Bump the npm_and_yarn group across 1 directory with 9 updates#4
Open
dependabot[bot] wants to merge 1 commit into
Open
Bump the npm_and_yarn group across 1 directory with 9 updates#4dependabot[bot] wants to merge 1 commit into
dependabot[bot] wants to merge 1 commit into
Conversation
Bumps the npm_and_yarn group with 7 updates in the / directory: | Package | From | To | | --- | --- | --- | | [axios](https://github.com/axios/axios) | `1.7.4` | `1.16.0` | | [js-yaml](https://github.com/nodeca/js-yaml) | `3.14.1` | `3.14.2` | | [braces](https://github.com/micromatch/braces) | `3.0.2` | `3.0.3` | | [flatted](https://github.com/WebReflection/flatted) | `3.3.1` | `3.4.2` | | [lodash](https://github.com/lodash/lodash) | `4.17.21` | `4.18.1` | | [picomatch](https://github.com/micromatch/picomatch) | `2.3.1` | `2.3.2` | | [uuid](https://github.com/uuidjs/uuid) | `8.3.2` | `removed` | Updates `axios` from 1.7.4 to 1.16.0 - [Release notes](https://github.com/axios/axios/releases) - [Changelog](https://github.com/axios/axios/blob/v1.x/CHANGELOG.md) - [Commits](axios/axios@v1.7.4...v1.16.0) Updates `form-data` from 4.0.0 to 4.0.5 - [Release notes](https://github.com/form-data/form-data/releases) - [Changelog](https://github.com/form-data/form-data/blob/master/CHANGELOG.md) - [Commits](form-data/form-data@v4.0.0...v4.0.5) Updates `js-yaml` from 3.14.1 to 3.14.2 - [Changelog](https://github.com/nodeca/js-yaml/blob/master/CHANGELOG.md) - [Commits](nodeca/js-yaml@3.14.1...3.14.2) Updates `braces` from 3.0.2 to 3.0.3 - [Changelog](https://github.com/micromatch/braces/blob/master/CHANGELOG.md) - [Commits](micromatch/braces@3.0.2...3.0.3) Updates `flatted` from 3.3.1 to 3.4.2 - [Commits](WebReflection/flatted@v3.3.1...v3.4.2) Updates `follow-redirects` from 1.15.6 to 1.16.0 - [Release notes](https://github.com/follow-redirects/follow-redirects/releases) - [Commits](follow-redirects/follow-redirects@v1.15.6...v1.16.0) Updates `lodash` from 4.17.21 to 4.18.1 - [Release notes](https://github.com/lodash/lodash/releases) - [Commits](lodash/lodash@4.17.21...4.18.1) Updates `picomatch` from 2.3.1 to 2.3.2 - [Release notes](https://github.com/micromatch/picomatch/releases) - [Changelog](https://github.com/micromatch/picomatch/blob/master/CHANGELOG.md) - [Commits](micromatch/picomatch@2.3.1...2.3.2) Removes `uuid` --- updated-dependencies: - dependency-name: axios dependency-version: 1.16.0 dependency-type: direct:production dependency-group: npm_and_yarn - dependency-name: form-data dependency-version: 4.0.5 dependency-type: direct:production dependency-group: npm_and_yarn - dependency-name: js-yaml dependency-version: 3.14.2 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: braces dependency-version: 3.0.3 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: flatted dependency-version: 3.4.2 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: follow-redirects dependency-version: 1.16.0 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: lodash dependency-version: 4.18.1 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: picomatch dependency-version: 2.3.2 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: uuid dependency-version: dependency-type: indirect dependency-group: npm_and_yarn ... Signed-off-by: dependabot[bot] <support@github.com>
dependabot
Bot
added
dependencies
📝 WalkthroughWalkthroughThis PR updates two runtime dependencies in ChangesRuntime Dependency Updates
Poem
🚥 Pre-merge checks | ✅ 2✅ Passed checks (2 passed)
✏️ Tip: You can configure your own custom pre-merge checks in the settings. ✨ Finishing Touches🧪 Generate unit tests (beta)
✨ Simplify code
Comment |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 1
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In `@package.json`:
- Around line 74-76: The package.json dependency lines for "`@actions/core`",
"axios", and "form-data" don't reflect the full set of PR changes and may be out
of sync with package-lock.json: update or regenerate the lockfile and
package.json so the PR description matches reality—ensure package-lock contains
the bumped transitive packages (js-yaml, braces, flatted, follow-redirects,
lodash, picomatch) or remove them from the PR text if they remain only
transitive, confirm that "uuid" is absent from both package.json and
package-lock.json to validate removal, and verify axios@1.16.0 compatibility by
checking the axios changelog for breaking/security/behavioral changes before
committing; if axios introduces install/prepare script changes, ensure those
scripts are visible in package-lock/node_modules/axios metadata or document why
they are not present.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Organization UI
Review profile: CHILL
Plan: Pro Plus
Run ID: 0e78a3d9-1c20-4682-91fc-57b1783868f9
⛔ Files ignored due to path filters (1)
package-lock.jsonis excluded by!**/package-lock.json
📒 Files selected for processing (1)
package.json
Comment on lines
+74
to
76
| "@actions/core": "^1.11.1", | ||
| "axios": "^1.16.0", | ||
| "form-data": "^4.0.0" |
There was a problem hiding this comment.
🧩 Analysis chain
🏁 Script executed:
#!/bin/bash
# Description: Check if package-lock.json contains the packages mentioned in PR objectives
echo "=== Checking for packages mentioned in PR objectives ==="
for pkg in form-data js-yaml braces flatted follow-redirects lodash picomatch uuid; do
echo "--- $pkg ---"
rg -n "\"$pkg\"" package-lock.json | head -5
doneRepository: appcircleio/appcircle-enterprise-app-store-githubaction
Length of output: 794
🏁 Script executed:
#!/bin/bash
set -euo pipefail
echo "=== uuid occurrences in package-lock.json ==="
rg -n "uuid" package-lock.json | head -20 || true
echo
echo "=== axios occurrences in package-lock.json ==="
rg -n "\"axios\"" package-lock.json | head -50
echo
echo "=== `@actions/core` occurrences in package-lock.json ==="
rg -n "\"`@actions/core`\"" package-lock.json | head -50Repository: appcircleio/appcircle-enterprise-app-store-githubaction
Length of output: 319
🏁 Script executed:
#!/bin/bash
set -euo pipefail
echo "=== axios block context in package-lock.json ==="
# Print ~60 lines around the axios version entry
line=$(rg -n "\"axios\": \"\^1\.16\.0\"" package-lock.json | head -1 | cut -d: -f1 || true)
if [ -n "${line:-}" ]; then
start=$((line-30))
end=$((line+80))
sed -n "${start},${end}p" package-lock.json
else
# fallback: show first occurrence of axios
rg -n "\"axios\"" package-lock.json | head -1
fi
echo
echo "=== searching for script-related markers around axios ==="
rg -n "(hasInstallScript|hasShrinkwrap|prepare\"|install\"|preinstall\"|postinstall\"|prepublish|postpublish|scripts)" package-lock.json | head -50Repository: appcircleio/appcircle-enterprise-app-store-githubaction
Length of output: 1989
🏁 Script executed:
#!/bin/bash
set -euo pipefail
echo "=== axios line(s) in package-lock.json ==="
rg -nF '"axios": "^1.16.0"' package-lock.json || true
echo
echo "=== axios block context (bounded) ==="
line=$(rg -nF '"axios": "^1.16.0"' package-lock.json | head -1 | cut -d: -f1 || true)
if [ -n "${line:-}" ]; then
start=$((line-30))
if [ "$start" -lt 1 ]; then start=1; fi
end=$((line+80))
sed -n "${start},${end}p" package-lock.json
fi
echo
echo "=== script-related markers around entire lockfile ==="
rg -n "(hasInstallScript|hasShrinkwrap|\"prepare\"|\"install\"|\"preinstall\"|\"postinstall\"|prepublish|postpublish|\"scripts\")" package-lock.json | head -50 || trueRepository: appcircleio/appcircle-enterprise-app-store-githubaction
Length of output: 3648
🏁 Script executed:
#!/bin/bash
set -euo pipefail
echo "=== uuid occurrences in package-lock.json (case-insensitive) ==="
rg -ni "uuid" package-lock.json | head -20 || trueRepository: appcircleio/appcircle-enterprise-app-store-githubaction
Length of output: 164
🏁 Script executed:
#!/bin/bash
set -euo pipefail
start=3685
end=3725
echo "=== package-lock.json around line 3703 (hasInstallScript) ==="
nl -ba package-lock.json | sed -n "${start},${end}p"Repository: appcircleio/appcircle-enterprise-app-store-githubaction
Length of output: 222
🏁 Script executed:
#!/bin/bash
set -euo pipefail
start=3675
end=3725
echo "=== package-lock.json lines ${start}-${end} (around hasInstallScript) ==="
awk -v s="$start" -v e="$end" 'NR>=s && NR<=e {printf "%d: %s\n", NR, $0}' package-lock.jsonRepository: appcircleio/appcircle-enterprise-app-store-githubaction
Length of output: 2450
🏁 Script executed:
#!/bin/bash
set -euo pipefail
echo "=== node_modules/axios block context ==="
line=$(rg -nF '"node_modules/axios": {' package-lock.json | head -1 | cut -d: -f1 || true)
if [ -n "${line:-}" ]; then
start=$((line-5))
end=$((line+120))
awk -v s="$start" -v e="$end" 'NR>=s && NR<=e {print NR ":" $0}' package-lock.json
else
echo "node_modules/axios block not found"
fi
echo
echo "=== hasInstallScript markers in lockfile near axios ==="
rg -n "hasInstallScript" package-lock.json | head -50
echo
echo "=== versions for mentioned packages in package-lock.json (node_modules/<pkg>) ==="
for pkg in form-data js-yaml braces flatted follow-redirects lodash picomatch axios "`@actions/core`"; do
echo "--- $pkg ---"
rg -nF "\"node_modules/$pkg\": {" package-lock.json | head -3 || true
doneRepository: appcircleio/appcircle-enterprise-app-store-githubaction
Length of output: 6399
Align PR “9 package updates” and “uuid removal” with package.json vs package-lock.json
- package.json (lines 74-76) shows only direct bumps for
@actions/core(^1.11.1) andaxios(^1.16.0); the other PR-listed packages (js-yaml,braces,flatted,follow-redirects,lodash,picomatch) are present inpackage-lock.jsonas transitive dependencies. form-datastays^4.0.0inpackage.json, butpackage-lock.jsonresolves it to4.0.5, matching the PR objective.uuidhas no entries inpackage-lock.json(supports the “removed uuid” claim).axiosis still a large jump (1.7.4 → 1.16.0); verify the axios 1.16.0 changelog for breaking/behavior/security impacts. Also, the “axios modifies install/prepare scripts” claim isn’t reflected in thepackage-lock.jsonnode_modules/axiosblock (no install/prepare/script metadata shown there).
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In `@package.json` around lines 74 - 76, The package.json dependency lines for
"`@actions/core`", "axios", and "form-data" don't reflect the full set of PR
changes and may be out of sync with package-lock.json: update or regenerate the
lockfile and package.json so the PR description matches reality—ensure
package-lock contains the bumped transitive packages (js-yaml, braces, flatted,
follow-redirects, lodash, picomatch) or remove them from the PR text if they
remain only transitive, confirm that "uuid" is absent from both package.json and
package-lock.json to validate removal, and verify axios@1.16.0 compatibility by
checking the axios changelog for breaking/security/behavioral changes before
committing; if axios introduces install/prepare script changes, ensure those
scripts are visible in package-lock/node_modules/axios metadata or document why
they are not present.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Bumps the npm_and_yarn group with 7 updates in the / directory:
1.7.41.16.03.14.13.14.23.0.23.0.33.3.13.4.24.17.214.18.12.3.12.3.28.3.2removedUpdates
axiosfrom 1.7.4 to 1.16.0Release notes
Sourced from axios's releases.
... (truncated)
Changelog
Sourced from axios's changelog.
... (truncated)
Commits
df53d7dchore(release): prepare release 1.16.0 (#10834)9d92bcdfix: gadgets and smaller issues (#10833)5107ee6fix: prevent undefined error codes in settle (#7276)e573499fix(fetch): defer global access in fetch adapter (#7260)ad68e1afix(http): honor timeout during connect without redirects (#10819)2a51828fix(http): decode URL basic auth credentials (#10825)0e8b6bbfix(http): preserve user-supplied Host header when forwarding through a proxy...79f39e1docs: document paramsSerializer.encode for strict RFC 3986 query encoding (#1...0fe3a5f[Docs/Types] UpdateparseReviverTypeScript definitions for ES2023 and add ...cd6737fchore: matches the sibling responseStream.on(aborted) handler and added tests...Maintainer changes
This version was pushed to npm by GitHub Actions, a new releaser for axios since your current version.
Install script changes
This version modifies
preparescript that runs during installation. Review the package contents before updating.Updates
form-datafrom 4.0.0 to 4.0.5Release notes
Sourced from form-data's releases.
... (truncated)
Changelog
Sourced from form-data's changelog.
... (truncated)
Commits
68ff7ddv4.0.55822467[Dev Deps] update@ljharb/eslint-config,eslint76d0dee[Fix] set Symbol.toStringTag in the proper place16e0076[Tests] Switch to newer v8 prediction library; enable node 24 testing41996f5v4.0.4316c82b[meta] actually ensure the readme backup isn’t published2300ca1[meta] fix readme capitalization811f682[meta] addauto-changelog5e34080[Tests] fix linting errors1d11a76[Tests] handle predict-v8-randomness failures in node < 17 and node > 23Maintainer changes
This version was pushed to npm by ljharb, a new releaser for form-data since your current version.
Install script changes
This version modifies
prepublishscript that runs during installation. Review the package contents before updating.Updates
js-yamlfrom 3.14.1 to 3.14.2Changelog
Sourced from js-yaml's changelog.
... (truncated)
Commits
9963d363.14.2 released10d3c8edist rebuild5278870fix prototype pollution in merge (<<) (#731)Updates
bracesfrom 3.0.2 to 3.0.3Commits
74b2db23.0.388f1429update eslint. lint, fix unit tests.415d660Snyk js braces 6838727 (#40)190510ffix tests, skip 1 test in test/braces.expand716eb9freadme bumpa5851e5Merge pull request #37 from coderaiser/fix/vulnerability2092bd1feature: braces: add maxSymbols (https://github.com/micromatch/braces/issues/...9f5b4cffix: vulnerability (https://security.snyk.io/vuln/SNYK-JS-BRACES-6838727)98414f9remove funding file665ab5dupdate keepEscaping doc (#27)Updates
flattedfrom 3.3.1 to 3.4.2Commits
3bf09093.4.2885ddccfix CWE-13210bdba70added flatted-view to the benchmark2a02dce3.4.1fba4e8fMerge pull request #89 from WebReflection/python-fix5fe8648added "when in Rome" also a test for PHP53517adsome minor improvementb3e2a0cFixing recursion issue in Python tooc4b46dbAdd SECURITY.md for security policy and reportingf86d071Create dependabot.yml for version updatesUpdates
follow-redirectsfrom 1.15.6 to 1.16.0Commits
0c23a22Release version 1.16.0 of the npm package.844c4d3Add sensitiveHeaders option.5e8b8d0ci: add Node.js 24.x to the CI matrix7953e22ci: upgrade GitHub Actions to use setup-node@v6 and checkout@v686dc1f8Sanitizing input.21ef28aRelease version 1.15.11 of the npm package.7c88135Roll back tree shaking.6e389baRelease version 1.15.10 of the npm package.5bc496eShake me up before you go-go.694d6b4Bump minimist from 1.2.5 to 1.2.8Updates
lodashfrom 4.17.21 to 4.18.1Release notes
Sourced from lodash's releases.
Commits
cb0b9b9release(patch): bump main to 4.18.1 (#6177)75535f5chore: prune stale advisory refs (#6170)62e91bcdocs: remove n_ Node.js < 6 REPL note from README (#6165)59be2derelease(minor): bump to 4.18.0 (#6161)af63457fix: broken tests for _.template 879aaa91073a76fix: linting issues879aaa9fix: validate imports keys in _.templatefe8d32efix: block prototype pollution in baseUnset via constructor/prototype traversal18ba0a3refactor(fromPairs): use baseAssignValue for consistent assignment (#6153)b819080ci: add dist sync validation workflow (#6137)Updates
picomatchfrom 2.3.1 to 2.3.2Release notes
Sourced from picomatch's releases.
Changelog
Sourced from picomatch's changelog.
... (truncated)
Commits
81cba8dPublish 2.3.2fc1f6b6Merge commit from forkeec17aeMerge commit from fork78f8ca4Merge pull request #156 from micromatch/backport-1443f4f10eMerge pull request #144 from Jason3S/jdent-object-propertiesRemoves
uuidDependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting
@dependabot rebase.Dependabot commands and options
You can trigger Dependabot actions by commenting on this PR:
@dependabot rebasewill rebase this PR@dependabot recreatewill recreate this PR, overwriting any edits that have been made to it@dependabot show <dependency name> ignore conditionswill show all of the ignore conditions of the specified dependency@dependabot ignore <dependency name> major versionwill close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)@dependabot ignore <dependency name> minor versionwill close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)Description has been truncated
Summary by CodeRabbit