chore(deps): combined dependency updates 2026-06-22 - #254
Merged
Conversation
Bumps the all-docker group with 1 update: node. Updates `node` from `1e738cb` to `aa27a5f` --- updated-dependencies: - dependency-name: node dependency-version: 26-slim dependency-type: direct:production dependency-group: all-docker ... Signed-off-by: dependabot[bot] <support@github.com>
Contributor
There was a problem hiding this comment.
Pull request overview
This PR is an automated combined Dependabot update that refreshes Node/npm dependencies, Docker base image digest, and pinned GitHub Action revisions used across CI/security workflows.
Changes:
- Bump
@github/copilot-sdkto^1.0.0(plus corresponding lockfile updates). - Refresh dev tooling lock entries (e.g., ESLint, lint-staged, tsx, tinyexec, yaml).
- Update pinned GitHub Actions SHAs (notably
actions/checkout) and bumpgitleaksaction; update Docker base image digest.
Show a summary per file
| File | Description |
|---|---|
package.json |
Updates @github/copilot-sdk dependency version. |
package-lock.json |
Updates resolved dependency versions/metadata for the bumped packages. |
Dockerfile |
Updates the pinned node:26-slim image digest. |
.github/workflows/site.yml |
Updates actions/checkout pin used by the docs/site workflow. |
.github/workflows/security.yml |
Updates actions/checkout pin and bumps gitleaks/gitleaks-action pin. |
.github/workflows/scorecard.yml |
Updates actions/checkout and CodeQL upload-sarif action pins. |
.github/workflows/scorecard-monitor.lock.yml |
Updates actions/checkout pins in the scorecard monitor workflow. |
.github/workflows/release.yml |
Updates actions/checkout pin for release automation. |
.github/workflows/combine-prs.yml |
Updates actions/checkout pin for the Dependabot-combine workflow. |
.github/workflows/codeql.yml |
Updates actions/checkout and CodeQL init/analyze action pins. |
.github/workflows/ci.yml |
Updates actions/checkout pins across CI jobs. |
.github/workflows/cflite_pr.yml |
Updates actions/checkout pin for ClusterFuzzLite PR workflow. |
.github/workflows/cflite_batch.yml |
Updates actions/checkout pin for ClusterFuzzLite batch workflow. |
Copilot's findings
- Files reviewed: 12/13 changed files
- Comments generated: 0
Bumps the all-npm group with 8 updates in the / directory: | Package | From | To | | --- | --- | --- | | [@github/copilot-sdk](https://github.com/github/copilot-sdk) | `0.3.0` | `1.0.1` | | [tsx](https://github.com/privatenumber/tsx) | `4.22.3` | `4.22.4` | | [@playwright/test](https://github.com/microsoft/playwright) | `1.60.0` | `1.61.0` | | [eslint](https://github.com/eslint/eslint) | `10.4.0` | `10.5.0` | | [eslint-plugin-security](https://github.com/eslint-community/eslint-plugin-security) | `4.0.0` | `4.0.1` | | [lint-staged](https://github.com/lint-staged/lint-staged) | `17.0.5` | `17.0.7` | | [prettier](https://github.com/prettier/prettier) | `3.8.3` | `3.8.4` | | [better-sqlite3](https://github.com/WiseLibs/better-sqlite3) | `12.10.0` | `12.10.1` | Updates `@github/copilot-sdk` from 0.3.0 to 1.0.1 - [Release notes](https://github.com/github/copilot-sdk/releases) - [Changelog](https://github.com/github/copilot-sdk/blob/main/CHANGELOG.md) - [Commits](github/copilot-sdk@v0.3.0...v1.0.1) Updates `tsx` from 4.22.3 to 4.22.4 - [Release notes](https://github.com/privatenumber/tsx/releases) - [Changelog](https://github.com/privatenumber/tsx/blob/master/release.config.cjs) - [Commits](privatenumber/tsx@v4.22.3...v4.22.4) Updates `@playwright/test` from 1.60.0 to 1.61.0 - [Release notes](https://github.com/microsoft/playwright/releases) - [Commits](microsoft/playwright@v1.60.0...v1.61.0) Updates `eslint` from 10.4.0 to 10.5.0 - [Release notes](https://github.com/eslint/eslint/releases) - [Commits](eslint/eslint@v10.4.0...v10.5.0) Updates `eslint-plugin-security` from 4.0.0 to 4.0.1 - [Release notes](https://github.com/eslint-community/eslint-plugin-security/releases) - [Changelog](https://github.com/eslint-community/eslint-plugin-security/blob/main/CHANGELOG.md) - [Commits](eslint-community/eslint-plugin-security@eslint-plugin-security-v4.0.0...eslint-plugin-security-v4.0.1) Updates `lint-staged` from 17.0.5 to 17.0.7 - [Release notes](https://github.com/lint-staged/lint-staged/releases) - [Changelog](https://github.com/lint-staged/lint-staged/blob/main/CHANGELOG.md) - [Commits](lint-staged/lint-staged@v17.0.5...v17.0.7) Updates `prettier` from 3.8.3 to 3.8.4 - [Release notes](https://github.com/prettier/prettier/releases) - [Changelog](https://github.com/prettier/prettier/blob/main/CHANGELOG.md) - [Commits](prettier/prettier@3.8.3...3.8.4) Updates `better-sqlite3` from 12.10.0 to 12.10.1 - [Release notes](https://github.com/WiseLibs/better-sqlite3/releases) - [Commits](WiseLibs/better-sqlite3@v12.10.0...v12.10.1) --- updated-dependencies: - dependency-name: "@github/copilot-sdk" dependency-version: 1.0.1 dependency-type: direct:production update-type: version-update:semver-major dependency-group: all-npm - dependency-name: tsx dependency-version: 4.22.4 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: all-npm - dependency-name: "@playwright/test" dependency-version: 1.61.0 dependency-type: direct:development update-type: version-update:semver-minor dependency-group: all-npm - dependency-name: eslint dependency-version: 10.5.0 dependency-type: direct:development update-type: version-update:semver-minor dependency-group: all-npm - dependency-name: eslint-plugin-security dependency-version: 4.0.1 dependency-type: direct:development update-type: version-update:semver-patch dependency-group: all-npm - dependency-name: lint-staged dependency-version: 17.0.7 dependency-type: direct:development update-type: version-update:semver-patch dependency-group: all-npm - dependency-name: prettier dependency-version: 3.8.4 dependency-type: direct:development update-type: version-update:semver-patch dependency-group: all-npm - dependency-name: better-sqlite3 dependency-version: 12.10.1 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: all-npm ... Signed-off-by: dependabot[bot] <support@github.com>
dorlugasigal
force-pushed
the
combined-deps/open
branch
from
June 15, 2026 16:59
1a6e442 to
51faf42
Compare
dorlugasigal
changed the title
Bumps the all-actions group with 5 updates in the / directory: | Package | From | To | | --- | --- | --- | | [actions/checkout](https://github.com/actions/checkout) | `6.0.2` | `7.0.0` | | [davelosert/vitest-coverage-report-action](https://github.com/davelosert/vitest-coverage-report-action) | `2.12.0` | `2.12.1` | | [github/codeql-action](https://github.com/github/codeql-action) | `4.36.0` | `4.36.2` | | [softprops/action-gh-release](https://github.com/softprops/action-gh-release) | `3.0.0` | `3.0.1` | | [gitleaks/gitleaks-action](https://github.com/gitleaks/gitleaks-action) | `2.3.9` | `3.0.0` | Updates `actions/checkout` from 6.0.2 to 7.0.0 - [Release notes](https://github.com/actions/checkout/releases) - [Changelog](https://github.com/actions/checkout/blob/main/CHANGELOG.md) - [Commits](actions/checkout@de0fac2...9c091bb) Updates `davelosert/vitest-coverage-report-action` from 2.12.0 to 2.12.1 - [Release notes](https://github.com/davelosert/vitest-coverage-report-action/releases) - [Changelog](https://github.com/davelosert/vitest-coverage-report-action/blob/main/release.config.js) - [Commits](davelosert/vitest-coverage-report-action@02f3c2e...3c054a2) Updates `github/codeql-action` from 4.36.0 to 4.36.2 - [Release notes](https://github.com/github/codeql-action/releases) - [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md) - [Commits](github/codeql-action@7211b7c...8aad20d) Updates `softprops/action-gh-release` from 3.0.0 to 3.0.1 - [Release notes](https://github.com/softprops/action-gh-release/releases) - [Changelog](https://github.com/softprops/action-gh-release/blob/master/CHANGELOG.md) - [Commits](softprops/action-gh-release@b430933...718ea10) Updates `gitleaks/gitleaks-action` from 2.3.9 to 3.0.0 - [Release notes](https://github.com/gitleaks/gitleaks-action/releases) - [Commits](gitleaks/gitleaks-action@ff98106...e0c47f4) --- updated-dependencies: - dependency-name: actions/checkout dependency-version: 7.0.0 dependency-type: direct:production update-type: version-update:semver-major dependency-group: all-actions - dependency-name: davelosert/vitest-coverage-report-action dependency-version: 2.12.1 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: all-actions - dependency-name: github/codeql-action dependency-version: 4.36.2 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: all-actions - dependency-name: softprops/action-gh-release dependency-version: 3.0.1 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: all-actions - dependency-name: gitleaks/gitleaks-action dependency-version: 3.0.0 dependency-type: direct:production update-type: version-update:semver-major dependency-group: all-actions ... Signed-off-by: dependabot[bot] <support@github.com>
dorlugasigal
force-pushed
the
combined-deps/open
branch
from
June 22, 2026 16:58
51faf42 to
41347b1
Compare
dorlugasigal
changed the title
| working-directory: packages/site | ||
| steps: | ||
| - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6 | ||
| - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v6 |
| run: sleep 120 | ||
|
|
||
| - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6 | ||
| - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v6 |
| security-events: write | ||
| steps: | ||
| - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6 | ||
| - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v6 |
| id-token: write | ||
| steps: | ||
| - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6 | ||
| - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v6 |
| runs-on: ubuntu-latest | ||
| steps: | ||
| - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6 | ||
| - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v6 |
| pull-requests: write | ||
| steps: | ||
| - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6 | ||
| - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v6 |
| runs-on: ubuntu-latest | ||
| steps: | ||
| - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6 | ||
| - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v6 |
| runs-on: ubuntu-latest | ||
| steps: | ||
| - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6 | ||
| - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v6 |
| os: [ubuntu-latest, windows-latest, macos-latest] | ||
| steps: | ||
| - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6 | ||
| - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v6 |
| os: [ubuntu-latest, windows-latest, macos-latest] | ||
| steps: | ||
| - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6 | ||
| - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v6 |
Resolves Trivy filesystem HIGH findings: - CVE-2026-50146, CVE-2026-54299 (astro: reflected XSS / host-header SSRF) - CVE-2026-53571 (vite: server.fs.deny bypass on Windows) Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Combined dependency updates
Supersedes and combines #256 (GitHub Actions), #255 (npm), and #251 (Docker base image) into a single coherent PR, plus a security fix for the docs site.
Changes
all-actionsgroup): 5 action updates across workflows.all-npmgroup): root deps incl.@github/copilot-sdk^0.3.0 → ^1.0.1.node:26-slimdigest bump.astro^6.1.9 → ^6.4.8 andviteoverride>=7.3.6 <8, clearing the Trivy filesystem HIGH findings (CVE-2026-50146, CVE-2026-54299, CVE-2026-53571).flowchart LR A[#256 actions] --> C[#254 combined] B[#255 npm] --> C D[#251 docker] --> C E[astro/vite fix] --> C C --> M[(main)] style C fill:#2563eb,color:#fff style M fill:#16a34a,color:#fffTrivy filesystem scan now reports 0 CRITICAL/HIGH vulnerabilities.