Repository navigation
chore(deps): consolidate open Dependabot updates into one PR - #81
Merged
Merged
Conversation
Workflow refs: init v4.39.0->v4.39.1,autobuild v4.39.0->v4.39.1,install-action v2.87.29->v2.87.30. All references of each multi-step action move in one commit so workflows such as CodeQL run against a single action version; single-step Dependabot PRs leave the steps of one workflow on different versions and fail their own CI. I also grouped github-actions updates in .github/dependabot.yml so future action bumps arrive as one weekly PR instead of one PR per workflow step.
github-actions
Bot
added
ci
tokio 1.53.x before 1.53.3 has AsyncFd constructors that violate I/O safety (RUSTSEC-2026-0386); the lockfile now tracks 1.54.1. cargo-deny treats the unsound advisory as an error, so every fresh CI run fails without this.
Dependabot had not opened the analyze step PR yet, so the consolidation left analyze on 4.39.0 while init and autobuild moved to 4.39.1, which fails CodeQL with the version-mismatch error in the opposite direction.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Consolidates the currently open Dependabot PRs so every reference moves together and CI can pass:
Workflow refs:
github/codeql-action/init@6f2ac81f5cd81fe351a197ba0b00d91d03cd2aee # v4.39.0->github/codeql-action/init@9b3254085494b55a0f7c4c2b3d2d52cc712ce370 # v4.39.1github/codeql-action/autobuild@6f2ac81f5cd81fe351a197ba0b00d91d03cd2aee # v4.39.0->github/codeql-action/autobuild@9b3254085494b55a0f7c4c2b3d2d52cc712ce370 # v4.39.1taiki-e/install-action@8cca0918f8471c33515202b73f56ab27f2bed283 # v2.87.29->taiki-e/install-action@a4d3f3f761dcd95cce1b72cb61cb6d1963438177 # v2.87.30I also added a
groups.actionsblock for the github-actions ecosystem in.github/dependabot.yml, so future action bumps land as a single weekly PR instead of one PR per workflow step (the same grouping the npm, go-modules, gradle and pip ecosystems already use here).Supersedes:
Each superseded PR moves only one step of a shared workflow, which trips the CodeQL version-mismatch check (
All steps in a workflow that use github/codeql-action must use the same version), so they cannot go green individually.