Repository navigation
build(deps): Bump the actions group across 1 directory with 3 updates - #512
Closed
dependabot[bot] wants to merge 1 commit into
Closed
dependabot[bot] wants to merge 1 commit into
dependabot[bot] wants to merge 1 commit into
Conversation
Bumps the actions group with 3 updates in the / directory: [actions/checkout](https://github.com/actions/checkout), [actions/dependency-review-action](https://github.com/actions/dependency-review-action) and [googleapis/release-please-action](https://github.com/googleapis/release-please-action). Updates `actions/checkout` from 6 to 7 - [Release notes](https://github.com/actions/checkout/releases) - [Changelog](https://github.com/actions/checkout/blob/main/CHANGELOG.md) - [Commits](actions/checkout@v6...v7) Updates `actions/dependency-review-action` from 4 to 5 - [Release notes](https://github.com/actions/dependency-review-action/releases) - [Commits](actions/dependency-review-action@v4...v5) Updates `googleapis/release-please-action` from 4 to 5 - [Release notes](https://github.com/googleapis/release-please-action/releases) - [Changelog](https://github.com/googleapis/release-please-action/blob/main/CHANGELOG.md) - [Commits](googleapis/release-please-action@v4...v5) --- updated-dependencies: - dependency-name: actions/checkout dependency-version: '7' dependency-type: direct:production update-type: version-update:semver-major dependency-group: actions - dependency-name: actions/dependency-review-action dependency-version: '5' dependency-type: direct:production update-type: version-update:semver-major dependency-group: actions - dependency-name: googleapis/release-please-action dependency-version: '5' dependency-type: direct:production update-type: version-update:semver-major dependency-group: actions ... Signed-off-by: dependabot[bot] <support@github.com>
dependabot
Bot
added
dependencies
|
The latest updates on your projects. Learn more about Vercel for GitHub. |
|
RobertLD
added a commit
that referenced
this pull request
Oct 8, 2026
…alerts (#516) * build(deps): update npm dependencies Includes the Dependabot updates from #514 (minor and patch group), #504 (@xmldom/xmldom, lodash, path-to-regexp) and #502 (TypeScript 6), plus in-range updates of transitive dependencies. node-cron 4.6 ships its own types, so @types/node-cron is removed. * ci: bump actions/checkout to v7, dependency-review-action to v5, release-please-action to v5 From #512. All three only move the action runtime to Node 24. * style: apply Prettier 3.9 formatting and drop assertions TypeScript 6 makes unnecessary * fix(deps): replace @xenova/transformers with @huggingface/transformers @xenova/transformers 2.x is deprecated and pulls protobufjs 6 (critical advisory), sharp 0.32 and an old onnxruntime-web. @huggingface/transformers 4.3.1 brings protobufjs 7.6.6, sharp 0.35.5 and onnxruntime-node 1.30. The local provider loads the same model with dtype q8 (onnx/model_quantized.onnx, the 2.x default), so vectors stay compatible with existing indexes. The model is now cached in ~/.libscope/models. The library default is a folder inside its own package; version 4 fails the model load when it cannot write there (global installs, the non-root user of the Docker image). sharp and onnxruntime-node ship prebuilt binaries, so CI and the Docker image rebuild only better-sqlite3. * fix(deps): drop epub2 and parse EPUB files with pizzip epub2 pulls adm-zip 0.5 (high advisories). The EPUB parser now reads META-INF/container.xml, the OPF package and its spine with pizzip, which the PPTX parser already uses, and extracts chapter text with a linear tag scanner. The output format is unchanged: body text of each spine document in reading order, chapters separated by a blank line. Character references are now decoded. Entries are inflated with a bounded output size, and an EPUB whose content exceeds 100 MiB uncompressed (the indexing.maxDocumentSize default) is refused with a ValidationError. * fix(deps): bump csv-parse to v7 csv-parse < 7.0.2 has a moderate advisory (prototype replacement via columns). Version 7 keeps the csv-parse/sync API that the CSV parser uses. * chore(deps): ignore undici major updates in Dependabot undici 8 requires Node.js >= 22.19, and libscope supports Node.js 20.
Contributor
Author
|
Looks like these dependencies are updatable in another way, so this is no longer needed. |
dependabot
Bot
deleted the
dependabot/github_actions/development/actions-862af04ad9
branch
October 8, 2026 19:08
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Bumps the actions group with 3 updates in the / directory: actions/checkout, actions/dependency-review-action and googleapis/release-please-action.
Updates
actions/checkoutfrom 6 to 7Release notes
Sourced from actions/checkout's releases.
Changelog
Sourced from actions/checkout's changelog.
... (truncated)
Commits
9c091bbupdate error wording (#2467)1044a6dgetting ready for checkout v7 release (#2464)f028218Bump the minor-npm-dependencies group across 1 directory with 3 updates (#2462)d914b26upgrade module to esm and update dependencies (#2463)537c7efBump@actions/coreand@actions/tool-cacheand Remove uuid (#2459)130a169Bump js-yaml from 4.1.0 to 4.2.0 (#2461)7d09575Bump flatted from 3.3.1 to 3.4.2 (#2460)0f9f3aaBump actions/publish-immutable-action (#2458)f9e715ablock checking out fork pr for pull_request_target and workflow_run (#2454)Updates
actions/dependency-review-actionfrom 4 to 5Release notes
Sourced from actions/dependency-review-action's releases.
... (truncated)
Commits
a1d282bMerge pull request #1098 from actions/ahpook/v5-releaseeb6c199update examples to show@v53943c2cv5.0.0 release branch454943cMerge pull request #1094 from actions/ashelytc/security-findings6d92a12revert@typescript-eslint/parserupdatea8e5a7eMerge pull request #1076 from tspascoal/fix-version-matching-for-non-string-s...b6b7079update@typescript-eslint/parserto 8.40.0821a21dupdate more dependencies05aaaaerun npm audit fix55d3e75Merge pull request #1077 from Marukome0743/docs/checkoutUpdates
googleapis/release-please-actionfrom 4 to 5Release notes
Sourced from googleapis/release-please-action's releases.
... (truncated)
Changelog
Sourced from googleapis/release-please-action's changelog.
... (truncated)
Commits
45996edchore(main): release 5.0.0 (#1200)a8121b9chore: build dist (#1201)f533c26fix: bump release-please from 17.3.0 to 17.6.0 (#1199)46dfc01feat!: upgrade to node24 (#1188)Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting
@dependabot rebase.Dependabot commands and options
You can trigger Dependabot actions by commenting on this PR:
@dependabot rebasewill rebase this PR@dependabot recreatewill recreate this PR, overwriting any edits that have been made to it@dependabot show <dependency name> ignore conditionswill show all of the ignore conditions of the specified dependency@dependabot ignore <dependency name> major versionwill close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)@dependabot ignore <dependency name> minor versionwill close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)@dependabot ignore <dependency name>will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)@dependabot unignore <dependency name>will remove all of the ignore conditions of the specified dependency@dependabot unignore <dependency name> <ignore condition>will remove the ignore condition of the specified dependency and ignore conditions