Dependency Dashboard

[bfra-me]

This issue lists Renovate updates and detected dependencies. Read the Dependency Dashboard docs to learn more.

Repository Problems

Renovate tried to run on this repository, but found these problems.

• ⚠️ WARN: Package lookup failures
• ⚠️ WARN: Error updating branch: update failure

Deprecations / Replacements

Warning

The following dependencies are either deprecated or have replacements available.

Datasource	Package	Replacement PR?
npm	@svitejs/changesets-changelog-github-compact

Abandoned Dependencies

The following dependencies have not received updates for an extended period and may be unmaintained.

View abandoned dependencies (6)

[!NOTE]
Packages are marked as abandoned when they exceed the abandonmentThreshold since their last release. Unlike deprecated packages with official notices, abandonment is detected by release inactivity.

Datasource	Package	Last Updated
npm	husky	2024-11-18
npm	mdast-util-to-string	2023-07-07
npm	remark	2023-09-18
npm	remark-parse	2023-09-18
npm	remark-stringify	2023-09-18
npm	unified	2024-06-19

Pending Approval

The following branches are pending approval. To create them, click on a checkbox below.

• chore(deps): update actions/checkout action to v7
• chore(deps): update actions/dependency-review-action action to v5
• chore(dev): update dependency lint-staged to v17
• fix(deps): update dependency js-yaml to v5
• 🔐 Create all pending approval PRs at once 🔐

Awaiting Schedule

The following updates are awaiting their schedule. To get an update now, click on a checkbox below.

• chore(dev): update dependency @types/node to v24.13.2
• chore(deps): maintain lockfiles
• 🔐 Create all awaiting schedule PRs at once 🔐

Errored

The following updates encountered an error and will be retried. To force a retry now, click on a checkbox below.

• chore(deps): update fro-bot/agent to v1

Pending Status Checks

The following updates await pending status checks. To force their creation now, click on a checkbox below.

• chore(deps): update dependency js-yaml to v4.3.0
• chore(dev): update dependency eslint to v10.6.0
• chore(dev): update dependency prettier to v3.9.1

---

Warning

Renovate failed to look up the following dependencies: Failed to look up github-tags package aquasecurity/trivy-action: no-result.

Files affected: .github/workflows/container-scan.yaml

---

Open

The following updates have all been created. To force a retry/rebase of any, click on a checkbox below.

• chore(deps): update pnpm to v11 [SECURITY]

Vulnerabilities

Important

1/1 CVEs have Renovate fixes.

npm

package.json

pnpm

• GHSA-gj8w-mvpf-x27x (fixed in >= 11.5.3)

Detected Dependencies

github-actions (22)

.github/workflows/auto-release.yaml (5)

• actions/create-github-app-token v3.2.0@bcd2ba49218906704ab6c1aa796996da409d3eb1
• actions/checkout v6.0.3@df4cb1c069e1874edd31b4311f1884172cec0e10 → [Updates: v7.0.0]
• pnpm/action-setup v6.0.9@0ebf47130e4866e96fce0953f49152a61190b271
• actions/setup-node v6.4.0@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e
• changesets/action v1.9.0@a45c4d594aa4e2c509dc14a9f2b3b67ba3780d0d

.github/workflows/codeql-analysis.yaml (4)

• actions/checkout v6.0.3@df4cb1c069e1874edd31b4311f1884172cec0e10 → [Updates: v7.0.0]
• github/codeql-action v4.36.2@8aad20d150bbac5944a9f9d289da16a4b0d87c1e
• github/codeql-action v4.36.2@8aad20d150bbac5944a9f9d289da16a4b0d87c1e
• github/codeql-action v4.36.2@8aad20d150bbac5944a9f9d289da16a4b0d87c1e

.github/workflows/container-scan.yaml (4)

• actions/checkout v6.0.3@df4cb1c069e1874edd31b4311f1884172cec0e10 → [Updates: v7.0.0]
• dorny/paths-filter v4.0.1@fbd0ab8f3e69293af611ebaee6363fc25e6d187d
• aquasecurity/trivy-action 0.35.0@57a97c7e7821a5776cebc9bb87c984fa69cba8f1
• github/codeql-action v4.36.2@8aad20d150bbac5944a9f9d289da16a4b0d87c1e

.github/workflows/copilot-setup-steps.yaml (3)

• actions/checkout v6.0.3@df4cb1c069e1874edd31b4311f1884172cec0e10 → [Updates: v7.0.0]
• pnpm/action-setup v6.0.9@0ebf47130e4866e96fce0953f49152a61190b271
• actions/setup-node v6.4.0@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e

.github/workflows/dependency-review.yaml (2)

• actions/checkout v6.0.3@df4cb1c069e1874edd31b4311f1884172cec0e10 → [Updates: v7.0.0]
• actions/dependency-review-action v4.9.0@2031cfc080254a8a887f58cffee85186f0e49e48 → [Updates: v5.0.0]

.github/workflows/fro-bot.yaml (4)

• actions/checkout v6.0.3@df4cb1c069e1874edd31b4311f1884172cec0e10 → [Updates: v7.0.0]
• pnpm/action-setup v6.0.9@0ebf47130e4866e96fce0953f49152a61190b271
• actions/setup-node v6.4.0@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e
• fro-bot/agent v0.79.1@720b72169446b01bbc4042834ab948d4e3cef8d0 → [Updates: 1.17.11+harness.bf0e9bed]

.github/workflows/license-compliance.yaml (2)

• actions/checkout v6.0.3@df4cb1c069e1874edd31b4311f1884172cec0e10 → [Updates: v7.0.0]
• fossas/fossa-action v1.9.0@ff70fe9fe17cbd2040648f1c45e8ec4e4884dcf3

.github/workflows/main.yaml (8)

• actions/checkout v6.0.3@df4cb1c069e1874edd31b4311f1884172cec0e10 → [Updates: v7.0.0]
• pnpm/action-setup v6.0.9@0ebf47130e4866e96fce0953f49152a61190b271
• actions/setup-node v6.4.0@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e
• actions/create-github-app-token v3.2.0@bcd2ba49218906704ab6c1aa796996da409d3eb1
• actions/checkout v6.0.3@df4cb1c069e1874edd31b4311f1884172cec0e10 → [Updates: v7.0.0]
• pnpm/action-setup v6.0.9@0ebf47130e4866e96fce0953f49152a61190b271
• actions/setup-node v6.4.0@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e
• changesets/action v1.9.0@a45c4d594aa4e2c509dc14a9f2b3b67ba3780d0d

.github/workflows/pr-triage.yaml (4)

• actions/create-github-app-token v3.2.0@bcd2ba49218906704ab6c1aa796996da409d3eb1
• actions/checkout v6.0.3@df4cb1c069e1874edd31b4311f1884172cec0e10 → [Updates: v7.0.0]
• actions/labeler v6.1.0@f27b608878404679385c85cfa523b85ccb86e213
• kentaro-m/auto-assign-action v2.0.2@0a2c53d3721e4c5cfcce6afd4014aecc337979f6

.github/workflows/renovate-changeset.yaml (3)

• actions/create-github-app-token v3.2.0@bcd2ba49218906704ab6c1aa796996da409d3eb1
• actions/checkout v6.0.3@df4cb1c069e1874edd31b4311f1884172cec0e10 → [Updates: v7.0.0]
• actions/checkout v6.0.3@df4cb1c069e1874edd31b4311f1884172cec0e10 → [Updates: v7.0.0]

.github/workflows/renovate.yaml (4)

• actions/checkout v6.0.3@df4cb1c069e1874edd31b4311f1884172cec0e10 → [Updates: v7.0.0]
• actions/create-github-app-token v3.2.0@bcd2ba49218906704ab6c1aa796996da409d3eb1
• dorny/paths-filter v4.0.1@fbd0ab8f3e69293af611ebaee6363fc25e6d187d
• bfra-me/renovate-action 9.128.0@ab9e22461bbbf9707645a75a2f8ffc2d5bbf402f

.github/workflows/scorecard.yaml (4)

• actions/checkout v6.0.3@df4cb1c069e1874edd31b4311f1884172cec0e10 → [Updates: v7.0.0]
• ossf/scorecard-action v2.4.3@4eaacf0543bb3f2c246792bd56e8cdeffafb205a
• actions/upload-artifact v7.0.1@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a
• github/codeql-action v4.36.2@8aad20d150bbac5944a9f9d289da16a4b0d87c1e

.github/workflows/secret-scan.yaml (1)

• actions/checkout v6.0.3@df4cb1c069e1874edd31b4311f1884172cec0e10 → [Updates: v7.0.0]

.github/workflows/trigger-org-renovate.yaml (1)

• actions/create-github-app-token v3.2.0@bcd2ba49218906704ab6c1aa796996da409d3eb1

.github/workflows/update-metadata.yaml (5)

• actions/create-github-app-token v3.2.0@bcd2ba49218906704ab6c1aa796996da409d3eb1
• actions/checkout v6.0.3@df4cb1c069e1874edd31b4311f1884172cec0e10 → [Updates: v7.0.0]
• pnpm/action-setup v6.0.9@0ebf47130e4866e96fce0953f49152a61190b271
• actions/setup-node v6.4.0@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e
• peter-evans/create-pull-request v8.1.1@5f6978faf089d4d20b00c7766989d076bb2fc7f1

.github/workflows/update-repo-settings.yaml (4)

• actions/checkout v6.0.3@df4cb1c069e1874edd31b4311f1884172cec0e10 → [Updates: v7.0.0]
• dorny/paths-filter v4.0.1@fbd0ab8f3e69293af611ebaee6363fc25e6d187d
• actions/create-github-app-token v3.2.0@bcd2ba49218906704ab6c1aa796996da409d3eb1
• actions/checkout v6.0.3@df4cb1c069e1874edd31b4311f1884172cec0e10 → [Updates: v7.0.0]

workflow-templates/codeql-analysis.yaml (3)

• actions/checkout v6.0.3@df4cb1c069e1874edd31b4311f1884172cec0e10 → [Updates: v7.0.0]
• github/codeql-action v4.36.2@8aad20d150bbac5944a9f9d289da16a4b0d87c1e
• github/codeql-action v4.36.2@8aad20d150bbac5944a9f9d289da16a4b0d87c1e

workflow-templates/dependency-review.yaml (2)

• actions/checkout v6.0.3@df4cb1c069e1874edd31b4311f1884172cec0e10 → [Updates: v7.0.0]
• actions/dependency-review-action v4.9.0@2031cfc080254a8a887f58cffee85186f0e49e48 → [Updates: v5.0.0]

workflow-templates/renovate-changesets.yaml (1)

• bfra-me/.github v4.16.31@7c7e50a51f430b42aae2165e5d555847aa738ba9

workflow-templates/renovate.yaml (1)

• bfra-me/.github v4.16.31@7c7e50a51f430b42aae2165e5d555847aa738ba9

workflow-templates/scorecard.yaml (4)

• actions/checkout v6.0.3@df4cb1c069e1874edd31b4311f1884172cec0e10 → [Updates: v7.0.0]
• ossf/scorecard-action v2.4.3@4eaacf0543bb3f2c246792bd56e8cdeffafb205a
• actions/upload-artifact v7.0.1@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a
• github/codeql-action v4.36.2@8aad20d150bbac5944a9f9d289da16a4b0d87c1e

workflow-templates/update-repo-settings.yaml (1)

• bfra-me/.github v4.16.31@7c7e50a51f430b42aae2165e5d555847aa738ba9

nodenv (1)

.node-version (1)

• node 24.18.0

npm (5)

.github/actions/renovate-changesets/package.json (12)

• @actions/core ^3.0.0
• @actions/exec ^3.0.0
• @actions/github ^9.0.0
• @changesets/parse ^0.4.0
• @changesets/write ^0.4.0
• @octokit/rest ^22.0.0
• js-yaml ^4.1.0 → [Updates: ^4.1.0, ^5.0.0]
• minimatch 10.2.5
• @types/js-yaml 4.0.9
• @types/node 24.12.4 → [Updates: 24.13.2]
• tsup 8.5.1
• node >=24

.github/actions/update-metadata/package.json (7)

• @actions/core ^3.0.0
• @octokit/rest ^22.0.0
• js-yaml ^4.1.0 → [Updates: ^4.1.0, ^5.0.0]
• @types/js-yaml 4.0.9
• @types/node 24.12.4 → [Updates: 24.13.2]
• tsup 8.5.1
• node >=24

.github/actions/update-repository-settings/package.json (8)

• @actions/core ^3.0.0
• @actions/github ^9.0.0
• @octokit/rest ^22.0.0
• js-yaml ^4.1.0 → [Updates: ^4.1.0, ^5.0.0]
• @types/js-yaml 4.0.9
• @types/node 24.12.4 → [Updates: 24.13.2]
• tsup 8.5.1
• node >=24

package.json (30)

• @bfra.me/eslint-config 0.51.1
• @bfra.me/prettier-config 0.16.9
• @bfra.me/tsconfig 0.13.1
• @changesets/cli 2.31.0
• @changesets/config 3.1.4
• @changesets/should-skip-package 0.1.2
• @changesets/types 6.1.0
• @manypkg/cli 0.25.1
• @manypkg/get-packages 3.1.0
• @svitejs/changesets-changelog-github-compact 1.2.0
• @types/node 24.12.4 → [Updates: 24.13.2]
• @vitest/coverage-v8 4.1.9
• eslint 10.5.0 → [Updates: 10.6.0]
• eslint-config-prettier 10.1.8
• eslint-plugin-prettier 5.5.6
• glob 13.0.6
• husky 9.1.7
• jiti 2.7.0
• lint-staged 16.4.0 → [Updates: 17.0.8]
• mdast-util-to-string 4.0.0
• prettier 3.8.4 → [Updates: 3.9.1]
• remark 15.0.1
• remark-parse 11.0.0
• remark-stringify 11.0.0
• tsx 4.22.4
• typescript 6.0.3
• unified 11.0.5
• vite 8.1.0
• vitest 4.1.9
• pnpm 10.34.4 → [Updates: 11.5.3]

pnpm-workspace.yaml (4)

• esbuild@>=0.17.0 <0.28.1 >=0.28.1
• flatted 3.4.2
• undici@<6.27.0 >=6.27.0
• vite@>=8.0.0 <=8.0.4 >=8.0.5

renovate-config (1)

.github/renovate.json5

---

• Check here to trigger a Renovate run on this repository

[marcusrbrown]

With the release of bfra-me/renovate-config@v1.9.3, this issue is titled Renovate Dashboard (#16).

[fro-bot]

Investigation Complete: [Updates: undefined] Root Cause Identified

Summary

The undefined version detection for bfra-me/.github dependencies is caused by ineffective Renovate configuration. The fix has been prepared locally.

Root Cause Analysis

1. Package Name Mismatch

   • The existing matchPackageNames patterns use full paths: bfra-me/.github/.github/actions/renovate-changesets
   • Renovate's github-actions manager normalizes package names to owner/repo format only
   • The full path patterns never matched any dependencies

2. Unsupported Version Extraction

   • The extractVersion patterns expect tags like renovate-changesets@0.2.15
   • But the actual workflow references use SHA pinning: @2c3d82d... # renovate-changesets@0.2.15
   • Renovate cannot extract version from SHA references or parse the @ separator in comments

Evidence from Renovate Source Code

From lib/modules/manager/github-actions/extract.ts:

const packageName = \`\${owner}/\${repo}\`;
const depName = \`\${registryUrl}\${packageName}\`;

The path component (.github/actions/renovate-changesets) is stored separately and not used for package matching.

Fix Prepared

{
  description: 'Disable updates for self-referential actions within the bfra-me/.github repository...',
  matchPackageNames: ['bfra-me/.github'],
  enabled: false,
}

This replaces the two ineffective package rules with a single rule that:

1. Uses correct package name: bfra-me/.github (how Renovate detects it)
2. Disables updates: Self-referential actions should be managed through the release process, not Renovate

Status

• ✅ Fix prepared in local working directory (.github/renovate.json5)
• ⏳ Awaiting manual commit by someone with push access
• ✅ Detailed analysis posted on PR #1710

Recommendations

1. Commit the fix to prevent future incorrect PRs
2. Consider updating workflow templates to use semantic version tags (@v3, @v4) instead of SHA pinning for external consumers
3. For internal workflows, continueusing SHA pinning with version comments for security