chore(deps): update rubygems/configure-rubygems-credentials action to v2.1.0 by renovate[bot] · Pull Request #30 · wave-av/sdks

renovate · 2026-06-27T20:13:14Z

This PR contains the following updates:

Package	Type	Update	Change
rubygems/configure-rubygems-credentials	action	minor	`v2.0.0` → `v2.1.0`

Warning

Some dependencies could not be looked up. Check the warning logs for more information.

Release Notes

rubygems/configure-rubygems-credentials (rubygems/configure-rubygems-credentials)

`v2.1.0`

Compare Source

This release switches the action runtime from Node 20 to Node 24. The node24 declaration in action.yml removes the deprecation warning that every consumer — most visibly through rubygems/release-gem — has seen since GitHub announced the Node 20 deprecation, and gets ahead of runners switching JavaScript actions to Node 24 by default on June 16, 2026.

Note for self-hosted runners: the node24 runtime requires actions/runner 2.327.1 or later. GitHub-hosted runners are unaffected.

The pending major dependency updates are included as well: zod 4, @actions/core 3, and @actions/http-client 4. The actions toolkit majors ship only ES module builds now, so the build pipeline emits ES modules internally, while the bundled dist/index.js the runner executes remains CommonJS. The action's inputs, outputs, and behavior are unchanged.

Thanks to @dduugg for first proposing the runtime switch in #413.

What's Changed

Clean up stale development configuration by @hsbt in #420
Switch to Node 24 and adopt pending major dependency updates by @hsbt in #421

Full Changelog: rubygems/configure-rubygems-credentials@v2.0.0...v2.1.0

Configuration

📅 Schedule: (UTC)

Branch creation
- At any time (no schedule defined)
Automerge
- At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

If you want to rebase/retry this PR, check this box

This PR was generated by Mend Renovate. View the repository job log.

greptile-apps · 2026-06-27T20:13:18Z

PR author is in the excluded authors list.

changeset-bot · 2026-06-27T20:13:18Z

⚠️ No Changeset found

Latest commit: 1ab6820

Merging this PR will not cause a version bump for any packages. If these changes should not result in a new version, you're good to go. If these changes should result in a version bump, you need to add a changeset.

Click here to learn what changesets are, and how to add one.

Click here if you're a maintainer who wants to add a changeset to this PR

wave-bugbot · 2026-08-12T23:23:14Z

🌊 WAVE BugBot — 6 finding(s)

🔴 5 · 🟡 1

🔴 P0 .github/workflows/publish-rubygems.yml:63 CWE-863 — Unpinned action tag
The action tag is pinned to a specific commit SHA rather than using the latest version tag (@v2.1.0). This can lead to security vulnerabilities if the commit is
🔴 P0 .github/workflows/publish-rubygems.yml:63 CWE-276 — Unpinned action tag with overbroad permissions
The action tag specifies id-token: write, which grants broad permissions that could be exploited if the action is compromised. It's recommended to use a speci
🔴 P0 .github/workflows/publish-rubygems.yml:63 CWE-78 — Potential injection risk in action usage
The action tag is being interpolated into the YAML file. If this value comes from an untrusted source, it could lead to command injection vulnerabilities.
🔴 P0 .github/workflows/publish-rubygems.yml:63 CWE-798 — Potential secret leakage in action usage
The action tag is being interpolated into the YAML file. If this value comes from an untrusted source, it could lead to secret leakage vulnerabilities.
🔴 P0 .github/workflows/publish-rubygems.yml:63 CWE-269 — Potential security authorization issue with action usage
The action tag is being interpolated into the YAML file. If this value comes from an untrusted source, it could lead to security authorization vulnerabilities.
🟡 P2 .github/workflows/publish-rubygems.yml:63 CWE-617 — Potential correctness issue with action usage
The action tag is being interpolated into the YAML file. If this value comes from an untrusted source, it could lead to incorrect behavior or errors.

_{severity: critical · major · minor · info — local review · $0 inference · wave-dispatch · react 👍/👎 to tune}

devin-ai-integration

Devin Review found 1 potential issue.

macroscopeapp · 2026-08-14T17:31:01Z

Approvability

Verdict: Needs human review

Dependency update to rubygems/configure-rubygems-credentials v2.1.0. The file is owned by wave-av/sdk-owners (not the author), and there's an unresolved comment noting the SHA↔tag mapping should be verified before merging since this workflow runs only during releases.

No code changes detected at 15b9ad2. Prior analysis still applies.

^{You can customize Macroscope's approvability policy. Learn more.}

…mber space Review found a SECOND concurrency collision, on a different axis from the one this template already documents (wave-pen#386). `issue_comment` fires for ISSUES as well as PRs, and GitHub draws both from ONE number sequence. So a comment on Issue #30 and a `/review` on PR #30 entered the same concurrency group. Concurrency is evaluated at WORKFLOW level, BEFORE the job-level `if:` runs — so the Issue comment cancelled the PR review already in flight, and was then skipped itself, having done nothing. That is the identical shape as the #386 defect the block above exists to fix, one axis over: a run that will not review taking the lane from the run that would have. #386 separated the two EVENTS; it did not separate the two number spaces inside one event. pull_request PR 433 -> pr-agent-pull_request-pr-433 issue_comment on PR 30 -> pr-agent-issue_comment-pr-30 issue_comment on ISSUE 30 -> pr-agent-issue_comment-issue-30 The last two used to be one group. actionlint and zizmor clean. Upstream: wave-av/wave-foundation-public#73. Refs wave-pen#418, wave-pen#417. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

codeant-ai · 2026-08-27T00:47:37Z

Your free trial PR review limit of 300 PRs has been reached. Please upgrade your plan to continue using CodeAnt AI.

codeant-ai · 2026-09-03T17:34:51Z

Your free trial PR review limit of 300 PRs has been reached. Please upgrade your plan to continue using CodeAnt AI.

… v2.1.0

codeant-ai · 2026-09-07T23:30:08Z

Skipping PR review because a bot author is detected.

If you want to trigger CodeAnt AI, comment @codeant-ai review to trigger a manual review.

renovate Bot force-pushed the renovate/rubygems-configure-rubygems-credentials-2.x branch 4 times, most recently from 2f169c7 to 3b2d146 Compare July 22, 2026 05:14

renovate Bot force-pushed the renovate/rubygems-configure-rubygems-credentials-2.x branch 2 times, most recently from 3caf4ba to 1ab6820 Compare August 1, 2026 03:53

renovate Bot force-pushed the renovate/rubygems-configure-rubygems-credentials-2.x branch from 1ab6820 to a119d06 Compare August 14, 2026 17:25

devin-ai-integration Bot reviewed Aug 14, 2026

View reviewed changes

Comment thread .github/workflows/publish-rubygems.yml

yakimoto mentioned this pull request Aug 24, 2026

fix(pr-agent): discriminate the concurrency group by event and by pr/issue #66

Closed

renovate Bot force-pushed the renovate/rubygems-configure-rubygems-credentials-2.x branch from a119d06 to 4179144 Compare August 27, 2026 00:47

renovate Bot force-pushed the renovate/rubygems-configure-rubygems-credentials-2.x branch from 4179144 to 0825b63 Compare September 3, 2026 17:34

chore(deps): update rubygems/configure-rubygems-credentials action to…

15b9ad2

… v2.1.0

renovate Bot force-pushed the renovate/rubygems-configure-rubygems-credentials-2.x branch from 0825b63 to 15b9ad2 Compare September 7, 2026 23:30

Navigation Menu

Uh oh!

chore(deps): update rubygems/configure-rubygems-credentials action to v2.1.0 - #30

chore(deps): update rubygems/configure-rubygems-credentials action to v2.1.0#30
renovate[bot] wants to merge 1 commit into
mainfrom
renovate/rubygems-configure-rubygems-credentials-2.x

renovate Bot commented Jun 27, 2026 •

edited

Loading

Uh oh!

greptile-apps Bot commented Jun 27, 2026

Uh oh!

changeset-bot Bot commented Jun 27, 2026 •

edited

Loading

Uh oh!

wave-bugbot Bot commented Aug 12, 2026

Uh oh!

devin-ai-integration Bot left a comment

Uh oh!

Uh oh!

macroscopeapp Bot commented Aug 14, 2026 •

edited

Loading

Uh oh!

codeant-ai Bot commented Aug 27, 2026

Uh oh!

codeant-ai Bot commented Sep 3, 2026

Uh oh!

codeant-ai Bot commented Sep 7, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

Uh oh!

Conversation

renovate Bot commented Jun 27, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Release Notes

v2.1.0

What's Changed

Configuration

Uh oh!

greptile-apps Bot commented Jun 27, 2026

Uh oh!

changeset-bot Bot commented Jun 27, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

⚠️ No Changeset found

Uh oh!

wave-bugbot Bot commented Aug 12, 2026

🌊 WAVE BugBot — 6 finding(s)

Uh oh!

devin-ai-integration Bot left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

macroscopeapp Bot commented Aug 14, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Approvability

Uh oh!

codeant-ai Bot commented Aug 27, 2026

Uh oh!

codeant-ai Bot commented Sep 3, 2026

Uh oh!

codeant-ai Bot commented Sep 7, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

renovate Bot commented Jun 27, 2026 •

edited

Loading

`v2.1.0`

changeset-bot Bot commented Jun 27, 2026 •

edited

Loading

macroscopeapp Bot commented Aug 14, 2026 •

edited

Loading