Repository navigation
build(deps): consolidate all pending Dependabot updates - #68784
Conversation
Apply all 14 open dependency updates across Go, setup JavaScript, documentation, and github/stale-repos. Keep the workflow source, generated manifest, and embedded action pins in sync. Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
There was a problem hiding this comment.
Note
Copilot was unable to run its full agentic suite in this review.
Copilot review overview
0 open findings
What changed in this PR
Updates pinned GitHub Actions and bumps Go/Node dependencies across the repo to newer patch/minor versions.
Changes:
- Bump
github/stale-reposfromv9.0.19tov9.1.1and propagate the new SHA across action pin/lock files and the workflow. - Upgrade Go module dependencies (Charm TUI libs +
golang.org/x/*) and refreshgo.sum. - Update docs and action JS tooling dependencies (Astro/Starlight/Playwright,
@actions/artifact,ts-json-schema-generator,vite).
| File | Description |
|---|---|
| pkg/workflow/data/action_pins.json | Updates pinned github/stale-repos version+SHA used by workflow tooling. |
| pkg/actionpins/data/action_pins.json | Mirrors the github/stale-repos pin update in the actionpins package. |
| .github/aw/actions-lock.json | Updates the centralized action lock entry for github/stale-repos. |
| .github/workflows/stale-repo-identifier.md | Bumps the workflow to use github/stale-repos@v9.1.1. |
| .github/workflows/stale-repo-identifier.lock.yml | Refreshes the generated lock to the new pinned action SHA/version. |
| go.mod | Bumps Go dependencies to newer versions. |
| go.sum | Updates checksums for the bumped Go dependencies. |
| docs/package.json | Updates documentation site dependencies (Astro/Starlight/Playwright, validator). |
| actions/setup/js/package.json | Updates JS action dev tooling dependencies (artifact, schema generator, vite). |
Files not reviewed (2)
- actions/setup/js/package-lock.json: Generated file
- docs/package-lock.json: Generated file
🧠 Review effort: Lite
💡 Add a code-review agent skill for context-aware, tailored reviews. Learn more in the docs.
|
🧠 Matt Pocock Skills Reviewer has completed the skills-based review. ✅ Matt Pocock Skills ReviewerOutcome: The agent completed and reported no action. A no-op output alone does not verify that all required work was completed or that publication was possible. Agent messages are omitted from this comment. The category uses structured run status, not interpretation of agent prose.
|
|
✅ Design Decision Gate 🏗️ completed the design decision gate check. See the comment below for the result and any generated ADR draft. Design Decision Gate 🏗️Outcome: The agent completed and reported no action. A no-op output alone does not verify that all required work was completed or that publication was possible. Agent messages are omitted from this comment. The category uses structured run status, not interpretation of agent prose.
|
|
✅ Ponytail Reviewer completed successfully! Ponytail ReviewerOutcome: The agent completed and reported no action. A no-op output alone does not verify that all required work was completed or that publication was possible. Agent messages are omitted from this comment. The category uses structured run status, not interpretation of agent prose.
|
|
✅ PR Code Quality Reviewer completed the code quality review. PR Code Quality ReviewerOutcome: The agent completed and reported no action. A no-op output alone does not verify that all required work was completed or that publication was possible. Agent messages are omitted from this comment. The category uses structured run status, not interpretation of agent prose.
|
|
✅ Test Quality Sentinel completed test quality analysis. Test Quality SentinelOutcome: The agent completed and reported no action. A no-op output alone does not verify that all required work was completed or that publication was possible. Agent messages are omitted from this comment. The category uses structured run status, not interpretation of agent prose.
|
Visual Regression Check
Every request to `(host.docker.internal/redacted) returned 403 Forbidden from the sandbox proxy. The screenshots show that error page, not the docs, so no visual comparison or accessibility audit was possible. The docs host is probably missing from the browser proxy allowlist. Warning Firewall blocked 1 domainThe following domain was blocked by the firewall during workflow execution:
To allow these domains, add them to the network:
allowed:
- defaults
- "host.docker.internal"See Network Configuration for more information.
|
Comment MemoryPeek at saved memory (pr-code-quality-reviewer)Note This comment is managed by comment memory.Expand the saved memory block to view or edit the persistent context for this thread.
|
![github-actions[bot]](https://avatars.githubusercontent.com/in/15368?s=60&v=4){kind=small}
There was a problem hiding this comment.
Request changes
This dependency rollup still introduces known install breakages on the repository's supported npm path, so it is not ready to merge.
Blocking themes
actions/setup/js: thevite@8.3.4bump is already known to failnpm cithrough the approved proxy/fallback path.docs: the Astro/Starlight bump now resolveszod@4.6.6, which the PR body also documents as unavailable on that same path.
A dependency-consolidation PR should not merge while make deps-js and make deps-docs remain knowingly broken; please keep installable versions or land the registry/remediation change in the same PR with passing npm ci evidence.
🔎 Code quality review by PR Code Quality Reviewer · copilot · gpt54 · 66.5 AIC · ⌖ 6.18 AIC · ⊞ 21.3K
Comment /review to run again
| "@astrojs/starlight": "^0.42.6", | ||
| "@primer/octicons": "^19.38.0", | ||
| "astro": "^7.3.5", | ||
| "astro": "^7.3.8", |
There was a problem hiding this comment.
These docs bumps are still blocked because they resolve zod@4.6.6, which your validation notes returns 404 on the approved registry path, so make deps-docs becomes unreproducible after merge.
💡 Why this blocks the PR
This change is landing with a known install failure, not just missing extra validation: docs/package-lock.json now contains node_modules/zod@4.6.6, and the PR body says that tarball cannot be fetched through the required proxy/fallback path. Since deps-docs runs npm ci under docs/, every docs build and bootstrap stays broken until the dependency is backed out or the registry path is fixed in the same change.
Please hold the Astro/Starlight bump to versions that install through the supported registry path, or include the registry fix and passing npm ci evidence here.
| "ts-json-schema-generator": "2.9.0", | ||
| "typescript": "^7.0.2", | ||
| "vite": "8.3.1", | ||
| "vite": "8.3.4", |
There was a problem hiding this comment.
Upgrading to vite@8.3.4 is not safe to merge yet because the repo's supported npm path already returns 404 for that tarball, so npm ci and every target that depends on actions/setup/js stays broken.
💡 Why this blocks the PR
The PR description already says the approved Microsoft proxy plus the 1ES fallback cannot fetch vite@8.3.4. That means this is not just an unverified update: make deps-js, the CI preflight that runs npm ci in actions/setup/js, and any contributor bootstrap on the supported registry path all fail after merge.
Please either keep vite on the last installable version or land the registry/remediation change in the same PR with a successful npm ci run.
"vite": "8.3.1"
Summary
Consolidates all 14 open Dependabot PRs into one dependency update, preserving their requested versions and npm integrity hashes.
charm.land/bubbletea/v22.1.0;golang.org/x/tools0.52.0;x/term0.47.0;x/sync0.24.0;x/mod0.42.0, plus required transitive updates@actions/artifact6.3.1;ts-json-schema-generator2.9.0;vite8.3.4astro7.3.8;@astrojs/starlight0.42.6;@astrojs/markdown-remark7.3.2 (dependency and override);starlight-links-validator0.27.0;@playwright/test1.64.0github/stale-repos9.1.1, with the workflow Markdown source, regenerated lockfile metadata, action cache, and both embedded pin files updated togetherIncludes updates from #68753, #68754, #68755, #68756, #68757, #68758, #68759, #68762, #68763, #68764, #68765, #68766, #68767, and #68770. The overlapping Go updates are combined without downgrading dependencies. The original Dependabot PRs are left open.
Validation
Passed:
make buildgo mod verifygo mod tidy -diff(no changes required)make recompile: all 344 workflows compiled successfully; unrelated generated downgrades were excluded from this PR../gh-aw compile stale-repo-identifier --validate --no-emit --no-check-update --schedule-seed github/gh-awgit diff --checkgithub/stale-reposv9.1.1 tag resolves to07243c72d78533a27c0e37a93bfa87275fca4aa1.Not fully validated; kept in draft:
npm cicannot complete because the configured Microsoft npm proxy and approved 1ES fallback return HTTP 404 for requested tarballs, includingvite@8.3.4. The docs installation also encounters a 404 forzod@4.6.6. Metadata queries for@astrojs/starlight@0.42.6fail as well. No dependency versions or registry URLs were changed to work around this.make agent-report-progressstops because pinned Prettier is unavailable after the blocked install.make test-unitskips dependency-only changes, so the full Go suite was also run.go test -short -parallel=4 -timeout=10m ./...: 131 packages passed; failures remain inactions/setup,pkg/cli,pkg/fileutil, andpkg/workflow. Representative missing-embed, macOS path canonicalization, case-sensitivity, and yamllint path failures reproduce with the originalHEADdependency versions via a separate baseline modfile. Other failures include platform/tool fixture assumptions; the complete suite is not green.make check-workflow-driftreports six unrelated existing generated-lock differences (older setup-node/artifact refs in workflow sources). Those unrelated downgrades are deliberately excluded; the changed stale-repo workflow is in sync.No workflow runs were manually dispatched.