From 5e8c56b37bee4099ec33663b7b8aa2c2a92a27e5 Mon Sep 17 00:00:00 2001 From: Kevin Heis Date: Mon, 2 Nov 2026 17:09:29 +0000 Subject: [PATCH 1/5] =?UTF-8?q?=F0=9F=93=9D=20Replace=20nodenv=20instructi?= =?UTF-8?q?ons=20with=20fnm=20steps=20(#64459)?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> Copilot-Session: 2e7a0086-4439-4fb9-9306-74232c70d818 Copilot-Session: e802693e-fff3-4c83-801e-d68bb1e5b109 --- contributing/development.md | 2 +- contributing/node-versions.md | 45 +++++++++++------------------------ 2 files changed, 15 insertions(+), 32 deletions(-) diff --git a/contributing/development.md b/contributing/development.md index ac803f70b3ea..aa3ae9640087 100644 --- a/contributing/development.md +++ b/contributing/development.md @@ -8,7 +8,7 @@ This site is powered by Node.js! :sparkles: :turtle: :rocket: :sparkles: It runs on macOS, Windows, and Linux environments. -You'll need Node.js to run the site. Check the version in `package.json`. To install Node.js, [download the "LTS" installer from nodejs.org](https://nodejs.org). If you're using [`nodenv`](https://github.com/nodenv/nodenv), read the [`nodenv` docs](https://github.com/nodenv/nodenv#readme) for instructions on switching Node.js versions. +You'll need Node.js to run the site. Check the version in `package.json`. To install Node.js, [download the "LTS" installer from nodejs.org](https://nodejs.org). To use a Node version manager instead, see [Node versions](./node-versions.md#install-nodejs-locally). Once you've installed Node.js (which includes the popular `npm` package manager), open Terminal and run the following: diff --git a/contributing/node-versions.md b/contributing/node-versions.md index ed9b5cb53296..b1baf86a168f 100644 --- a/contributing/node-versions.md +++ b/contributing/node-versions.md @@ -12,40 +12,23 @@ When updating to a new Node.js version, consider the following files: - [ ] The `contributing/development.md` guide - [ ] The `contributing/node-versions.md` file -## `nodenv` +## Install Node.js locally -[nodenv](https://github.com/nodenv/nodenv) is a tool for managing multiple Node.js versions on your local machine. It is **not required** to run this app, but you may already have it installed if you've worked on other projects that use Node.js. +You don't need a Node version manager, but it makes switching versions easier. We recommend [fnm](https://github.com/Schniz/fnm). -If you're using macOS, run this command to get the latest: +1. Install fnm. On macOS, run `brew install fnm`. For other systems, see the [fnm installation docs](https://github.com/Schniz/fnm#installation). +1. Set up your shell. For Zsh, add this line to `~/.zshrc`. For Bash, add it to `~/.bashrc` and change `zsh` to `bash`. For other shells, see [fnm shell setup](https://github.com/Schniz/fnm#shell-setup). -```shell -brew upgrade nodenv node-build -``` + ```shell + eval "$(fnm env --use-on-cd --shell zsh)" + ``` -If you see a warning like this one, run the suggested command: +1. Open a new terminal. Install the latest major version listed in `engines.node` in `package.json`, make it your default, and switch to it. For example, for Node.js 26: -```shell -# You should change the ownership of these directories to your user. -sudo chown -R $(whoami) /usr/local/sbin -``` + ```shell + fnm install 26 + fnm default 26 + fnm use 26 + ``` -If you're using another operating system, or did not use Homebrew to install nodenv, see these [upgrade instructions](https://github.com/nodenv/nodenv#installation). - -To install Node.js and make it your default version, run this command: - -```shell -# Set VERSION= based on package.json#engines -nodenv install $VERSION && nodenv global $VERSION -``` - -You may sometimes see a warning when running npm scripts with nodenv: - -```shell -npm WARN lifecycle The node binary used for scripts is [...] but npm is using [...] -``` - -This is due to nodenv's overriding behavior. To silence this harmless warning, the [nodenv docs](https://github.com/nodenv/nodenv/wiki/FAQ#npm-warning-about-mismatched-binaries) recommend running the following command from any directory: - -```shell -npm config set scripts-prepend-node-path auto -``` +1. Run `node --version` to check. If you see a different version, another version manager may be active in your shell. Check your shell profile. From e755a938bb80e20228732a352ba8c54b4ff90bfd Mon Sep 17 00:00:00 2001 From: Abhishek Date: Mon, 2 Nov 2026 17:46:46 +0000 Subject: [PATCH 2/5] Update docs with apm package manager support (#64485) Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> Co-authored-by: mc <42146119+mchammer01@users.noreply.github.com> --- .../dependabot-options-reference.md | 6 ++++ data/features/dependabot-apm-support.yml | 6 ++++ ...dabot-updates-supported-versioning-tags.md | 6 ++++ .../dependabot/supported-package-managers.md | 34 +++++++++++++++++++ 4 files changed, 52 insertions(+) create mode 100644 data/features/dependabot-apm-support.yml diff --git a/content/code-security/reference/supply-chain-security/dependabot-options-reference.md b/content/code-security/reference/supply-chain-security/dependabot-options-reference.md index 93e4c9a883ed..57b98e298ead 100644 --- a/content/code-security/reference/supply-chain-security/dependabot-options-reference.md +++ b/content/code-security/reference/supply-chain-security/dependabot-options-reference.md @@ -231,6 +231,9 @@ The table below shows the package managers that support `cooldown`. The `default | Package manager | Default days supported | SemVer-bump days supported | |-----------------------|:----------------------:|:--------------------------:| +| {% ifversion dependabot-apm-support %} | +| APM | {% octicon "check" aria-label="Supported" %} | {% octicon "check" aria-label="Supported" %} | +| {% endif %} | | {% ifversion dependabot-bazel-support %} | | Bazel | {% octicon "check" aria-label="Supported" %} | {% octicon "x" aria-label="Not supported" %} | | {% endif %} | @@ -559,6 +562,9 @@ When either limit is reached, {% data variables.product.prodname_dependabot %} r Package manager | YAML value | Supported versions | ---------------|------------------|:------------------:| +| {% ifversion dependabot-apm-support %} | +| APM | `apm` | Not applicable | +| {% endif %} | | {% ifversion dependabot-bazel-support %} | | Bazel | `bazel` | v7, v8, v9 | | {% endif %} | diff --git a/data/features/dependabot-apm-support.yml b/data/features/dependabot-apm-support.yml new file mode 100644 index 000000000000..c72f2aa16a03 --- /dev/null +++ b/data/features/dependabot-apm-support.yml @@ -0,0 +1,6 @@ +# Reference: https://github.com/github/releases/issues/11469 +# APM (Agent Package Manager) support for Dependabot +versions: + fpt: '*' + ghec: '*' + ghes: '>= 3.24' diff --git a/data/reusables/dependabot/dependabot-updates-supported-versioning-tags.md b/data/reusables/dependabot/dependabot-updates-supported-versioning-tags.md index e91f0e0ec017..c4597da883de 100644 --- a/data/reusables/dependabot/dependabot-updates-supported-versioning-tags.md +++ b/data/reusables/dependabot/dependabot-updates-supported-versioning-tags.md @@ -24,6 +24,9 @@ The `dependabot.yml` file doesn't control the versioning tags that you can use, | Docker | `docker` | `alpha`, `beta`, `rc`, `dev`, `preview`, `pre`, `nightly`, `snapshot`, `canary`, `unstable` (heuristic detection) | `nginx@1.25.0-rc1`, `node@20.0.0-alpha.1`, `redis@7.0.0-nightly`, `alpine@3.18.0-dev`, `ubuntu@22.04-preview` | | git submodule | `gitsubmodule` | None—pins to commit SHAs or git tags (no versioning scheme) | `my-lib@abc1234`, `shared-utils@v1.2.0` | | Go modules | `gomod` | `alpha`, `beta`, `rc` (SemVer prerelease after `-`) | `github.com/go-chi/chi@v5.0.0-rc1`, `google.golang.org/grpc@v1.60.0-beta.1`, `github.com/octo-org/octo-module@v0.17.0-alpha.1` | +| {% ifversion dependabot-apm-support %} | +| APM | `apm` | Any SemVer prerelease identifier (commonly `alpha`, `beta`, `rc`) | `microsoft/edge-ai#v1.1.0-rc.1`, `octo-org/octo-skills/skills/review#review-v2.0.0-beta.1` | +| {% endif %} | | {% ifversion dependabot-bazel-support %} | | Bazel | `bazel` | Any SemVer prerelease identifier (commonly `alpha`, `beta`, `rc`) | `rules_go@0.46.0-rc1`, `rules_rust@0.40.0-beta`, `bazel_skylib@1.5.0-alpha` | | {% endif %} | @@ -75,6 +78,9 @@ The following details describe how {% data variables.product.prodname_dependabot * **Elm:** Enforces strict SemVer (`MAJOR.MINOR.PATCH` integers only). The Elm package registry does not allow publishing prerelease versions. {% data variables.product.prodname_dependabot %} compares versions numerically. * **Go modules:** Follows SemVer with a mandatory `v` prefix. Pseudo-versions (`v0.0.0-YYYYMMDDHHMMSS-commithash`) represent unreleased commits and are always treated as prerelease. The `+incompatible` suffix marks modules at major version 2+ without a `go.mod` file and does not affect version ordering. * **git submodule:** {% data variables.product.prodname_dependabot %} tracks the latest commit on the configured branch. There is no version comparison—updates always move the pinned SHA forward. If the submodule tracks a tag, {% data variables.product.prodname_dependabot %} follows the tag's commit. +{% ifversion dependabot-apm-support %} +* **APM:** Resolves dependency versions from git tags. Both plain tags (`v1.4.0`) and package-scoped tags (`review-v1.4.0`, `review--v1.4.0`, `review_v1.4.0`) are recognized. The prefix of a package-scoped tag must match the package name, which is the repository name or the last component of a virtual package path. Build metadata (`+...`) is ignored for version precedence. Commit SHA pins only move to annotated, non-prerelease release tags. +{% endif %} {% ifversion dependabot-bazel-support %} * **Bazel:** Follows SemVer prerelease conventions. The Bazel Central Registry (BCR) `.bcr.N` suffix is stripped before comparison and does not affect prerelease detection. {% endif %} diff --git a/data/reusables/dependabot/supported-package-managers.md b/data/reusables/dependabot/supported-package-managers.md index 5c450cdb649f..e7075b30d306 100644 --- a/data/reusables/dependabot/supported-package-managers.md +++ b/data/reusables/dependabot/supported-package-managers.md @@ -2,6 +2,9 @@ Package manager | YAML value | Supported versions | Version updates | Security updates | Private repositories | Private registries | Vendoring | ---------------|------------------|------------------|:---:|:---:|:---:|:---:|:---:| +| {% ifversion dependabot-apm-support %} | +[APM](#apm) | `apm` | Not applicable | {% octicon "check" aria-label="Supported" %} | {% octicon "x" aria-label="Not supported" %} | {% octicon "check" aria-label="Supported" %} | {% octicon "check" aria-label="Supported" %} (git only) | Not applicable | +| {% endif %} | | {% ifversion dependabot-bazel-support %} | Bazel | `bazel` | v7, v8, v9 | {% octicon "check" aria-label="Supported" %} | {% octicon "x" aria-label="Not supported" %} | {% octicon "check" aria-label="Supported" %} | {% octicon "x" aria-label="Not supported" %} | {% octicon "x" aria-label="Not supported" %} | | {% endif %} | @@ -70,6 +73,37 @@ uv | `uv` | v0.11 | {% octicon "check" aria-label=" For further information about ecosystem support for {% data variables.product.prodname_dependabot_security_updates %}, see also [AUTOTITLE](/code-security/reference/supply-chain-security/dependency-graph-supported-package-ecosystems). +{% ifversion dependabot-apm-support %} + +### APM + +{% data variables.product.prodname_dependabot %} can update git dependencies declared in `apm.yml` manifest files for APM (Agent Package Manager). Entries under both `dependencies.apm` and `devDependencies.apm` are updated. For more information about APM, see [`microsoft/apm` repository](https://github.com/microsoft/apm) in the `microsoft/apm` repository. + +How {% data variables.product.prodname_dependabot %} updates a dependency depends on how the dependency is pinned. + +| Pin type | Example | Behavior | +|---|---|---| +| SemVer tag | `octo-org/octo-skills#v1.0.0` | Updated to the latest SemVer tag. Both plain tags (`v1.4.0`) and package-scoped tags are supported. A package-scoped tag must start with the package name, which is the repository name or the last component of a virtual package path. For example, `octo-org/octo-skills/skills/review#review-v1.4.0`. | +| Commit SHA | `octo-org/octo-skills#<40-character SHA>` | Updated to the commit of the latest annotated, non-prerelease release tag. The tag name is added as a comment, for example `# v1.4.0`. | +| Branch | `octo-org/octo-skills#main` | Updated to the latest commit on the branch. Only `apm.lock.yaml` changes, because the manifest still names the branch. Requires an existing `apm.lock.yaml` file. | + +If your repository contains an `apm.lock.yaml` file, {% data variables.product.prodname_dependabot %} regenerates it by running `apm lock`. {% data variables.product.prodname_dependabot %} doesn't create a lockfile if one doesn't exist. + +{% data variables.product.prodname_dependabot %} doesn't update the following entries: + +* Object-form entries (`git:`, `registry:`, `id:`, or `path:` maps) and `mcp:` entries +* Entries without a ref, such as `octo-org/octo-skills` +* Local path entries, such as `./my-package` +* Entries hosted on Azure DevOps +* Entries that use an `http://` or `git://` clone URL +* Entries written as YAML block scalars (`>` or `|`) or as quoted strings that use escape sequences +* Abbreviated commit SHAs +* Shorthand entries, such as `octo-org/octo-skills#v1.2.0`, when the manifest sets `registries.default`. Entries that use an explicit clone URL are still updated. + +Private registry support uses git registries. You can configure access for private git repositories by specifying a git registry in your `dependabot.yml` file. See [AUTOTITLE](/code-security/how-tos/secure-your-supply-chain/manage-your-dependency-security/configure-access-to-private-registries#git). + +{% endif %} + ### Bun {% data variables.product.prodname_dependabot %} supports the current default text-based `bun.lock` file, but not the legacy binary `bun.lockb` file. The `bun.lock` file is supported in version 1.1.39 and above. For more information, see [Lockfile](https://bun.sh/docs/install/lockfile) in the Bun documentation. From 424fb583412143b8e8fc8160b82e540ffa1d6cdc Mon Sep 17 00:00:00 2001 From: Sachin Sandhu <167903774+v-sachin-sandhu@users.noreply.github.com> Date: Mon, 2 Nov 2026 18:08:20 +0000 Subject: [PATCH 3/5] Document private vulnerability report limits (#63541) Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> Co-authored-by: grconm <167924715+grconm@users.noreply.github.com> --- .../configure-for-a-repository.md | 13 +++++++++++++ .../report-privately.md | 12 ++++++++++++ 2 files changed, 25 insertions(+) diff --git a/content/code-security/how-tos/report-and-fix-vulnerabilities/configure-vulnerability-reporting/configure-for-a-repository.md b/content/code-security/how-tos/report-and-fix-vulnerabilities/configure-vulnerability-reporting/configure-for-a-repository.md index eab1bb0a6d04..0ded5a60453d 100644 --- a/content/code-security/how-tos/report-and-fix-vulnerabilities/configure-vulnerability-reporting/configure-for-a-repository.md +++ b/content/code-security/how-tos/report-and-fix-vulnerabilities/configure-vulnerability-reporting/configure-for-a-repository.md @@ -81,6 +81,19 @@ You can require reporters to associate at least one Common Weakness Enumeration 1. Under **{% data variables.product.UI_advanced_security %}**, to the right of **Private vulnerability reporting**, click **Settings**. 1. Under **Submission requirements**, enable **Require a CWE assignment**. +## About rate limits for private vulnerability reports + +To protect maintainers from spam and abuse, {% data variables.product.github %} limits how many private vulnerability reports your repository receives and each user can submit per 24-hour period. You can set a lower or higher limit for the total number of reports your repository accepts and exempt trusted reporters. Reports that trusted reporters submit to your repository do not count toward your repository's limits or their global report limit. Reports they submit to other repositories remain subject to the limits for those repositories. For details of the limits, see [AUTOTITLE](/code-security/how-tos/report-and-fix-vulnerabilities/report-privately#rate-limits-for-private-vulnerability-reports). + +To set a limit for reports to your repository or exempt trusted reporters: + +{% data reusables.repositories.navigate-to-repo %} +{% data reusables.repositories.sidebar-settings %} +{% data reusables.repositories.navigate-to-code-security-and-analysis %} +1. Under **{% data variables.product.UI_advanced_security %}**, to the right of **Private vulnerability reporting**, click **Settings**. +1. Set a custom limit for reports to your repository. +1. Add trusted reporters to exempt their reports to your repository from the reporting limits. + ## Configuring notifications for private vulnerability reporting {% data reusables.security-advisory.private-vulnerability-reporting-configure-notifications %} diff --git a/content/code-security/how-tos/report-and-fix-vulnerabilities/report-privately.md b/content/code-security/how-tos/report-and-fix-vulnerabilities/report-privately.md index 11e7cb4dd9d3..c546fa00a46d 100644 --- a/content/code-security/how-tos/report-and-fix-vulnerabilities/report-privately.md +++ b/content/code-security/how-tos/report-and-fix-vulnerabilities/report-privately.md @@ -33,3 +33,15 @@ If the repository doesn't have private vulnerability reporting enabled, you need {% data reusables.security-advisory.reporting-a-vulnerability-non-admin %} The next steps depend on the action taken by the repository maintainer. See [AUTOTITLE](/code-security/how-tos/report-and-fix-vulnerabilities/fix-reported-vulnerabilities/manage-vulnerability-reports). + +## Rate limits for private vulnerability reports + +To protect maintainers from spam and abuse, {% data variables.product.github %} limits the number of private vulnerability reports that you can submit: + +* You can submit a maximum of 25 reports per 24-hour period across repositories where you are not a trusted reporter. +* You can submit a maximum of 5 reports to a single repository per 24-hour period. +* By default, a repository accepts a maximum of 10 reports per 24-hour period from all reporters combined. + +Repository maintainers can set a lower or higher total limit for their repository and exempt trusted reporters. Reports to a repository where you are a trusted reporter are exempt from that repository's limits and do not count toward your global 25-report limit. Reports to other repositories still count toward both the global limit and each repository's limits. + +If you reach a rate limit, you will see a message when you try to submit a new report on {% data variables.product.github %}. Each 24-hour period starts with the first report that counts toward that limit, and the limit resets in full when the period ends. From dd3d6ed62da94bc5312f228bb4eefe65312a4cc0 Mon Sep 17 00:00:00 2001 From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com> Date: Mon, 2 Nov 2026 19:26:23 +0000 Subject: [PATCH 4/5] Bump @graphql-tools/load from 8.1.8 to 9.0.4 (#64447) Signed-off-by: dependabot[bot] Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> --- package-lock.json | 78 +++++++++++++++++++---------------------------- package.json | 2 +- 2 files changed, 33 insertions(+), 47 deletions(-) diff --git a/package-lock.json b/package-lock.json index e81940bef7d4..dbf6b2b18a1f 100644 --- a/package-lock.json +++ b/package-lock.json @@ -101,7 +101,7 @@ "@eslint/js": "^9.39.3", "@github/markdownlint-github": "^0.6.3", "@graphql-inspector/core": "^8.0.0", - "@graphql-tools/load": "^8.1.8", + "@graphql-tools/load": "^9.0.4", "@octokit/graphql": "9.0.1", "@octokit/plugin-retry": "8.0.1", "@octokit/request-error": "7.0.0", @@ -1312,76 +1312,75 @@ } }, "node_modules/@graphql-tools/load": { - "version": "8.1.8", - "resolved": "https://registry.npmjs.org/@graphql-tools/load/-/load-8.1.8.tgz", - "integrity": "sha512-gxO662b64qZSToK3N6XUxWG5E6HOUjlg5jEnmGvD4bMtGJ0HwEe/BaVZbBQemCfLkxYjwRIBiVfOY9o0JyjZJg==", + "version": "9.0.4", + "resolved": "https://registry.npmjs.org/@graphql-tools/load/-/load-9.0.4.tgz", + "integrity": "sha512-obVMJzI5aphUCJkwNae5Q+6oiObAk23upEw4/1otWesPj6NL1DixKn6OP0oeP3/N52sPXsUtzOWcLJsUGkM1SA==", "dev": true, "license": "MIT", "dependencies": { - "@graphql-tools/schema": "^10.0.31", - "@graphql-tools/utils": "^11.0.0", + "@graphql-tools/schema": "^11.0.4", + "@graphql-tools/utils": "^13.1.1", "p-limit": "3.1.0", "tslib": "^2.4.0" }, "engines": { - "node": ">=16.0.0" + "node": ">=22.18.0" }, "peerDependencies": { - "graphql": "^14.0.0 || ^15.0.0 || ^16.0.0 || ^17.0.0" + "graphql": "^16.0.0 || ^17.0.0" } }, "node_modules/@graphql-tools/merge": { - "version": "9.1.7", - "resolved": "https://registry.npmjs.org/@graphql-tools/merge/-/merge-9.1.7.tgz", - "integrity": "sha512-Y5E1vTbTabvcXbkakdFUt4zUIzB1fyaEnVmIWN0l0GMed2gdD01TpZWLUm4RNAxpturvolrb24oGLQrBbPLSoQ==", + "version": "10.0.4", + "resolved": "https://registry.npmjs.org/@graphql-tools/merge/-/merge-10.0.4.tgz", + "integrity": "sha512-3Z1RBsRK7F8OGR2hR6D1Julyo0AZqw1wZmm1xn9eR4t+GPGq/7bY0ctMxbHxqeqMgnSlb2IxrTCSOh2yeFla5w==", "dev": true, "license": "MIT", "dependencies": { - "@graphql-tools/utils": "^11.0.0", + "@graphql-tools/utils": "^13.1.1", "tslib": "^2.4.0" }, "engines": { - "node": ">=16.0.0" + "node": ">=22.18.0" }, "peerDependencies": { - "graphql": "^14.0.0 || ^15.0.0 || ^16.0.0 || ^17.0.0" + "graphql": "^16.0.0 || ^17.0.0" } }, "node_modules/@graphql-tools/schema": { - "version": "10.0.31", - "resolved": "https://registry.npmjs.org/@graphql-tools/schema/-/schema-10.0.31.tgz", - "integrity": "sha512-ZewRgWhXef6weZ0WiP7/MV47HXiuFbFpiDUVLQl6mgXsWSsGELKFxQsyUCBos60Qqy1JEFAIu3Ns6GGYjGkqkQ==", + "version": "11.0.4", + "resolved": "https://registry.npmjs.org/@graphql-tools/schema/-/schema-11.0.4.tgz", + "integrity": "sha512-jJQY+RkSctB7QkOzc47KCuaAcxZDPucbihgCI17zgU7jVaobPi0f6xE54JQPbJIMP9m7n6CoQoE9I/xVFFrYpw==", "dev": true, "license": "MIT", "dependencies": { - "@graphql-tools/merge": "^9.1.7", - "@graphql-tools/utils": "^11.0.0", + "@graphql-tools/merge": "^10.0.4", + "@graphql-tools/utils": "^13.1.1", "tslib": "^2.4.0" }, "engines": { - "node": ">=16.0.0" + "node": ">=22.18.0" }, "peerDependencies": { - "graphql": "^14.0.0 || ^15.0.0 || ^16.0.0 || ^17.0.0" + "graphql": "^16.0.0 || ^17.0.0" } }, "node_modules/@graphql-tools/utils": { - "version": "11.0.0", - "resolved": "https://registry.npmjs.org/@graphql-tools/utils/-/utils-11.0.0.tgz", - "integrity": "sha512-bM1HeZdXA2C3LSIeLOnH/bcqSgbQgKEDrjxODjqi3y58xai2TkNrtYcQSoWzGbt9VMN1dORGjR7Vem8SPnUFQA==", + "version": "13.1.1", + "resolved": "https://registry.npmjs.org/@graphql-tools/utils/-/utils-13.1.1.tgz", + "integrity": "sha512-3o36m/WESYlKGrhwOzX3DAmQe9N2al0FJvZkBY4z4NYlUG5Bc2ZqUxQHbL6hBhUY+MhDMI/EXAJW0YbhggzhvQ==", "dev": true, "license": "MIT", "dependencies": { - "@graphql-typed-document-node/core": "^3.1.1", - "@whatwg-node/promise-helpers": "^1.0.0", - "cross-inspect": "1.0.1", + "@graphql-typed-document-node/core": "^3.2.0", + "@whatwg-node/promise-helpers": "^2.0.0", "tslib": "^2.4.0" }, "engines": { - "node": ">=16.0.0" + "node": ">=22.18.0" }, "peerDependencies": { - "graphql": "^14.0.0 || ^15.0.0 || ^16.0.0 || ^17.0.0" + "graphql": "^16.0.0 || ^17.0.0" } }, "node_modules/@graphql-typed-document-node/core": { @@ -5211,16 +5210,16 @@ } }, "node_modules/@whatwg-node/promise-helpers": { - "version": "1.3.2", - "resolved": "https://registry.npmjs.org/@whatwg-node/promise-helpers/-/promise-helpers-1.3.2.tgz", - "integrity": "sha512-Nst5JdK47VIl9UcGwtv2Rcgyn5lWtZ0/mhRQ4G8NN2isxpq2TO30iqHzmwoJycjWuyUfg3GFXqP/gFHXeV57IA==", + "version": "2.0.0", + "resolved": "https://registry.npmjs.org/@whatwg-node/promise-helpers/-/promise-helpers-2.0.0.tgz", + "integrity": "sha512-/i9CS0Z96o+cPwaYoAyVxAThDiUX1wV3tDmNWPJbn+vtdR+JftuCDg1NGCXBrzIYVDGkJ8uT6ctwmrBOUzOpKQ==", "dev": true, "license": "MIT", "dependencies": { "tslib": "^2.6.3" }, "engines": { - "node": ">=16.0.0" + "node": ">=22.15.0" } }, "node_modules/@whatwg-node/promise-helpers/node_modules/tslib": { @@ -6630,19 +6629,6 @@ "node": ">=20" } }, - "node_modules/cross-inspect": { - "version": "1.0.1", - "resolved": "https://registry.npmjs.org/cross-inspect/-/cross-inspect-1.0.1.tgz", - "integrity": "sha512-Pcw1JTvZLSJH83iiGWt6fRcT+BjZlCDRVwYLbUcHzv/CRpB7r0MlSrGbIyQvVSNyGnbt7G4AXuyCiDR3POvZ1A==", - "dev": true, - "license": "MIT", - "dependencies": { - "tslib": "^2.4.0" - }, - "engines": { - "node": ">=16.0.0" - } - }, "node_modules/cross-spawn": { "version": "7.0.6", "resolved": "https://registry.npmjs.org/cross-spawn/-/cross-spawn-7.0.6.tgz", diff --git a/package.json b/package.json index ac21bf3145f0..d95963a45e23 100644 --- a/package.json +++ b/package.json @@ -260,7 +260,7 @@ "@eslint/js": "^9.39.3", "@github/markdownlint-github": "^0.6.3", "@graphql-inspector/core": "^8.0.0", - "@graphql-tools/load": "^8.1.8", + "@graphql-tools/load": "^9.0.4", "@octokit/graphql": "9.0.1", "@octokit/plugin-retry": "8.0.1", "@octokit/request-error": "7.0.0", From 632229debe7487d49681b2d2d383e9cb51ebb3c3 Mon Sep 17 00:00:00 2001 From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com> Date: Mon, 2 Nov 2026 19:26:29 +0000 Subject: [PATCH 5/5] Bump github/gh-base-image/gh-base-noble from 20261022-141141-gfa3bc27f7 to 20261028-150140-g8ff90a672 in the baseimages group across 1 directory (#64471) Signed-off-by: dependabot[bot] Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> --- Dockerfile | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/Dockerfile b/Dockerfile index b60d04df82ef..b4a08a87888b 100644 --- a/Dockerfile +++ b/Dockerfile @@ -4,7 +4,7 @@ # Update the base image digest from the gh-base-noble package page: # https://github.com/github/gh-base-image/pkgs/container/gh-base-image%2Fgh-base-noble -FROM ghcr.io/github/gh-base-image/gh-base-noble:20261022-141141-gfa3bc27f7@sha256:c1175f242e207eeaf679305e553b6f1a2f69d06fa7b3840b199c5c33da2de130 AS base +FROM ghcr.io/github/gh-base-image/gh-base-noble:20261028-150140-g8ff90a672@sha256:2f8cb0ab06a0547bd9d70a81829f680208e7e6852d1e6abc1f68569d414e3d00 AS base # Install curl for NodeSource setup. # Install git for early-access and translation clones. # Ubuntu's nodejs package lags the Node LTS release line.