chore(deps): bump danger/danger-js from 11.2.0 to 13.0.10 by dependabot[bot] · Pull Request #39 · Create-Python-App/website

dependabot · 2026-08-24T13:46:00Z

Bumps danger/danger-js from 11.2.0 to 13.0.10.

Release notes

Sourced from danger/danger-js's releases.

Release 13.0.10

No release notes provided.

Release 13.0.8

No release notes provided.

Release 13.0.5

No release notes provided.

Release 13.0.4

Fun sidenote, it's been exactly a year and we had to update the node version etc

Release 12.3.4

No release notes provided.

Release 12.3.3

No release notes provided.

Release 12.3.2

No release notes provided.

Release 12.3.1

No release notes provided.

Release 12.3.0

No release notes provided.

Release 12.2.1

No release notes provided.

Release 12.2.0

No release notes provided.

Release 12.1.0

It's been 7 years since I looked at danger init and err, the world of CI has changed quite a bit since then. So, Danger JS's init command now knows that GitHub Actions exists and will correctly offer some advice on how to set up a Dangerfile for it. - [@orta]

12.0.1

Bumping to 12.x because we've raised the minimum to node version from 14 to 18. This is due to some of our dependencies requiring a newer version of node. This is a breaking change for some folk! Also, 14 has been out of support for quite a while now and Node 18 gives us a full year. - [@orta]

Remove the user checks in GitHub comment/inline comment lookups, to allow using app tokens #1433 - [@orta]

... (truncated)

Changelog

Sourced from danger/danger-js's changelog.

Main

14.0.0-5

Release faff as I migrate to OIDC deploys for danger - orta

14.0.0

Danger now installs undici 7 by default. undici is what Danger uses to talk to GitHub, GitLab and Bitbucket, and version 7 requires node 20.18.1 or newer — so for most people that is Danger's new effective minimum. Node 18 has not been dropped: you can pin undici back to the 6.x line yourself and everything keeps working. - [@orta]

The reason for the switch is that it puts you in control of your own undici version. Previously Danger pinned undici to the 6.x line, so if a security advisory landed you had to wait for a Danger release to pick up the fix. undici is now an optional peer dependency accepting ^6.28.0 || ^7, which means moving it in either direction is a supported thing to do rather than a workaround.

github.reviews now reports the review states GitHub actually sends, so checking for a review that requested changes works - fixes #1443 [@Socialpranker]

GitHub: Fetch all pages of pull request reviews #1383 [@LeonMAG]

Upgrade to undici 6.27.0 to resolve transitive CVEs - fixes #1517 [@rjatkins]

Breaking Default to undici 7, which raises the effective node requirement to 20.18.1. If you are on node 18, add "resolutions": { "undici": "^6.28.0" } (yarn), "overrides": { "undici": "^6.28.0" } (npm), or the same overrides block nested under "pnpm" (pnpm) to your package.json. [@orta]

undici is now an optional peer dependency (^6.28.0 || ^7), so you can move it forward yourself to pick up security fixes without waiting for a Danger release [@orta]

Removed the undici entry from Danger's own resolutions, which had no effect on people installing Danger [@orta]

Danger now runs on node 24 and newer. Signing in as a GitHub App relied on a dependency that used a part of node removed in 24, which crashed Danger on startup before it could do any work. That signing is now done with node's own crypto, so the dependency (and the eleven packages it brought with it) is gone [@orta]

13.0.9

... (truncated)

Commits

e9b5882 Release 13.0.10
8a697d3 CHANGELOG
008e05d Merge pull request #1514 from nicholasgriffintn/swap-out-node-fetch
c8b966a feat: swapping our node-fetch for unidici / native
58355dc Release 13.0.8
ed3f089 Fix up the JSON schema process which was blocking deploys
4ea156e Merge pull request #1513 from danger/danger-exec
087a729 Adds a fix for a potential local shell execution based on a filename - thanks...
a9f198a Merge pull request #1509 from glensc/build-sequence
af06dbf Merge branch 'main' into build-sequence
Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

@dependabot rebase will rebase this PR
@dependabot recreate will recreate this PR, overwriting any edits that have been made to it
@dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
@dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
@dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
@dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

Bumps [danger/danger-js](https://github.com/danger/danger-js) from 11.2.0 to 13.0.10. - [Release notes](https://github.com/danger/danger-js/releases) - [Changelog](https://github.com/danger/danger-js/blob/main/CHANGELOG.md) - [Commits](danger/danger-js@11.2.0...13.0.10) --- updated-dependencies: - dependency-name: danger/danger-js dependency-version: 13.0.10 dependency-type: direct:production update-type: version-update:semver-major ... Signed-off-by: dependabot[bot] <support@github.com>

vercel · 2026-08-24T13:46:02Z

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
create-awesome-python-app-website	Ready	Preview	Aug 24, 2026 1:46pm

github-actions · 2026-08-24T13:47:13Z

	Fails
🚫	`node` failed.

Log

Details

Error:  TypeError: ts.transpileModule is not a function
    at typescriptify (/usr/src/danger/dist/runner/runners/utils/transpiler.js:160:21)
    at /usr/src/danger/dist/runner/runners/utils/transpiler.js:235:44
    at /usr/src/danger/dist/runner/runners/inline.js:154:53
    at step (/usr/src/danger/dist/runner/runners/inline.js:56:23)
    at Object.next (/usr/src/danger/dist/runner/runners/inline.js:37:53)
    at /usr/src/danger/dist/runner/runners/inline.js:31:71
    at new Promise (<anonymous>)
    at __awaiter (/usr/src/danger/dist/runner/runners/inline.js:27:12)
    at runDangerfileEnvironment (/usr/src/danger/dist/runner/runners/inline.js:123:132)
    at /usr/src/danger/dist/platforms/GitHub.js:181:38
danger-results://tmp/danger-results-069b6bd2.json

Generated by 🚫 dangerJS against 12974c9

github-actions · 2026-08-24T13:47:34Z

❌MegaLinter analysis: Error

Descriptor	Linter	Files	Errors	Warnings	Elapsed time
✅ ACTION	actionlint	5	0	0	0.07s
❌ ACTION	zizmor	5	1	0	0.28s
✅ COPYPASTE	jscpd	yes	no	no	0.95s
✅ EDITORCONFIG	editorconfig-checker	172	0	0	0.51s
❌ JAVASCRIPT	eslint	1	1	0	0.42s
✅ JAVASCRIPT	standard	1	0	0	1.06s
✅ JSON	jsonlint	9	0	0	0.09s
✅ JSON	npm-package-json-lint	yes	no	no	0.43s
✅ JSON	prettier	9	0	0	0.31s
✅ JSON	v8r	9	0	0	11.51s
✅ MARKDOWN	markdownlint	9	0	0	0.52s
✅ MARKDOWN	markdown-table-formatter	9	0	0	0.22s
✅ REPOSITORY	betterleaks	yes	no	no	0.58s
✅ REPOSITORY	checkov	yes	no	no	14.4s
✅ REPOSITORY	git_diff	yes	no	no	0.01s
❌ REPOSITORY	osv-scanner	yes	8	no	1.85s
✅ REPOSITORY	secretlint	yes	no	no	2.63s
❌ REPOSITORY	trivy	yes	1	no	19.98s
✅ REPOSITORY	trufflehog	yes	no	no	3.74s
✅ SPELL	cspell	173	0	0	4.56s
❌ TSX	eslint	100	1	0	0.28s
⚠️ YAML	prettier	13	1	2	0.48s
✅ YAML	yamllint	13	0	0	0.52s

Detailed Issues

❌ JAVASCRIPT / eslint - 1 error

Oops! Something went wrong! :(

ESLint: 10.8.0

Error [ERR_MODULE_NOT_FOUND]: Cannot find package 'eslint-plugin-import' imported from eslint.config.mjs
    at Object.getPackageJSONURL (node:internal/modules/package_json_reader:301:9)
    at packageResolve (node:internal/modules/esm/resolve:768:81)
    at moduleResolve (node:internal/modules/esm/resolve:859:18)
    at defaultResolve (node:internal/modules/esm/resolve:992:11)
    at #cachedDefaultResolve (node:internal/modules/esm/loader:704:20)
    at #resolveAndMaybeBlockOnLoaderThread (node:internal/modules/esm/loader:724:38)
    at ModuleLoader.resolveSync (node:internal/modules/esm/loader:762:56)
    at #resolve (node:internal/modules/esm/loader:686:17)
    at ModuleLoader.getOrCreateModuleJob (node:internal/modules/esm/loader:606:35)
    at ModuleJob.syncLink (node:internal/modules/esm/module_job:163:33)


[JAVASCRIPT_ES_ERROR_FLAT_CONFIG_MODULE_NOT_FOUND] ESLint v9+/v10 flat config (`eslint.config.mjs`) uses native ESM resolution, which does not honor `NODE_PATH`. Bare imports like `import js from '@eslint/js'` fail when ESLint runs from MegaLinter's bundled install.
Resolutions:
  - Use `createRequire` in your `eslint.config.mjs` (see the "ESLint v10" section in this linter's documentation above).
  - Or install your project's dependencies and run the project-local ESLint binary:
      JAVASCRIPT_ES_PRE_COMMANDS:
        - command: yarn install --frozen-lockfile --ignore-scripts
          cwd: workspace
          continue_if_failed: false
      JAVASCRIPT_ES_CLI_EXECUTABLE: node_modules/.bin/eslint

❌ TSX / eslint - 1 error

Oops! Something went wrong! :(

ESLint: 10.8.0

Error [ERR_MODULE_NOT_FOUND]: Cannot find package 'eslint-plugin-import' imported from eslint.config.mjs
    at Object.getPackageJSONURL (node:internal/modules/package_json_reader:301:9)
    at packageResolve (node:internal/modules/esm/resolve:768:81)
    at moduleResolve (node:internal/modules/esm/resolve:859:18)
    at defaultResolve (node:internal/modules/esm/resolve:992:11)
    at #cachedDefaultResolve (node:internal/modules/esm/loader:704:20)
    at #resolveAndMaybeBlockOnLoaderThread (node:internal/modules/esm/loader:724:38)
    at ModuleLoader.resolveSync (node:internal/modules/esm/loader:762:56)
    at #resolve (node:internal/modules/esm/loader:686:17)
    at ModuleLoader.getOrCreateModuleJob (node:internal/modules/esm/loader:606:35)
    at ModuleJob.syncLink (node:internal/modules/esm/module_job:163:33)


[TSX_ESLINT_ERROR_FLAT_CONFIG_MODULE_NOT_FOUND] ESLint v9+/v10 flat config (`eslint.config.mjs`) uses native ESM resolution, which does not honor `NODE_PATH`. Bare imports like `import tsPlugin from '@typescript-eslint/eslint-plugin'` fail when ESLint runs from MegaLinter's bundled install.
Resolutions:
  - Use `createRequire` in your `eslint.config.mjs` (see the "ESLint v10" section in this linter's documentation above).
  - Or install your project's dependencies and run the project-local ESLint binary:
      TSX_ESLINT_PRE_COMMANDS:
        - command: yarn install --frozen-lockfile --ignore-scripts
          cwd: workspace
          continue_if_failed: false
      TSX_ESLINT_CLI_EXECUTABLE: node_modules/.bin/eslint

❌ REPOSITORY / osv-scanner - 8 errors

Scanning dir .
Starting filesystem walk for root: /
Scanned pnpm-lock.yaml file and found 827 packages
Scanned tools/danger/package-lock.json file and found 95 packages
End status: 34 dirs visited, 209 inodes visited, 2 Extract calls, 47.802809ms elapsed, 47.803008ms wall time

Total 3 packages affected by 8 known vulnerabilities (0 Critical, 0 High, 6 Medium, 2 Low, 0 Unknown) from 1 ecosystem.
8 vulnerabilities can be fixed.

+-------------------------------------+------+-----------+-----------+---------+---------------+----------------+
| OSV URL                             | CVSS | ECOSYSTEM | PACKAGE   | VERSION | FIXED VERSION | SOURCE         |
+-------------------------------------+------+-----------+-----------+---------+---------------+----------------+
| https://osv.dev/GHSA-55q2-fjhq-7xh7 | 5.1  | npm       | dompurify | 3.4.11  | 3.4.13        | pnpm-lock.yaml |
| https://osv.dev/GHSA-c2j3-45gr-mqc4 | 2.1  | npm       | dompurify | 3.4.11  | 3.4.12        | pnpm-lock.yaml |
| https://osv.dev/GHSA-2v8p-3f2j-5mp7 | 5.3  | npm       | mermaid   | 11.16.0 | 11.16.1       | pnpm-lock.yaml |
| https://osv.dev/GHSA-3rrr-jr9j-h3q3 | 6.5  | npm       | mermaid   | 11.16.0 | 11.16.1       | pnpm-lock.yaml |
| https://osv.dev/GHSA-6x64-9x62-f2gx | 5.3  | npm       | mermaid   | 11.16.0 | 11.16.1       | pnpm-lock.yaml |
| https://osv.dev/GHSA-c4c3-pg64-4m4v | 2.4  | npm       | mermaid   | 11.16.0 | 11.16.1       | pnpm-lock.yaml |
| https://osv.dev/GHSA-rhh3-jpg6-66xh | 5.3  | npm       | mermaid   | 11.16.0 | 11.16.1       | pnpm-lock.yaml |
| https://osv.dev/GHSA-fxqj-rqcc-2cmp | 6.3  | npm       | postcss   | 8.5.21  | 8.5.23        | pnpm-lock.yaml |
+-------------------------------------+------+-----------+-----------+---------+---------------+----------------+

❌ REPOSITORY / trivy - 1 error

2026-08-24T13:47:31Z	ERROR	[vulndb] The first run cannot skip downloading DB
2026-08-24T13:47:31Z	FATAL	Fatal error	run error: init error: DB error: database error: --skip-db-update cannot be specified on the first run

❌ ACTION / zizmor - 1 error

INFO zizmor: 🌈 zizmor v1.25.0
fatal: no audit was performed
'ref-confusion' audit failed on file://.github/workflows/mega-linter.yml

Caused by:
    0: error in 'ref-confusion' audit
    1: couldn't list branches for actions/checkout
    2: request error while accessing GitHub API
    3: HTTP status client error (401 Unauthorized) for url (https://github.com/actions/checkout.git/git-upload-pack)


[ACTION_ZIZMOR_ERROR_GITHUB_API_UNREACHABLE] Zizmor could not access a repository referenced by a `uses:` clause via the GitHub API (missing token, insufficient scope, or cross-repo private access).
To allow zizmor to authenticate with GITHUB_TOKEN (or a PAT with `Contents: read-only`), whitelist the variable in your .mega-linter.yml:
ACTION_ZIZMOR_UNSECURED_ENV_VARIABLES:
  - GITHUB_TOKEN
If the referenced workflow is in a private repo outside the current one, provide a PAT with cross-repo access instead of the default GITHUB_TOKEN, or run zizmor in offline mode.

⚠️ YAML / prettier - 1 error

Checking formatting...
[warn] .github/dependabot.yml
[warn] Code style issues found in the above file. Run Prettier with --write to fix.

Notices

⚠️ Your configuration references items that have been removed from MegaLinter and are ignored: MARKDOWN_MARKDOWN_LINK_CHECK. See Removed linters to find their replacements.

See detailed reports in MegaLinter artifacts

Your project could benefit from a custom flavor, which would allow you to run only the linters you need, and thus improve runtime performances. (Skip this info by defining FLAVOR_SUGGESTIONS: false)

Documentation: Custom Flavors
Command: npx mega-linter-runner@10.0.0 --custom-flavor-setup --custom-flavor-linters ACTION_ACTIONLINT,ACTION_ZIZMOR,COPYPASTE_JSCPD,EDITORCONFIG_EDITORCONFIG_CHECKER,JAVASCRIPT_ES,JAVASCRIPT_STANDARD,JSON_JSONLINT,JSON_V8R,JSON_PRETTIER,JSON_NPM_PACKAGE_JSON_LINT,MARKDOWN_MARKDOWNLINT,MARKDOWN_MARKDOWN_TABLE_FORMATTER,REPOSITORY_CHECKOV,REPOSITORY_GIT_DIFF,REPOSITORY_BETTERLEAKS,REPOSITORY_OSV_SCANNER,REPOSITORY_SECRETLINT,REPOSITORY_TRIVY,REPOSITORY_TRUFFLEHOG,SPELL_CSPELL,TSX_ESLINT,YAML_PRETTIER,YAML_YAMLLINT

Show us your support by starring ⭐ the repository

dependabot · 2026-08-26T02:16:27Z

Superseded by #42.

dependabot Bot added dependencies Pull requests that update a dependency file github_actions Pull requests that update GitHub Actions code labels Aug 24, 2026

dependabot Bot requested a review from ulises-jeremias as a code owner August 24, 2026 13:46

dependabot Bot added dependencies Pull requests that update a dependency file github_actions Pull requests that update GitHub Actions code labels Aug 24, 2026

vercel Bot deployed to Preview August 24, 2026 13:46 View deployment

dependabot Bot closed this Aug 26, 2026

dependabot Bot deleted the dependabot/github_actions/danger/danger-js-13.0.10 branch August 26, 2026 02:16

Navigation Menu

Uh oh!

chore(deps): bump danger/danger-js from 11.2.0 to 13.0.10 - #39

chore(deps): bump danger/danger-js from 11.2.0 to 13.0.10#39
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/github_actions/danger/danger-js-13.0.10

dependabot Bot commented on behalf of github Aug 24, 2026

Uh oh!

vercel Bot commented Aug 24, 2026 •

edited

Loading

Uh oh!

github-actions Bot commented Aug 24, 2026

Uh oh!

github-actions Bot commented Aug 24, 2026

Uh oh!

dependabot Bot commented on behalf of github Aug 26, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants

Uh oh!

Conversation

dependabot Bot commented on behalf of github Aug 24, 2026

Release 13.0.10

Release 13.0.8

Release 13.0.5

Release 13.0.4

Release 12.3.4

Release 12.3.3

Release 12.3.2

Release 12.3.1

Release 12.3.0

Release 12.2.1

Release 12.2.0

Release 12.1.0

12.0.1

Main

14.0.0-5

14.0.0

13.0.9

Uh oh!

vercel Bot commented Aug 24, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

github-actions Bot commented Aug 24, 2026

Log

Uh oh!

github-actions Bot commented Aug 24, 2026

❌MegaLinter analysis: Error

Detailed Issues

Notices

Uh oh!

dependabot Bot commented on behalf of github Aug 26, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants

vercel Bot commented Aug 24, 2026 •

edited

Loading