Repository navigation
deps(main): consolidate dependency updates and security fixes - #378
Merged
Merged
Conversation
…#375) - actions/checkout v6.0.2 -> v7.0.1 (tags and SHA pins) - actions/cache v5.0.5 / v5 -> v6.1.0 (tags and SHA pins) - actions/download-artifact v8.0.1 / v7 -> v8.0.2 (tags and SHA pins) - codecov/codecov-action v6 -> v7.1.1 - hashicorp/setup-packer v3.2.0 -> v3.4.0 - cargo-bins/cargo-binstall v1.19.1 -> v1.26.0 Every reference to each action moves together, including the composite actions under .github/actions. All releases are at least 3 days old.
pnpm 9 is affected by GHSA-8cc4-rfj6-fhg4 and later pnpm advisories with no 9.x fix. 12.14.0 (2026-10-15) is the newest 12.x past the 3-day release-age gate; a floating `12` would resolve to 12.15.0 (2026-10-21).
This was referenced Oct 23, 2026
pacphi
added a commit
that referenced
this pull request
Oct 23, 2026
This was referenced Oct 23, 2026
pacphi
added a commit
that referenced
this pull request
Oct 23, 2026
* deps(v2): clear vf-management-api npm advisories in-major; bump yq and gh in the image vf-management-api (the v2 line's only package-lock.json): - fastify ^5.8.5 -> ^5.12.7 (locked 5.12.7); fixes 7 fastify GHSAs. - In-range lock refresh, cut off at 2026-10-20T17:15Z (3-day release age): find-my-way 9.4.0 -> 9.10.0, fast-uri 3.1.0 -> 3.1.9 (ajv) / 4.2.3 (fastify 5.12), ws 8.19.0 -> 8.22.0, brace-expansion 5.0.5 -> 5.0.12, minimatch 10.2.4 -> 10.2.6, fast-copy 3.0.2 -> 3.1.0. - npm audit: 9 (6 high, 3 moderate) -> 3 (1 high, 2 moderate); the remaining high (@fastify/static via @fastify/swagger-ui 3) needs majors and is excepted in v2/audit-ignore. v2/Dockerfile: - yq 4.53.2 -> 4.54.1 and gh 2.90.0 -> 2.102.0 (same majors, both >= 3 days old). Both were built with Go 1.26.2, which Trivy flags (CVE-2026-33811/-33814/-39820/-39836/-42499 high); gh 2.102.0 also clears GHSA-8xvp-7hj6-mcj9 (high, < 2.93.0) and in-toto GHSA-pmwq-pjrm-6p5r. * ci(v2): add a branch-local npm audit gate Adds an npm-audit job to the v2 CI shim. It runs .github/scripts/v2/npm-audit.sh, which runs `npm audit --audit-level=high` on every committed package-lock.json and fails on any high or critical advisory not excepted in v2/audit-ignore. It fails closed when npm audit returns an error body (registry timeout) and flags exceptions that no longer match. The centralized ci-v2.yml on main is unchanged; its Trivy image scan still runs. * chore(v2): add branch-local renovate.json for useBaseBranchConfig main's renovate.json will set useBaseBranchConfig: "merge", which needs a config file on every base branch. Shared policy stays on main. * ci(v2): re-run CI on main's updated reusable workflows (#378)
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Consolidates the open GitHub Actions dependency PRs that target
maininto one change.mainholds no product code, so Actions majors are taken here when CI passes. Every reference to each action moves together, including the composite actions under.github/actions/, so no reference is left on an older major.actions/checkout3d3c42e5…for SHA pins)actions/cachev555cc8345…).github/actions/shared/build-image,.github/actions/v3/setup-rust)actions/download-artifactv79000827c…).github/actions/shared/deploy-provider)codecov/codecov-actionv6ci-v3.yml)hashicorp/setup-packercargo-bins/cargo-binstallci-v3.yml)_ci-npm.yml,pnpm/action-setupversion:)I checked each SHA pin against its tag with
gh api repos/<action>/git/ref/tags/<tag>.Superseded PRs
Dependabot (to close with "Superseded by #N." after merge):
Renovate (covered by this PR; leave them for Renovate to autoclose, don't close them by hand):
[security]Deferred majors
None. Actions majors are allowed on
main.Breaking-change review of the majors taken (from each
action.ymldiff and the release notes):pull_request_target/workflow_rununlessallow-unsafe-pr-checkout: trueis set. The onlyworkflow_runworkflow,v3-packer-test.yml, uses bareactions/checkoutwith noref:, so it checks out the base repo and isn't affected. v7.0.1 also skips that check when inputs are left at their defaults. No workflow usespull_request_target.@v6was a dead line (v6.0.2 is a copy of v7.0.0). The only new input iscleanup(defaultfalse).node24runtime. Every runner is GitHub-hosted (ubuntu-latest,windows-latest,ubuntu-26.04-arm).engines.node >=18, which matches_ci-npm.yml's Node 20 default.pnpm/action-setup@v6(v6.1.0) supports pnpm 12.Release age (3 days)
Every version above is at least 3 days old. pnpm is pinned to
12.14.0, not a floating12, because a floating12currently resolves to 12.15.0 (published 2026-10-21T11:16Z, under 3 days old). Release-age exceptions: none.Overrides and ignores
None.
Security
/advisories?ecosystem=actions): the only one is GHSA-cxww-7g56-2vh6 (download-artifact < 4.1.3), which doesn't apply.mainhas no lockfiles (noCargo.lock,package-lock.jsonorpnpm-lock.yaml).Pre-existing issues (not fixed here, unchanged by this PR)
actionlintreports the same 4 findings before and after this change:ci-v2.yml:86,ci-v3.yml:213,v2-manual-deploy.yml:173readsteps.*.outputs.tag, which isn't a declared output.monitor-ubuntu-2604-arm.yml:27uses the unknown labelubuntu-26.04-arm; that scheduled workflow already fails onmain.The "Pinned action SHAs" comment header in
registry-core-publish.ymlwas already out of date: it lists v4-era SHAs that the file no longer uses. I left it alone rather than update part of it._ci-npm.ymlhas no callers onmain(its header saysci-v3.ymluses it, butci-v3.ymlonly calls_ci-rust.yml), so the pnpm pin has no CI effect today.Verification
actionlint -shellcheck= -pyflakes=(1.7.12): exit 1 both before and after, with the same 4 pre-existing findings. The change adds none.yamllint -c .yamllint.yml <changed files>: exit 0. (.prettierignoreexcludes**/*.yml.)grep -rhoE "(actions/checkout|actions/cache|hashicorp/setup-packer|cargo-bins/cargo-binstall|codecov/codecov-action|actions/download-artifact)@…" .github. Only the target versions remain. The leftover@v4hits are in the out-of-date comment header noted above.ebf1236(Validate YAML, Validate Markdown, Validate Shell).gh workflow run check-links.yml --ref chore/deps-consolidate-341-375(run 39994228338) passed. Its log showsDownload action repository 'actions/checkout@v7.0.1' (SHA:3d3c42e5…)and'actions/cache@v6.1.0' (SHA:55cc8345…).gh api repos/pacphi/sindri/dependabot/alerts?state=open: no open alerts.core.hooksPathand no rootpackage.json, so.husky/pre-commitisn't wired. Its checks apply only tov3//v4/files anyway.What runs only after merge
The
v1–v4shim workflows callpacphi/sindri/.github/workflows/ci-vN.yml@main, so this PR's own CI can't exercise codecov v7.1.1, cargo-binstall v1.26.0, download-artifact v8.0.2, setup-packer v3.4.0 or the pnpm pin. Their first real run is the next v3/v4 CI run after merge. After merging, re-run CI on the openv3/v4PRs, or update their branches.v3.1.xandv2.5.xcarry their own workflow copies and aren't affected.🤖 Generated with Claude Code