chore(deps)(deps): Bump the "weekly-dependency-refresh" group with 2 updates across multiple ecosystems#191
Open
dependabot[bot] wants to merge 1 commit into
Conversation
Bumps the weekly-dependency-refresh group with 1 update: [actions/checkout](https://github.com/actions/checkout). Updates `actions/checkout` from 6 to 7 - [Release notes](https://github.com/actions/checkout/releases) - [Changelog](https://github.com/actions/checkout/blob/main/CHANGELOG.md) - [Commits](actions/checkout@v6...v7) chore(deps)(deps): bump the weekly-dependency-refresh group with 5 updates Bumps the weekly-dependency-refresh group with 5 updates: | Package | From | To | | --- | --- | --- | | [@sentry/astro](https://github.com/getsentry/sentry-javascript) | `10.57.0` | `10.59.0` | | [astro](https://github.com/withastro/astro/tree/HEAD/packages/astro) | `6.4.6` | `6.4.8` | | [@playwright/test](https://github.com/microsoft/playwright) | `1.60.0` | `1.61.0` | | [typescript-eslint](https://github.com/typescript-eslint/typescript-eslint/tree/HEAD/packages/typescript-eslint) | `8.61.0` | `8.61.1` | | [vitest](https://github.com/vitest-dev/vitest/tree/HEAD/packages/vitest) | `4.1.8` | `4.1.9` | Updates `@sentry/astro` from 10.57.0 to 10.59.0 - [Release notes](https://github.com/getsentry/sentry-javascript/releases) - [Changelog](https://github.com/getsentry/sentry-javascript/blob/develop/CHANGELOG.md) - [Commits](getsentry/sentry-javascript@10.57.0...10.59.0) Updates `astro` from 6.4.6 to 6.4.8 - [Release notes](https://github.com/withastro/astro/releases) - [Changelog](https://github.com/withastro/astro/blob/astro@6.4.8/packages/astro/CHANGELOG.md) - [Commits](https://github.com/withastro/astro/commits/astro@6.4.8/packages/astro) Updates `@playwright/test` from 1.60.0 to 1.61.0 - [Release notes](https://github.com/microsoft/playwright/releases) - [Commits](microsoft/playwright@v1.60.0...v1.61.0) Updates `typescript-eslint` from 8.61.0 to 8.61.1 - [Release notes](https://github.com/typescript-eslint/typescript-eslint/releases) - [Changelog](https://github.com/typescript-eslint/typescript-eslint/blob/main/packages/typescript-eslint/CHANGELOG.md) - [Commits](https://github.com/typescript-eslint/typescript-eslint/commits/v8.61.1/packages/typescript-eslint) Updates `vitest` from 4.1.8 to 4.1.9 - [Release notes](https://github.com/vitest-dev/vitest/releases) - [Changelog](https://github.com/vitest-dev/vitest/blob/main/docs/releases.md) - [Commits](https://github.com/vitest-dev/vitest/commits/v4.1.9/packages/vitest) --- updated-dependencies: - dependency-name: actions/checkout dependency-version: '7' dependency-type: direct:production update-type: version-update:semver-major dependency-group: weekly-dependency-refresh - dependency-name: "@sentry/astro" dependency-version: 10.59.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: weekly-dependency-refresh - dependency-name: astro dependency-version: 6.4.8 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: weekly-dependency-refresh - dependency-name: "@playwright/test" dependency-version: 1.61.0 dependency-type: direct:development update-type: version-update:semver-minor dependency-group: weekly-dependency-refresh - dependency-name: typescript-eslint dependency-version: 8.61.1 dependency-type: direct:development update-type: version-update:semver-patch dependency-group: weekly-dependency-refresh - dependency-name: vitest dependency-version: 4.1.9 dependency-type: direct:development update-type: version-update:semver-patch dependency-group: weekly-dependency-refresh ... Signed-off-by: dependabot[bot] <support@github.com>
Contributor
Author
LabelsThe following labels could not be found: Please fix the above issues or remove invalid values from |
![cursor[bot]](https://avatars.githubusercontent.com/in/1210556?s=60&v=4){kind=small}
There was a problem hiding this comment.
Security review: no high-confidence vulnerabilities found
Scope: dependency-only PR (package.json, package-lock.json, GitHub Actions workflow pins). No application source, auth, or runtime configuration changes.
Summary
This PR bumps routine patch/minor versions and does not introduce confirmed vulnerabilities. Several updates are security improvements.
| Change | Security impact |
|---|---|
actions/checkout@v6 → v7 |
Improvement — blocks unsafe fork PR checkout in pull_request_target / workflow_run (pwn-request mitigation). This repo's workflows use push, pull_request, schedule, and workflow_dispatch only; no pull_request_target or workflow_run triggers are present. |
astro@6.4.6 → 6.4.8 |
Improvement — hardens URL percent-decoding limits (follow-up to CVE-2025-66202 middleware bypass class). Relevant if middleware or on-demand routes are added later; this site is currently static. |
@sentry/astro@10.57.0 → 10.59.0 |
Neutral — internal package rename (@sentry-internal/* → @sentry/*); no new attack surface identified. |
@playwright/test, vitest, typescript-eslint |
Dev/test-only; no production runtime exposure. |
Supply-chain / audit
npm audit(full tree): 39 vulnerabilities (5 low, 32 moderate, 2 high) — unchanged vs base (e9460f18).npm audit --omit=dev: 27 vulnerabilities — unchanged vs base.- Existing advisories (e.g.
esbuilddev-server file read on Windows,js-yamlDoS,launch-editorUNC path) are pre-existing; this PR does not worsen them. package.jsonoverridesforhonoandviteare unchanged.
Checklist (no findings)
- Injection / traversal / SSRF / XSS: No new code paths; no changes to user input handling.
- Authn/authz: No auth logic touched.
- Secrets / logging: No token or credential handling changes.
- Deserialization / CSRF: Not applicable to this diff.
Residual (informational, not introduced by this PR)
Pre-existing transitive advisories remain in the lockfile. Address separately if desired; they are outside this PR's scope.
Verdict: Safe to merge from a security perspective.
Sent by Cursor Automation: Find vulnerabilities
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Bumps the weekly-dependency-refresh group with 1 update: actions/checkout.
Updates
actions/checkoutfrom 6 to 7Release notes
Sourced from actions/checkout's releases.
Changelog
Sourced from actions/checkout's changelog.
... (truncated)
Commits
9c091bbupdate error wording (#2467)1044a6dgetting ready for checkout v7 release (#2464)f028218Bump the minor-npm-dependencies group across 1 directory with 3 updates (#2462)d914b26upgrade module to esm and update dependencies (#2463)537c7efBump@actions/coreand@actions/tool-cacheand Remove uuid (#2459)130a169Bump js-yaml from 4.1.0 to 4.2.0 (#2461)7d09575Bump flatted from 3.3.1 to 3.4.2 (#2460)0f9f3aaBump actions/publish-immutable-action (#2458)f9e715ablock checking out fork pr for pull_request_target and workflow_run (#2454)Bumps the weekly-dependency-refresh group with 5 updates:
10.57.010.59.06.4.66.4.81.60.01.61.08.61.08.61.14.1.84.1.9Updates
@sentry/astrofrom 10.57.0 to 10.59.0Release notes
Sourced from @sentry/astro's releases.
... (truncated)
Changelog
Sourced from @sentry/astro's changelog.
... (truncated)
Commits
2cb0ef6release: 10.59.0f77b265Merge pull request #21655 from getsentry/prepare-release/10.59.08e32a8dmeta(changelog): Update changelog for 10.59.050fe5d9fix: Diagnostics channel Node v18 (#21631)9c765e0feat(react-router): support react router v8 (#21633)815c1cffeat(deps): Bump@babel/corefrom 7.29.0 to 7.29.6 (#21574)a520447ref(tanstackstart-react): Use@sentry/conventions(#21498)38a0485test(cloudflare): Remove mock in DO tests (#21634)cb69761feat(deno): Add orchestrion deno runtime hook (#21451)1e057bachore(deps): Bump esbuild from 0.25.0 to 0.28.1 in /dev-packages/e2e-tests/te...Updates
astrofrom 6.4.6 to 6.4.8Release notes
Sourced from astro's releases.
Changelog
Sourced from astro's changelog.
Commits
3ec2c10[ci] release (#17110)27c80eafix(core): encoded URLs (#17109)910e121[ci] release (#17036)ef771ecfix: improve diagnostics (#17046)0537f5c[ci] format2f4d92aFix prerendered redirect targets inflating SSR bundle in hybrid mode (#17066)360fa3fdocs: fix grammar in container API JSDoc comments (#16984)bbe0e54[ci] format52fc862Supporting numeric id references (#16672)9de80aefeat(cli): Adds wrangler schema to generated wrangler.jsonc file when running...Updates
@playwright/testfrom 1.60.0 to 1.61.0Release notes
Sourced from @playwright/test's releases.
... (truncated)
Commits
1cc5a90cherry-pick(#41295): chore: PLAYWRIGHT_TRACING_NO_WEBSOCKET_FRAMES and PLAYWR...a6772bdcherry-pick(#41280): Revert "fix(trace-viewer): add keyboard navigation to `N...8133dcfcherry-pick(#41283): docs: add Ubuntu 26.04 and Node.js 26.x to system requir...812432echore: mark v1.61.0 (#41277)ac05145fix(fetch): report serverAddr and securityDetails for reused sockets (#41267)056efc9fix(trace-viewer): add keyboard navigation toNetworkFilterscomponent (#41...41f7b9achore: fixes uncovered by the .NET 1.61 roll (#41266)ba50778fix(mcp): assign caps as array for legacy --vision flag (#41253)b8ee5aedocs: release notes for v1.61 (#41261)49c1f69fix(trace viewer): load trace from a local file (#41263)Updates
typescript-eslintfrom 8.61.0 to 8.61.1Release notes
Sourced from typescript-eslint's releases.
Changelog
Sourced from typescript-eslint's changelog.
Commits
aaad718chore(release): publish 8.61.1Updates
vitestfrom 4.1.8 to 4.1.9Release notes
Sourced from vitest's releases.
Commits
a7a61e7chore: release v4.1.9 (#10598)934b0f5fix(pool): prevent test run hang on worker crash (#10543) [backport to v4] (#...7fb2965fix(browser): wait for orchestrator readiness before resolving browser sessio...a518019fix: fiximportOriginalwith optimizer and query import [backport to v4] (#...Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting
@dependabot rebase.Dependabot commands and options
You can trigger Dependabot actions by commenting on this PR:
@dependabot rebasewill rebase this PR@dependabot recreatewill recreate this PR, overwriting any edits that have been made to it@dependabot show <dependency name> ignore conditionswill show all of the ignore conditions of the specified dependency@dependabot ignore <dependency name> major versionwill close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)@dependabot ignore <dependency name> minor versionwill close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)@dependabot ignore <dependency name>will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)@dependabot unignore <dependency name>will remove all of the ignore conditions of the specified dependency@dependabot unignore <dependency name> <ignore condition>will remove the ignore condition of the specified dependency and ignore conditions