v20.0.0">compare
view</a></li>
</ul>
</details>
<br />


[![Dependabot compatibility
score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=@octokit/openapi&package-manager=npm_and_yarn&previous-version=19.1.0&new-version=20.0.0)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)

You can trigger a rebase of this PR by commenting `@dependabot rebase`.

[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)

---

<details>
<summary>Dependabot commands and options</summary>
<br />

You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot merge` will merge this PR after your CI passes on it
- `@dependabot squash and merge` will squash and merge this PR after
your CI passes on it
- `@dependabot cancel merge` will cancel a previously requested merge
and block automerging
- `@dependabot reopen` will reopen this PR if it is closed
- `@dependabot close` will close this PR and stop Dependabot recreating
it. You can achieve the same result by closing it manually
- `@dependabot show <dependency name> ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore this major version` will close this PR and stop
Dependabot creating any more for this major version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this minor version` will close this PR and stop
Dependabot creating any more for this minor version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this dependency` will close this PR and stop
Dependabot creating any more for this dependency (unless you reopen the
PR or upgrade to it yourself)


</details>

> **Note**
> Automatic rebases have been disabled on this pull request as it has
been open for over 30 days.

---------

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: Parker Brown <17183625+parkerbxyz@users.noreply.github.com>
 2025-11-21 15:49:50 -08:00
dependabot[bot] 55e2a4b2cc fix(deps): bump the production-dependencies group with 2 updates (#292) 
Bumps the production-dependencies group with 2 updates:
[@octokit/auth-app](https://github.com/octokit/auth-app.js) and
[@octokit/request](https://github.com/octokit/request.js).

Updates `@octokit/auth-app` from 8.1.0 to 8.1.1
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/octokit/auth-app.js/releases"><code>@​octokit/auth-app</code>'s
releases</a>.</em></p>
<blockquote>
<h2>v8.1.1</h2>
<h2><a
href="https://github.com/octokit/auth-app.js/compare/v8.1.0...v8.1.1">8.1.1</a>
(2025-09-29)</h2>
<h3>Bug Fixes</h3>
<ul>
<li><strong>deps:</strong> update dependency
<code>@​octokit/types</code> to v15 (<a
href="https://redirect.github.com/octokit/auth-app.js/issues/721">#721</a>)
(<a
href="https://github.com/octokit/auth-app.js/commit/8b76e56918edc0e754d397e42b1b968ec9fad800">8b76e56</a>)</li>
</ul>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/octokit/auth-app.js/commit/8b76e56918edc0e754d397e42b1b968ec9fad800"><code>8b76e56</code></a>
fix(deps): update dependency <code>@​octokit/types</code> to v15 (<a
href="https://redirect.github.com/octokit/auth-app.js/issues/721">#721</a>)</li>
<li><a
href="https://github.com/octokit/auth-app.js/commit/1eb6dbc98053ecd71827edaf0cf47d78444899bb"><code>1eb6dbc</code></a>
chore(deps): update dependency node to v22 (<a
href="https://redirect.github.com/octokit/auth-app.js/issues/713">#713</a>)</li>
<li><a
href="https://github.com/octokit/auth-app.js/commit/576769682cfc7a7901bab4678edd9cd1c48aa76e"><code>5767696</code></a>
build(deps): lock file maintenance (<a
href="https://redirect.github.com/octokit/auth-app.js/issues/715">#715</a>)</li>
<li>See full diff in <a
href="https://github.com/octokit/auth-app.js/compare/v8.1.0...v8.1.1">compare
view</a></li>
</ul>
</details>
<br />

Updates `@octokit/request` from 10.0.3 to 10.0.5
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/octokit/request.js/releases"><code>@​octokit/request</code>'s
releases</a>.</em></p>
<blockquote>
<h2>v10.0.5</h2>
<h2><a
href="https://github.com/octokit/request.js/compare/v10.0.4...v10.0.5">10.0.5</a>
(2025-09-29)</h2>
<h3>Bug Fixes</h3>
<ul>
<li><strong>deps:</strong> update octokit deps (<a
href="https://redirect.github.com/octokit/request.js/issues/772">#772</a>)
(<a
href="https://github.com/octokit/request.js/commit/30f83b64578eebf6988b44df495d235de8136e6e">30f83b6</a>)</li>
</ul>
<h2>v10.0.4</h2>
<h2><a
href="https://github.com/octokit/request.js/compare/v10.0.3...v10.0.4">10.0.4</a>
(2025-09-29)</h2>
<h3>Bug Fixes</h3>
<ul>
<li><strong>deps:</strong> update dependency
<code>@​octokit/types</code> to v15 (<a
href="https://redirect.github.com/octokit/request.js/issues/775">#775</a>)
(<a
href="https://github.com/octokit/request.js/commit/ad78b4c8099a790d9ac3489342021896cabdbecd">ad78b4c</a>)</li>
</ul>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/octokit/request.js/commit/30f83b64578eebf6988b44df495d235de8136e6e"><code>30f83b6</code></a>
fix(deps): update octokit deps (<a
href="https://redirect.github.com/octokit/request.js/issues/772">#772</a>)</li>
<li><a
href="https://github.com/octokit/request.js/commit/b07d5937e628436a399716e2df8e747d5cbb98d5"><code>b07d593</code></a>
ci(action): update actions/checkout action to v5 (<a
href="https://redirect.github.com/octokit/request.js/issues/770">#770</a>)</li>
<li><a
href="https://github.com/octokit/request.js/commit/928c3d7e019e38a70eb89b9760ff120eed6acf58"><code>928c3d7</code></a>
chore(deps): update dependency prettier to v3.6.2 (<a
href="https://redirect.github.com/octokit/request.js/issues/766">#766</a>)</li>
<li><a
href="https://github.com/octokit/request.js/commit/a84613eab6b231fca05549186fd4fd4c62bd7f02"><code>a84613e</code></a>
ci(action): update actions/setup-node action to v5 (<a
href="https://redirect.github.com/octokit/request.js/issues/771">#771</a>)</li>
<li><a
href="https://github.com/octokit/request.js/commit/ad78b4c8099a790d9ac3489342021896cabdbecd"><code>ad78b4c</code></a>
fix(deps): update dependency <code>@​octokit/types</code> to v15 (<a
href="https://redirect.github.com/octokit/request.js/issues/775">#775</a>)</li>
<li>See full diff in <a
href="https://github.com/octokit/request.js/compare/v10.0.3...v10.0.5">compare
view</a></li>
</ul>
</details>
<br />


You can trigger a rebase of this PR by commenting `@dependabot rebase`.

[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)

---

<details>
<summary>Dependabot commands and options</summary>
<br />

You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot merge` will merge this PR after your CI passes on it
- `@dependabot squash and merge` will squash and merge this PR after
your CI passes on it
- `@dependabot cancel merge` will cancel a previously requested merge
and block automerging
- `@dependabot reopen` will reopen this PR if it is closed
- `@dependabot close` will close this PR and stop Dependabot recreating
it. You can achieve the same result by closing it manually
- `@dependabot show <dependency name> ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore <dependency name> major version` will close this
group update PR and stop Dependabot creating any more for the specific
dependency's major version (unless you unignore this specific
dependency's major version or upgrade to it yourself)
- `@dependabot ignore <dependency name> minor version` will close this
group update PR and stop Dependabot creating any more for the specific
dependency's minor version (unless you unignore this specific
dependency's minor version or upgrade to it yourself)
- `@dependabot ignore <dependency name>` will close this group update PR
and stop Dependabot creating any more for the specific dependency
(unless you unignore this specific dependency or upgrade to it yourself)
- `@dependabot unignore <dependency name>` will remove all of the ignore
conditions of the specified dependency
- `@dependabot unignore <dependency name> <ignore condition>` will
remove the ignore condition of the specified dependency and ignore
conditions


</details>

> **Note**
> Automatic rebases have been disabled on this pull request as it has
been open for over 30 days.

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: Parker Brown <17183625+parkerbxyz@users.noreply.github.com>
 2025-11-21 23:48:38 +00:00