Skip to content

build(deps-dev): bump the development-dependencies group across 1 directory with 6 updates - #13

Merged
anilkreddy merged 8 commits into
mainfrom
dependabot/npm_and_yarn/development-dependencies-343dc03040
Nov 14, 2026
Merged

build(deps-dev): bump the development-dependencies group across 1 directory with 6 updates#13
anilkreddy merged 8 commits into
mainfrom
dependabot/npm_and_yarn/development-dependencies-343dc03040

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Nov 9, 2026 •
edited by anilkreddy
Loading

Copy link
Copy Markdown
Contributor

Integrate the four pending dependency PRs together, with normal commit ancestry,
so CodeQL's init/analyze pins stay aligned and the committed standalone bundle
matches the dependency graph.

Includes these original PR heads unchanged as ancestors:

  • #10 semver 7.8.6: 1ca1adcb31156124c35cd14b14e41e2c883047fd
  • #11 CodeQL init: d116c4be995a6110a484246f943e7f5af2887c2f
  • #12 CodeQL analyze: da86c2dc2437ae14578f8edbd8075beb5e23d8f3
  • This development group: original d158327e50ec8b40757c53dc17d665a3da6a5d46

Final reviewed head: 204a7f1f2eee0b005d9585e9669144084048833a.
Only four files differ from main: package.json, pnpm-lock.yaml,
.github/workflows/codeql.yml and dist/index.js. No application source,
permissions, thresholds, exclusions or deployment workflow was changed.

Repairs and validation

  • Both CodeQL steps use verified full SHA 33d7b85da1a04171e211befe2c739303b9a4c066.
    This fixes the split-version configuration failure from updating them separately.
  • Regenerate dist for semver and the full dependency update, fixing build(deps): bump semver from 7.8.5 to 7.8.6 #10's stale
    committed bundle failure.
  • Narrowly refresh runtime Undici 6.29.0 to published 6.29.1 within the existing
    @actions/http-client range. No override or new direct dependency was added.
    The previous production high-severity findings are fixed.
  • Frozen install and full local pnpm quality PASS: formatting, lint, strict
    types, 143 tests across 11 files, unchanged coverage requirements,
    byte-identical bundle regeneration, public scan and production audit.
  • Coverage: 93.75% statements, 90% branches, 93.10% functions, 93.92% lines;
    existing repository thresholds/exclusions were not changed.
  • Actual bundled CLI install/help/version/cache integration PASS locally on
    macOS ARM64 with official CLI 0.1.0-preview.2.
  • PASS: hosted quality and all six CLI-install platforms
    on the exact reviewed head: Linux, macOS and Windows, x64 and ARM64.
  • PASS: CodeQL analysis
    and CodeQL check on that same head.
  • Production audit: no known vulnerabilities. Full audit retains one pre-existing
    moderate development-only minimatch advisory; it is disclosed, not suppressed
    or described as full-audit clean.
  • Bundle SHA-256: 9124b04f924532b8b6fce0ee2739e6da06586f8fdc3f643a291a4e52ecd6cf0b.

Use a normal merge commit, preserving all four original PR ancestries so the
companion PRs can be recognized as integrated. Repository review requirements
and checks are honored; no admin override, force push or check bypass.

The owner authorized merging pending source PRs. This does not authorize
package/action publication, release/tag creation, deployment or real SAP
cleanup. Main-push workflows here perform CI/CodeQL only. Notify's separate
contract-publication gate remains outside this dependency merge.

dependabot Bot added 4 commits November 9, 2026 12:22
@dependabot
build(deps): bump semver from 7.8.5 to 7.8.6
1ca1adc 
Bumps [semver](https://github.com/npm/node-semver) from 7.8.5 to 7.8.6.
- [Release notes](https://github.com/npm/node-semver/releases)
- [Changelog](https://github.com/npm/node-semver/blob/main/CHANGELOG.md)
- [Commits](npm/node-semver@v7.8.5...v7.8.6)

---
updated-dependencies:
- dependency-name: semver
  dependency-version: 7.8.6
  dependency-type: direct:production
  update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot
build(deps): bump github/codeql-action/init from 4.38.3 to 4.39.3
d116c4b 
Bumps [github/codeql-action/init](https://github.com/github/codeql-action) from 4.38.3 to 4.39.3.
- [Release notes](https://github.com/github/codeql-action/releases)
- [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md)
- [Commits](github/codeql-action@24c5418...33d7b85)

---
updated-dependencies:
- dependency-name: github/codeql-action/init
  dependency-version: 4.39.3
  dependency-type: direct:production
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot
build(deps): bump github/codeql-action/analyze from 4.38.3 to 4.39.3
da86c2d 
Bumps [github/codeql-action/analyze](https://github.com/github/codeql-action) from 4.38.3 to 4.39.3.
- [Release notes](https://github.com/github/codeql-action/releases)
- [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md)
- [Commits](github/codeql-action@24c5418...33d7b85)

---
updated-dependencies:
- dependency-name: github/codeql-action/analyze
  dependency-version: 4.39.3
  dependency-type: direct:production
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot
build(deps-dev): bump the development-dependencies group across 1 dir…
d158327 
…ectory with 6 updates

Bumps the development-dependencies group with 6 updates in the / directory:

| Package | From | To |
| --- | --- | --- |
| [@types/node](https://github.com/DefinitelyTyped/DefinitelyTyped/tree/HEAD/types/node) | `26.6.5` | `26.6.6` |
| [@vitest/coverage-v8](https://github.com/vitest-dev/vitest/tree/HEAD/packages/coverage-v8) | `5.0.4` | `5.1.0` |
| [eslint](https://github.com/eslint/eslint) | `10.12.0` | `10.14.0` |
| [globals](https://github.com/sindresorhus/globals) | `17.13.0` | `17.14.0` |
| [typescript-eslint](https://github.com/typescript-eslint/typescript-eslint/tree/HEAD/packages/typescript-eslint) | `8.71.2` | `8.72.1` |
| [vitest](https://github.com/vitest-dev/vitest/tree/HEAD/packages/vitest) | `5.0.4` | `5.1.0` |



Updates `@types/node` from 26.6.5 to 26.6.6
- [Release notes](https://github.com/DefinitelyTyped/DefinitelyTyped/releases)
- [Commits](https://github.com/DefinitelyTyped/DefinitelyTyped/commits/HEAD/types/node)

Updates `@vitest/coverage-v8` from 5.0.4 to 5.1.0
- [Release notes](https://github.com/vitest-dev/vitest/releases)
- [Changelog](https://github.com/vitest-dev/vitest/blob/main/docs/releases.md)
- [Commits](https://github.com/vitest-dev/vitest/commits/v5.1.0/packages/coverage-v8)

Updates `eslint` from 10.12.0 to 10.14.0
- [Release notes](https://github.com/eslint/eslint/releases)
- [Commits](eslint/eslint@v10.12.0...v10.14.0)

Updates `globals` from 17.13.0 to 17.14.0
- [Release notes](https://github.com/sindresorhus/globals/releases)
- [Commits](sindresorhus/globals@v17.13.0...v17.14.0)

Updates `typescript-eslint` from 8.71.2 to 8.72.1
- [Release notes](https://github.com/typescript-eslint/typescript-eslint/releases)
- [Changelog](https://github.com/typescript-eslint/typescript-eslint/blob/main/packages/typescript-eslint/CHANGELOG.md)
- [Commits](https://github.com/typescript-eslint/typescript-eslint/commits/v8.72.1/packages/typescript-eslint)

Updates `vitest` from 5.0.4 to 5.1.0
- [Release notes](https://github.com/vitest-dev/vitest/releases)
- [Changelog](https://github.com/vitest-dev/vitest/blob/main/docs/releases.md)
- [Commits](https://github.com/vitest-dev/vitest/commits/v5.1.0/packages/vitest)

---
updated-dependencies:
- dependency-name: "@types/node"
  dependency-version: 26.6.6
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: development-dependencies
- dependency-name: "@vitest/coverage-v8"
  dependency-version: 5.1.0
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: development-dependencies
- dependency-name: eslint
  dependency-version: 10.14.0
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: development-dependencies
- dependency-name: globals
  dependency-version: 17.14.0
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: development-dependencies
- dependency-name: typescript-eslint
  dependency-version: 8.72.1
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: development-dependencies
- dependency-name: vitest
  dependency-version: 5.1.0
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: development-dependencies
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot Bot added dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code labels Nov 9, 2026
@anilkreddy
Merge remote-tracking branch 'origin/dependabot/github_actions/github…
0886804 
…/codeql-action/init-4.39.3' into dependabot/npm_and_yarn/development-dependencies-343dc03040
@anilkreddy
Merge remote-tracking branch 'origin/dependabot/github_actions/github…
863b956 
…/codeql-action/analyze-4.39.3' into dependabot/npm_and_yarn/development-dependencies-343dc03040
@anilkreddy
Merge remote-tracking branch 'origin/dependabot/npm_and_yarn/semver-7…
f4ab222 
….8.6' into dependabot/npm_and_yarn/development-dependencies-343dc03040
@anilkreddy
fix: refresh patched Undici and rebuild combined dependency bundle
204a7f1
@anilkreddy
anilkreddy merged commit 7f650f3 into main Nov 14, 2026
9 checks passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@anilkreddy anilkreddy anilkreddy approved these changes

Assignees

No one assigned

Labels

dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

1 participant

@anilkreddy