chore(deps): bump dependabot/fetch-metadata from 2.5.0 to 3.0.0 - #7
chore(deps): bump dependabot/fetch-metadata from 2.5.0 to 3.0.0#7dependabot[bot] wants to merge 1 commit into
Conversation
Bumps [dependabot/fetch-metadata](https://github.com/dependabot/fetch-metadata) from 2.5.0 to 3.0.0. - [Release notes](https://github.com/dependabot/fetch-metadata/releases) - [Commits](dependabot/fetch-metadata@21025c7...ffa630c) --- updated-dependencies: - dependency-name: dependabot/fetch-metadata dependency-version: 3.0.0 dependency-type: direct:production update-type: version-update:semver-major ... Signed-off-by: dependabot[bot] <support@github.com>
LabelsThe following labels could not be found: Please fix the above issues or remove invalid values from |
|
Dependabot tried to update this pull request, but something went wrong. We're looking into it, but in the meantime you can retry the update by commenting |
1 similar comment
|
Dependabot tried to update this pull request, but something went wrong. We're looking into it, but in the meantime you can retry the update by commenting |
|
Closing as unrescuable (previously investigated): this PR targets |
|
OK, I won't notify you again about this release, but will get in touch when a new version is available. If you'd rather skip all updates until the next major or minor version, let me know by commenting If you change your mind, just re-open this PR and I'll resolve any conflicts on it. |
Both of these break CI/automerge for every PR, not just mine: - .github/workflows/automerge.yml pinned dependabot/fetch-metadata to db3088a99b59bc669c5853f669e2003c23d06b52 labeled "# v3.0.0" — that SHA does not exist in dependabot/fetch-metadata at all (confirmed via `gh api repos/dependabot/fetch-metadata/commits/<sha>` -> 422 "No commit found"). Every dependabot PR's automerge job has been unable to resolve this action and failing outright as a result. Fixed to the real v3.0.0 SHA (ffa630c65fa7e0ecfa0625b5ceda64399aea1b36, verified against the tags API — this exact SHA is what dependabot's own PR #7, "bump dependabot/fetch-metadata from 2.5.0 to 3.0.0", already carries, but #7 targets .github/workflows/dependabot- automerge.yml, a file that doesn't exist until #16 merges, so it can't land the fix to the actual current file). - While auditing every SHA pin across all workflow files for the same class of bug (`gh api repos/<owner>/<repo>/commits/<sha>` per pin), found a second one: .github/workflows/release.yml pinned softprops/action-gh-release to c95fe1489396fe8a9eb87c0abf8ad5bc06adad52 labeled "# v6.0.0" — that SHA doesn't exist either, and v6.0.0 has never been released (the action tops out at v3.0.2). Fixed to the real, current v3.0.2 SHA. - install.bash: same pre-existing trailing-whitespace lint failure fixed on codex/production-hardening/chore/consolidate-actions-bumps/ fix/python-dependency-vulnerabilities — applying here too since it's currently failing on main itself for any PR that touches this file. All other SHA-pinned actions across every workflow file verified to exist via the same commits-API check (actions/checkout, actions/ deploy-pages, actions/upload-pages-artifact, astral-sh/setup-uv, googleapis/release-please-action, SonarSource/sonarqube-scan-action — all confirmed real). make lint / make test both green.
1 participant
Bumps dependabot/fetch-metadata from 2.5.0 to 3.0.0.
Release notes
Sourced from dependabot/fetch-metadata's releases.
Commits
ffa630cv3.0.0 (#686)ec8fff2Merge pull request #674 from dependabot/dependabot/npm_and_yarn/picomatch-2.3.2caf48bdbuild(deps-dev): bump picomatch from 2.3.1 to 2.3.213d8274Upgrade@actions/githubto ^9.0.0 and@octokit/request-errorto ^7.1.0 (#678)b603099Upgrade@actions/corefrom ^1.11.1 to ^3.0.0 (#677)c5dc5b1Enable noImplicitAny in tsconfig.json (#684)a183f3cAdd typecheck step to CI (#685)5e17564Remove skipLibCheck from tsconfig.json (#683)bb56eebSwitch tsconfig module resolution to bundler (#682)3632e3dRemove vestigial outDir from tsconfig.json (#681)Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting
@dependabot rebase.Dependabot commands and options
You can trigger Dependabot actions by commenting on this PR:
@dependabot rebasewill rebase this PR@dependabot recreatewill recreate this PR, overwriting any edits that have been made to it@dependabot show <dependency name> ignore conditionswill show all of the ignore conditions of the specified dependency@dependabot ignore this major versionwill close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)@dependabot ignore this minor versionwill close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)@dependabot ignore this dependencywill close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)