From d7f7b31e12c418aed3819be9bc8acf114f76316c Mon Sep 17 00:00:00 2001 From: Christian Bager Bach Houmann Date: Sat, 13 Jun 2026 20:14:33 +0200 Subject: [PATCH 1/5] build(deps): pin svelte/joi/uuid overrides to patched versions Clears all 9 open Dependabot advisories. All are transitive and unreachable, but the pins remove the vulnerable copies from the trees entirely. Root (pnpm-lock.yaml): bump the obsidian-calendar-ui>svelte override 3.59.2 -> ^5.56.3 so it dedupes onto the already-bundled, already-patched svelte 5.56.3 instead of pinning the EOL 3.x that accumulated every new Svelte advisory (CVE-2024-45047 + CVE-2026-27121/27122/27125/27901/42573/42599). The subtree is never bundled (dataview's dist imports no calendar-ui; treeShaking on), verified by a production build: 0 svelte/internal refs in main.js. Docs (docs/pnpm-lock.yaml): add joi ^17.13.4 (CVE-2026-48038) and uuid ^11.1.1 (CVE-2026-41907) overrides; both are Docusaurus build/dev-time transitives. Verified: pnpm audit clean (root + docs), build + 1856 tests pass, docs build OK. --- docs/package.json | 4 +++- docs/pnpm-lock.yaml | 21 +++++++++++---------- package.json | 2 +- pnpm-lock.yaml | 21 +++++++++------------ 4 files changed, 24 insertions(+), 24 deletions(-) diff --git a/docs/package.json b/docs/package.json index 9638f69d..0451f46a 100644 --- a/docs/package.json +++ b/docs/package.json @@ -33,7 +33,9 @@ "pnpm": { "overrides": { "webpackbar": "^7.0.0", - "serialize-javascript": "^7.0.3" + "serialize-javascript": "^7.0.3", + "joi": "^17.13.4", + "uuid": "^11.1.1" } }, "browserslist": { diff --git a/docs/pnpm-lock.yaml b/docs/pnpm-lock.yaml index 81daf15d..988c6bcb 100644 --- a/docs/pnpm-lock.yaml +++ b/docs/pnpm-lock.yaml @@ -7,6 +7,8 @@ settings: overrides: webpackbar: ^7.0.0 serialize-javascript: ^7.0.3 + joi: ^17.13.4 + uuid: ^11.1.1 importers: @@ -3318,8 +3320,8 @@ packages: resolution: {integrity: sha512-/imKNG4EbWNrVjoNC/1H5/9GFy+tqjGBHCaSsN+P2RnPqjsLmv6UD3Ej+Kj8nBWaRAwyk7kK5ZUc+OEatnTR3A==} hasBin: true - joi@17.13.3: - resolution: {integrity: sha512-otDA4ldcIx+ZXsKHWmp0YizCweVRZG96J10b0FevjfuncLO1oX59THoAmHkNubYJ+9gWsYsp5k8v4ib6oDv1fA==} + joi@17.13.4: + resolution: {integrity: sha512-1RuuER6kmt8K8I3nIWvPZKi5RQCb568ZPyY4Pwjlua+yo+63ZTmIwxLZH0heBmiKN4uxjvCiarDrjaeH84xicQ==} js-tokens@4.0.0: resolution: {integrity: sha512-RdJUflcE3cUzKiMqQgsCu06FPu9UdIJO0beYbPhHN4k6apgJtifcoCtT9bcxOpYBtpD2kCM6Sbzg4CausW/PKQ==} @@ -5083,9 +5085,8 @@ packages: resolution: {integrity: sha512-pMZTvIkT1d+TFGvDOqodOclx0QWkkgi6Tdoa8gC8ffGAAqz9pzPTZWAybbsHHoED/ztMtkv/VoYTYyShUn81hA==} engines: {node: '>= 0.4.0'} - uuid@8.3.2: - resolution: {integrity: sha512-+NYs2QeMWy+GWFOEm9xnn6HCDp0l7QBD7ml8zLUmJ+93Q5NF0NocErnwkTkXVFNiX3/fpC6afS8Dhb/gz7R7eg==} - deprecated: uuid@10 and below is no longer supported. For ESM codebases, update to uuid@latest. For CommonJS codebases, use uuid@11 (but be aware this version will likely be deprecated in 2028). + uuid@11.1.1: + resolution: {integrity: sha512-vIYxrBCC/N/K+Js3qSN88go7kIfNPssr/hHCesKCQNAjmgvYS2oqr69kIufEG+O4+PfezOH4EbIeHCfFov8ZgQ==} hasBin: true value-equal@1.0.1: @@ -7276,7 +7277,7 @@ snapshots: '@types/mdast': 4.0.4 '@types/react': 19.2.17 commander: 5.1.0 - joi: 17.13.3 + joi: 17.13.4 react: 19.2.7 react-dom: 19.2.7(react@19.2.7) react-helmet-async: '@slorber/react-helmet-async@1.3.0(react-dom@19.2.7(react@19.2.7))(react@19.2.7)' @@ -7327,7 +7328,7 @@ snapshots: '@docusaurus/utils': 3.10.1(clean-css@5.3.3)(cssnano@6.1.2(postcss@8.5.15))(html-minifier-terser@7.2.0)(postcss@8.5.15)(react-dom@19.2.7(react@19.2.7))(react@19.2.7) '@docusaurus/utils-common': 3.10.1(clean-css@5.3.3)(cssnano@6.1.2(postcss@8.5.15))(html-minifier-terser@7.2.0)(postcss@8.5.15)(react-dom@19.2.7(react@19.2.7))(react@19.2.7) fs-extra: 11.3.5 - joi: 17.13.3 + joi: 17.13.4 js-yaml: 4.2.0 lodash: 4.18.1 tslib: 2.8.1 @@ -9796,7 +9797,7 @@ snapshots: jiti@1.21.7: {} - joi@17.13.3: + joi@17.13.4: dependencies: '@hapi/hoek': 9.3.0 '@hapi/topo': 5.1.0 @@ -11645,7 +11646,7 @@ snapshots: sockjs@0.3.24: dependencies: faye-websocket: 0.11.4 - uuid: 8.3.2 + uuid: 11.1.1 websocket-driver: 0.7.5 sort-css-media-queries@2.2.0: {} @@ -11956,7 +11957,7 @@ snapshots: utils-merge@1.0.1: {} - uuid@8.3.2: {} + uuid@11.1.1: {} value-equal@1.0.1: {} diff --git a/package.json b/package.json index 993c0952..8d8dc34a 100644 --- a/package.json +++ b/package.json @@ -66,7 +66,7 @@ "esbuild" ], "overrides": { - "obsidian-calendar-ui>svelte": "^3.59.2" + "obsidian-calendar-ui>svelte": "^5.56.3" } }, "release": { diff --git a/pnpm-lock.yaml b/pnpm-lock.yaml index 564e4e41..107b3bd0 100644 --- a/pnpm-lock.yaml +++ b/pnpm-lock.yaml @@ -5,7 +5,7 @@ settings: excludeLinksFromLockfile: false overrides: - obsidian-calendar-ui>svelte: ^3.59.2 + obsidian-calendar-ui>svelte: ^5.56.3 importers: @@ -22,7 +22,7 @@ importers: version: 7.4.2 obsidian-dataview: specifier: ^0.5.68 - version: 0.5.68 + version: 0.5.68(@typescript-eslint/types@8.61.0) svelte-dnd-action: specifier: 0.9.69 version: 0.9.69(svelte@5.56.3(@typescript-eslint/types@8.61.0)) @@ -3026,10 +3026,6 @@ packages: typescript: optional: true - svelte@3.59.2: - resolution: {integrity: sha512-vzSyuGr3eEoAtT/A6bmajosJZIUWySzY2CzB3w2pgPvnkUjGqlDnsNnA0PMO+mMAhuyMul6C2uuZzY6ELSkzyA==} - engines: {node: '>= 8'} - svelte@5.56.3: resolution: {integrity: sha512-w7JvrM5IFl5cmfbY0TLik9o7mjRUJmRMhOR51tBPu708Gr/MjbGs7VnJnr/B0CaXeI4vtnOh7RKxDr0cwhMdDA==} engines: {node: '>=18'} @@ -5450,14 +5446,15 @@ snapshots: object-assign@4.1.1: {} - obsidian-calendar-ui@0.3.12(@codemirror/state@6.6.0)(@codemirror/view@6.43.1): + obsidian-calendar-ui@0.3.12(@codemirror/state@6.6.0)(@codemirror/view@6.43.1)(@typescript-eslint/types@8.61.0): dependencies: obsidian-daily-notes-interface: 0.8.4(@codemirror/state@6.6.0)(@codemirror/view@6.43.1) - svelte: 3.59.2 + svelte: 5.56.3(@typescript-eslint/types@8.61.0) tslib: 2.1.0 transitivePeerDependencies: - '@codemirror/state' - '@codemirror/view' + - '@typescript-eslint/types' obsidian-daily-notes-interface@0.8.4(@codemirror/state@6.6.0)(@codemirror/view@6.43.1): dependencies: @@ -5467,7 +5464,7 @@ snapshots: - '@codemirror/state' - '@codemirror/view' - obsidian-dataview@0.5.68: + obsidian-dataview@0.5.68(@typescript-eslint/types@8.61.0): dependencies: '@codemirror/language': https://codeload.github.com/lishid/cm-language/tar.gz/b817e72a9861b3f8a50a92a2ea53cbafc4f88eb3 '@codemirror/state': 6.6.0 @@ -5475,11 +5472,13 @@ snapshots: emoji-regex: 10.6.0 localforage: 1.10.0 luxon: 3.7.2 - obsidian-calendar-ui: 0.3.12(@codemirror/state@6.6.0)(@codemirror/view@6.43.1) + obsidian-calendar-ui: 0.3.12(@codemirror/state@6.6.0)(@codemirror/view@6.43.1)(@typescript-eslint/types@8.61.0) papaparse: 5.5.3 parsimmon: 1.18.1 preact: 10.29.2 remove-markdown: 0.5.5 + transitivePeerDependencies: + - '@typescript-eslint/types' obsidian-e2e@0.6.0(vite-plus@0.1.24(@types/node@25.9.2)(@vitest/coverage-v8@4.1.8)(esbuild@0.28.1)(jiti@2.6.1)(jsdom@29.1.1)(svelte@5.56.3(@typescript-eslint/types@8.61.0))(typescript@6.0.3)(vite@8.0.16(@types/node@25.9.2)(esbuild@0.28.1)(jiti@2.6.1)(yaml@2.9.0))(yaml@2.9.0)): dependencies: @@ -6028,8 +6027,6 @@ snapshots: postcss-load-config: 3.1.4(postcss@8.5.15) typescript: 6.0.3 - svelte@3.59.2: {} - svelte@5.56.3(@typescript-eslint/types@8.61.0): dependencies: '@jridgewell/remapping': 2.3.5 From fdde72ddae1deb45b89b20b2d96d615f2b11dccc Mon Sep 17 00:00:00 2001 From: Christian Bager Bach Houmann Date: Sat, 13 Jun 2026 20:14:33 +0200 Subject: [PATCH 2/5] ci: tighten dependency-review and scan Actions with CodeQL - dependency-review: move to its own workflow that runs on ALL PRs (the root CI path-ignores docs/**, so docs lockfile bumps were unreviewed); raise the gate from fail-on-severity:high to moderate and add fail-on-scopes:runtime,development. - codeql: add the 'actions' language so workflow files get scanned too. --- .github/workflows/ci.yml | 18 ----------- .github/workflows/codeql.yml | 2 +- .github/workflows/dependency-review.yml | 40 +++++++++++++++++++++++++ 3 files changed, 41 insertions(+), 19 deletions(-) create mode 100644 .github/workflows/dependency-review.yml diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index ece84d31..5a99fac3 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -72,21 +72,3 @@ jobs: run: pnpm run build-with-lint - name: Svelte check run: pnpm run check - - dependency-review: - name: Dependency Review - runs-on: ubuntu-latest - if: github.event_name == 'pull_request' - permissions: - contents: read - pull-requests: write - steps: - - name: Checkout - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3 - with: - persist-credentials: false - - name: Dependency Review - uses: actions/dependency-review-action@a1d282b36b6f3519aa1f3fc636f609c47dddb294 # v5.0.0 - with: - comment-summary-in-pr: on-failure - fail-on-severity: high diff --git a/.github/workflows/codeql.yml b/.github/workflows/codeql.yml index cc56d0f4..a90a6ad5 100644 --- a/.github/workflows/codeql.yml +++ b/.github/workflows/codeql.yml @@ -26,7 +26,7 @@ jobs: strategy: fail-fast: false matrix: - language: [javascript-typescript] + language: [javascript-typescript, actions] steps: - name: Harden Runner uses: step-security/harden-runner@9af89fc71515a100421586dfdb3dc9c984fbf411 # v2.19.4 diff --git a/.github/workflows/dependency-review.yml b/.github/workflows/dependency-review.yml new file mode 100644 index 00000000..bd44e4ee --- /dev/null +++ b/.github/workflows/dependency-review.yml @@ -0,0 +1,40 @@ +name: Dependency Review + +# Runs on every PR (no paths-ignore) so changes to docs/pnpm-lock.yaml are +# scanned too — the root CI workflow path-ignores docs/**, which previously +# left docs dependency bumps unreviewed. +on: + pull_request: + branches: [master] + +concurrency: + group: dep-review-${{ github.workflow }}-${{ github.ref }} + cancel-in-progress: true + +permissions: + contents: read + +jobs: + dependency-review: + name: Dependency Review + runs-on: ubuntu-latest + permissions: + contents: read + pull-requests: write + steps: + - name: Harden Runner + uses: step-security/harden-runner@9af89fc71515a100421586dfdb3dc9c984fbf411 # v2.19.4 + with: + egress-policy: audit + - name: Checkout + uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3 + with: + persist-credentials: false + - name: Dependency Review + uses: actions/dependency-review-action@a1d282b36b6f3519aa1f3fc636f609c47dddb294 # v5.0.0 + with: + comment-summary-in-pr: on-failure + # Block newly-introduced moderate+ advisories in both runtime + # AND development scopes (the default only fails on runtime/high). + fail-on-severity: moderate + fail-on-scopes: runtime, development From b9cfb25e56544f669334deb95fd277a21bbd146d Mon Sep 17 00:00:00 2001 From: Christian Bager Bach Houmann Date: Sat, 13 Jun 2026 20:28:35 +0200 Subject: [PATCH 3/5] build(deps): roll in routine Dependabot bumps (consolidate #1323, #1324) Folds the open non-security Dependabot PRs into this branch so there's a single dependency PR with one coherent lockfile: - svelte-dnd-action 0.9.69 -> 0.9.70 (prod, bundled) [#1324] - obsidian 1.13.0 -> 1.13.1 (dev types) [#1323] - @types/node 25.9.2 -> 25.9.3 (dev types) [#1323] - eslint -> 10.5.0 (within existing "eslint":"10" range, lockfile) [#1323] Verified: pnpm install --frozen-lockfile consistent, audit clean, build OK, svelte-check 0 errors, 1856 tests pass (incl. drag-reorder suites). --- package.json | 6 +-- pnpm-lock.yaml | 108 ++++++++++++++++++++++++------------------------- 2 files changed, 57 insertions(+), 57 deletions(-) diff --git a/package.json b/package.json index 8d8dc34a..e64ded6c 100644 --- a/package.json +++ b/package.json @@ -23,7 +23,7 @@ "@testing-library/jest-dom": "^6.9.1", "@testing-library/svelte": "^5.3.1", "@testing-library/user-event": "^14.6.1", - "@types/node": "25.9.2", + "@types/node": "25.9.3", "@typescript-eslint/eslint-plugin": "^8.60.1", "@typescript-eslint/parser": "^8.60.1", "@vitest/coverage-v8": "4.1.8", @@ -33,7 +33,7 @@ "eslint-plugin-svelte": "^3.19.0", "globals": "17", "jsdom": "29", - "obsidian": "1.13.0", + "obsidian": "1.13.1", "obsidian-e2e": "0.6.0", "semantic-release": "^25.0.5", "svelte": "^5", @@ -50,7 +50,7 @@ "chrono-node": "^2.9.1", "fuse.js": "7", "obsidian-dataview": "^0.5.68", - "svelte-dnd-action": "0.9.69", + "svelte-dnd-action": "0.9.70", "three-way-merge": "^0.1.0", "uuid": "14", "zustand": "^5.0.14" diff --git a/pnpm-lock.yaml b/pnpm-lock.yaml index 107b3bd0..8db276c5 100644 --- a/pnpm-lock.yaml +++ b/pnpm-lock.yaml @@ -24,8 +24,8 @@ importers: specifier: ^0.5.68 version: 0.5.68(@typescript-eslint/types@8.61.0) svelte-dnd-action: - specifier: 0.9.69 - version: 0.9.69(svelte@5.56.3(@typescript-eslint/types@8.61.0)) + specifier: 0.9.70 + version: 0.9.70(svelte@5.56.3(@typescript-eslint/types@8.61.0)) three-way-merge: specifier: ^0.1.0 version: 0.1.0 @@ -44,19 +44,19 @@ importers: version: 10.0.1(semantic-release@25.0.5(typescript@6.0.3)) '@sveltejs/vite-plugin-svelte': specifier: ^7.1.2 - version: 7.1.2(svelte@5.56.3(@typescript-eslint/types@8.61.0))(vite@8.0.16(@types/node@25.9.2)(esbuild@0.28.1)(jiti@2.6.1)(yaml@2.9.0)) + version: 7.1.2(svelte@5.56.3(@typescript-eslint/types@8.61.0))(vite@8.0.16(@types/node@25.9.3)(esbuild@0.28.1)(jiti@2.6.1)(yaml@2.9.0)) '@testing-library/jest-dom': specifier: ^6.9.1 version: 6.9.1 '@testing-library/svelte': specifier: ^5.3.1 - version: 5.3.1(svelte@5.56.3(@typescript-eslint/types@8.61.0))(vite@8.0.16(@types/node@25.9.2)(esbuild@0.28.1)(jiti@2.6.1)(yaml@2.9.0))(vitest@4.1.8) + version: 5.3.1(svelte@5.56.3(@typescript-eslint/types@8.61.0))(vite@8.0.16(@types/node@25.9.3)(esbuild@0.28.1)(jiti@2.6.1)(yaml@2.9.0))(vitest@4.1.8) '@testing-library/user-event': specifier: ^14.6.1 version: 14.6.1(@testing-library/dom@10.4.1) '@types/node': - specifier: 25.9.2 - version: 25.9.2 + specifier: 25.9.3 + version: 25.9.3 '@typescript-eslint/eslint-plugin': specifier: ^8.60.1 version: 8.61.0(@typescript-eslint/parser@8.61.0(eslint@10.4.1(jiti@2.6.1))(typescript@6.0.3))(eslint@10.4.1(jiti@2.6.1))(typescript@6.0.3) @@ -85,11 +85,11 @@ importers: specifier: '29' version: 29.1.1 obsidian: - specifier: 1.13.0 - version: 1.13.0(@codemirror/state@6.5.0)(@codemirror/view@6.38.6) + specifier: 1.13.1 + version: 1.13.1(@codemirror/state@6.5.0)(@codemirror/view@6.38.6) obsidian-e2e: specifier: 0.6.0 - version: 0.6.0(vite-plus@0.1.24(@types/node@25.9.2)(@vitest/coverage-v8@4.1.8)(esbuild@0.28.1)(jiti@2.6.1)(jsdom@29.1.1)(svelte@5.56.3(@typescript-eslint/types@8.61.0))(typescript@6.0.3)(vite@8.0.16(@types/node@25.9.2)(esbuild@0.28.1)(jiti@2.6.1)(yaml@2.9.0))(yaml@2.9.0)) + version: 0.6.0(vite-plus@0.1.24(@types/node@25.9.3)(@vitest/coverage-v8@4.1.8)(esbuild@0.28.1)(jiti@2.6.1)(jsdom@29.1.1)(svelte@5.56.3(@typescript-eslint/types@8.61.0))(typescript@6.0.3)(vite@8.0.16(@types/node@25.9.3)(esbuild@0.28.1)(jiti@2.6.1)(yaml@2.9.0))(yaml@2.9.0)) semantic-release: specifier: ^25.0.5 version: 25.0.5(typescript@6.0.3) @@ -113,10 +113,10 @@ importers: version: 6.0.3 vite: specifier: ^8.0.16 - version: 8.0.16(@types/node@25.9.2)(esbuild@0.28.1)(jiti@2.6.1)(yaml@2.9.0) + version: 8.0.16(@types/node@25.9.3)(esbuild@0.28.1)(jiti@2.6.1)(yaml@2.9.0) vitest: specifier: ^4.1.8 - version: 4.1.8(@types/node@25.9.2)(@vitest/coverage-v8@4.1.8)(jsdom@29.1.1)(vite@8.0.16(@types/node@25.9.2)(esbuild@0.28.1)(jiti@2.6.1)(yaml@2.9.0)) + version: 4.1.8(@types/node@25.9.3)(@vitest/coverage-v8@4.1.8)(jsdom@29.1.1)(vite@8.0.16(@types/node@25.9.3)(esbuild@0.28.1)(jiti@2.6.1)(yaml@2.9.0)) packages: @@ -1081,8 +1081,8 @@ packages: '@types/json-schema@7.0.15': resolution: {integrity: sha512-5+fP8P8MFNC+AyZCDxrB2pkZFPGzqQWUzpSeuuVLvm8VMcorNYavBqoFcxK8bQz4Qsbn4oUEEem4wDLfcysGHA==} - '@types/node@25.9.2': - resolution: {integrity: sha512-G05zqtJhcDLb8uslf5EjCxXg9G1KQxiV8OS0R26IC//Eoyitzqe8z37I7cqvnZlrlSfgocQRfSn/AHBZJJFyGw==} + '@types/node@25.9.3': + resolution: {integrity: sha512-603BddQMv3pUcr4U2dhujk83N2tTDVr/34wII2B6bJy6g+8WD6yUb11jszNs0gdi4PesVWl7ABt8nYMVpnLUcg==} '@types/normalize-package-data@2.4.4': resolution: {integrity: sha512-37i+OaWTh9qeK4LSHPsyRC7NahnGotNuZvjLSgcPzblpHB3rrCJxAOgI5gCdKm7coonsaX1Of0ILiTcnZjbfxA==} @@ -2492,8 +2492,8 @@ packages: peerDependencies: vite-plus: ^0.1.11 - obsidian@1.13.0: - resolution: {integrity: sha512-PHw5+SAPlJ0S3leFvJ0wgFg63Z3DavxL6+d1ll+8toXR2ZlYKc1rMWqdUv9LgUbTwPQUyY6yfhOMMivampRRiQ==} + obsidian@1.13.1: + resolution: {integrity: sha512-qtTEA2pmhJzhuhJqzbBFRYhpIOqvW+krDYjtFynv66KbxBbumHBlsJfWw3I4jtnK/6fZwbQhCrmmDdRwXmX56w==} peerDependencies: '@codemirror/state': 6.5.0 '@codemirror/view': 6.38.6 @@ -2975,8 +2975,8 @@ packages: svelte: ^4.0.0 || ^5.0.0-next.0 typescript: '>=5.0.0' - svelte-dnd-action@0.9.69: - resolution: {integrity: sha512-NAmSOH7htJoYraTQvr+q5whlIuVoq88vEuHr4NcFgscDRUxfWPPxgie2OoxepBCQCikrXZV4pqV86aun60wVyw==} + svelte-dnd-action@0.9.70: + resolution: {integrity: sha512-iVqDAW1PtQArA96dHhM5Lwxj39iKNjIuYE+tqpq9DUaBWfv410SpGGFJ3NzPtvptx+YkXBzMYV3lpey8s07q+w==} peerDependencies: svelte: '>=3.23.0 || ^5.0.0-next.0' @@ -4124,14 +4124,14 @@ snapshots: '@sveltejs/load-config@0.1.1': {} - '@sveltejs/vite-plugin-svelte@7.1.2(svelte@5.56.3(@typescript-eslint/types@8.61.0))(vite@8.0.16(@types/node@25.9.2)(esbuild@0.28.1)(jiti@2.6.1)(yaml@2.9.0))': + '@sveltejs/vite-plugin-svelte@7.1.2(svelte@5.56.3(@typescript-eslint/types@8.61.0))(vite@8.0.16(@types/node@25.9.3)(esbuild@0.28.1)(jiti@2.6.1)(yaml@2.9.0))': dependencies: deepmerge: 4.3.1 magic-string: 0.30.21 obug: 2.1.2 svelte: 5.56.3(@typescript-eslint/types@8.61.0) - vite: 8.0.16(@types/node@25.9.2)(esbuild@0.28.1)(jiti@2.6.1)(yaml@2.9.0) - vitefu: 1.1.3(vite@8.0.16(@types/node@25.9.2)(esbuild@0.28.1)(jiti@2.6.1)(yaml@2.9.0)) + vite: 8.0.16(@types/node@25.9.3)(esbuild@0.28.1)(jiti@2.6.1)(yaml@2.9.0) + vitefu: 1.1.3(vite@8.0.16(@types/node@25.9.3)(esbuild@0.28.1)(jiti@2.6.1)(yaml@2.9.0)) '@testing-library/dom@10.4.1': dependencies: @@ -4157,14 +4157,14 @@ snapshots: dependencies: svelte: 5.56.3(@typescript-eslint/types@8.61.0) - '@testing-library/svelte@5.3.1(svelte@5.56.3(@typescript-eslint/types@8.61.0))(vite@8.0.16(@types/node@25.9.2)(esbuild@0.28.1)(jiti@2.6.1)(yaml@2.9.0))(vitest@4.1.8)': + '@testing-library/svelte@5.3.1(svelte@5.56.3(@typescript-eslint/types@8.61.0))(vite@8.0.16(@types/node@25.9.3)(esbuild@0.28.1)(jiti@2.6.1)(yaml@2.9.0))(vitest@4.1.8)': dependencies: '@testing-library/dom': 10.4.1 '@testing-library/svelte-core': 1.0.0(svelte@5.56.3(@typescript-eslint/types@8.61.0)) svelte: 5.56.3(@typescript-eslint/types@8.61.0) optionalDependencies: - vite: 8.0.16(@types/node@25.9.2)(esbuild@0.28.1)(jiti@2.6.1)(yaml@2.9.0) - vitest: 4.1.8(@types/node@25.9.2)(@vitest/coverage-v8@4.1.8)(jsdom@29.1.1)(vite@8.0.16(@types/node@25.9.2)(esbuild@0.28.1)(jiti@2.6.1)(yaml@2.9.0)) + vite: 8.0.16(@types/node@25.9.3)(esbuild@0.28.1)(jiti@2.6.1)(yaml@2.9.0) + vitest: 4.1.8(@types/node@25.9.3)(@vitest/coverage-v8@4.1.8)(jsdom@29.1.1)(vite@8.0.16(@types/node@25.9.3)(esbuild@0.28.1)(jiti@2.6.1)(yaml@2.9.0)) '@testing-library/user-event@14.6.1(@testing-library/dom@10.4.1)': dependencies: @@ -4194,7 +4194,7 @@ snapshots: '@types/json-schema@7.0.15': {} - '@types/node@25.9.2': + '@types/node@25.9.3': dependencies: undici-types: 7.24.6 @@ -4309,7 +4309,7 @@ snapshots: obug: 2.1.2 std-env: 4.1.0 tinyrainbow: 3.1.0 - vitest: 4.1.8(@types/node@25.9.2)(@vitest/coverage-v8@4.1.8)(jsdom@29.1.1)(vite@8.0.16(@types/node@25.9.2)(esbuild@0.28.1)(jiti@2.6.1)(yaml@2.9.0)) + vitest: 4.1.8(@types/node@25.9.3)(@vitest/coverage-v8@4.1.8)(jsdom@29.1.1)(vite@8.0.16(@types/node@25.9.3)(esbuild@0.28.1)(jiti@2.6.1)(yaml@2.9.0)) '@vitest/expect@4.1.8': dependencies: @@ -4320,13 +4320,13 @@ snapshots: chai: 6.2.2 tinyrainbow: 3.1.0 - '@vitest/mocker@4.1.8(vite@8.0.16(@types/node@25.9.2)(esbuild@0.28.1)(jiti@2.6.1)(yaml@2.9.0))': + '@vitest/mocker@4.1.8(vite@8.0.16(@types/node@25.9.3)(esbuild@0.28.1)(jiti@2.6.1)(yaml@2.9.0))': dependencies: '@vitest/spy': 4.1.8 estree-walker: 3.0.3 magic-string: 0.30.21 optionalDependencies: - vite: 8.0.16(@types/node@25.9.2)(esbuild@0.28.1)(jiti@2.6.1)(yaml@2.9.0) + vite: 8.0.16(@types/node@25.9.3)(esbuild@0.28.1)(jiti@2.6.1)(yaml@2.9.0) '@vitest/pretty-format@4.1.8': dependencies: @@ -4352,14 +4352,14 @@ snapshots: convert-source-map: 2.0.0 tinyrainbow: 3.1.0 - '@voidzero-dev/vite-plus-core@0.1.24(@types/node@25.9.2)(esbuild@0.28.1)(jiti@2.6.1)(typescript@6.0.3)(yaml@2.9.0)': + '@voidzero-dev/vite-plus-core@0.1.24(@types/node@25.9.3)(esbuild@0.28.1)(jiti@2.6.1)(typescript@6.0.3)(yaml@2.9.0)': dependencies: '@oxc-project/runtime': 0.133.0 '@oxc-project/types': 0.133.0 lightningcss: 1.32.0 postcss: 8.5.15 optionalDependencies: - '@types/node': 25.9.2 + '@types/node': 25.9.3 esbuild: 0.28.1 fsevents: 2.3.3 jiti: 2.6.1 @@ -4384,11 +4384,11 @@ snapshots: '@voidzero-dev/vite-plus-linux-x64-musl@0.1.24': optional: true - '@voidzero-dev/vite-plus-test@0.1.24(@types/node@25.9.2)(@vitest/coverage-v8@4.1.8)(esbuild@0.28.1)(jiti@2.6.1)(jsdom@29.1.1)(typescript@6.0.3)(vite@8.0.16(@types/node@25.9.2)(esbuild@0.28.1)(jiti@2.6.1)(yaml@2.9.0))(yaml@2.9.0)': + '@voidzero-dev/vite-plus-test@0.1.24(@types/node@25.9.3)(@vitest/coverage-v8@4.1.8)(esbuild@0.28.1)(jiti@2.6.1)(jsdom@29.1.1)(typescript@6.0.3)(vite@8.0.16(@types/node@25.9.3)(esbuild@0.28.1)(jiti@2.6.1)(yaml@2.9.0))(yaml@2.9.0)': dependencies: '@standard-schema/spec': 1.1.0 '@types/chai': 5.2.3 - '@voidzero-dev/vite-plus-core': 0.1.24(@types/node@25.9.2)(esbuild@0.28.1)(jiti@2.6.1)(typescript@6.0.3)(yaml@2.9.0) + '@voidzero-dev/vite-plus-core': 0.1.24(@types/node@25.9.3)(esbuild@0.28.1)(jiti@2.6.1)(typescript@6.0.3)(yaml@2.9.0) es-module-lexer: 1.7.0 obug: 2.1.2 pixelmatch: 7.2.0 @@ -4398,10 +4398,10 @@ snapshots: tinybench: 2.9.0 tinyexec: 1.2.4 tinyglobby: 0.2.17 - vite: 8.0.16(@types/node@25.9.2)(esbuild@0.28.1)(jiti@2.6.1)(yaml@2.9.0) + vite: 8.0.16(@types/node@25.9.3)(esbuild@0.28.1)(jiti@2.6.1)(yaml@2.9.0) ws: 8.21.0 optionalDependencies: - '@types/node': 25.9.2 + '@types/node': 25.9.3 '@vitest/coverage-v8': 4.1.8(vitest@4.1.8) jsdom: 29.1.1 transitivePeerDependencies: @@ -5480,12 +5480,12 @@ snapshots: transitivePeerDependencies: - '@typescript-eslint/types' - obsidian-e2e@0.6.0(vite-plus@0.1.24(@types/node@25.9.2)(@vitest/coverage-v8@4.1.8)(esbuild@0.28.1)(jiti@2.6.1)(jsdom@29.1.1)(svelte@5.56.3(@typescript-eslint/types@8.61.0))(typescript@6.0.3)(vite@8.0.16(@types/node@25.9.2)(esbuild@0.28.1)(jiti@2.6.1)(yaml@2.9.0))(yaml@2.9.0)): + obsidian-e2e@0.6.0(vite-plus@0.1.24(@types/node@25.9.3)(@vitest/coverage-v8@4.1.8)(esbuild@0.28.1)(jiti@2.6.1)(jsdom@29.1.1)(svelte@5.56.3(@typescript-eslint/types@8.61.0))(typescript@6.0.3)(vite@8.0.16(@types/node@25.9.3)(esbuild@0.28.1)(jiti@2.6.1)(yaml@2.9.0))(yaml@2.9.0)): dependencies: - vite-plus: 0.1.24(@types/node@25.9.2)(@vitest/coverage-v8@4.1.8)(esbuild@0.28.1)(jiti@2.6.1)(jsdom@29.1.1)(svelte@5.56.3(@typescript-eslint/types@8.61.0))(typescript@6.0.3)(vite@8.0.16(@types/node@25.9.2)(esbuild@0.28.1)(jiti@2.6.1)(yaml@2.9.0))(yaml@2.9.0) + vite-plus: 0.1.24(@types/node@25.9.3)(@vitest/coverage-v8@4.1.8)(esbuild@0.28.1)(jiti@2.6.1)(jsdom@29.1.1)(svelte@5.56.3(@typescript-eslint/types@8.61.0))(typescript@6.0.3)(vite@8.0.16(@types/node@25.9.3)(esbuild@0.28.1)(jiti@2.6.1)(yaml@2.9.0))(yaml@2.9.0) yaml: 2.9.0 - obsidian@1.13.0(@codemirror/state@6.5.0)(@codemirror/view@6.38.6): + obsidian@1.13.1(@codemirror/state@6.5.0)(@codemirror/view@6.38.6): dependencies: '@codemirror/state': 6.5.0 '@codemirror/view': 6.38.6 @@ -5518,7 +5518,7 @@ snapshots: type-check: 0.4.0 word-wrap: 1.2.5 - oxfmt@0.52.0(svelte@5.56.3(@typescript-eslint/types@8.61.0))(vite-plus@0.1.24(@types/node@25.9.2)(@vitest/coverage-v8@4.1.8)(esbuild@0.28.1)(jiti@2.6.1)(jsdom@29.1.1)(svelte@5.56.3(@typescript-eslint/types@8.61.0))(typescript@6.0.3)(vite@8.0.16(@types/node@25.9.2)(esbuild@0.28.1)(jiti@2.6.1)(yaml@2.9.0))(yaml@2.9.0)): + oxfmt@0.52.0(svelte@5.56.3(@typescript-eslint/types@8.61.0))(vite-plus@0.1.24(@types/node@25.9.3)(@vitest/coverage-v8@4.1.8)(esbuild@0.28.1)(jiti@2.6.1)(jsdom@29.1.1)(svelte@5.56.3(@typescript-eslint/types@8.61.0))(typescript@6.0.3)(vite@8.0.16(@types/node@25.9.3)(esbuild@0.28.1)(jiti@2.6.1)(yaml@2.9.0))(yaml@2.9.0)): dependencies: tinypool: 2.1.0 optionalDependencies: @@ -5542,7 +5542,7 @@ snapshots: '@oxfmt/binding-win32-ia32-msvc': 0.52.0 '@oxfmt/binding-win32-x64-msvc': 0.52.0 svelte: 5.56.3(@typescript-eslint/types@8.61.0) - vite-plus: 0.1.24(@types/node@25.9.2)(@vitest/coverage-v8@4.1.8)(esbuild@0.28.1)(jiti@2.6.1)(jsdom@29.1.1)(svelte@5.56.3(@typescript-eslint/types@8.61.0))(typescript@6.0.3)(vite@8.0.16(@types/node@25.9.2)(esbuild@0.28.1)(jiti@2.6.1)(yaml@2.9.0))(yaml@2.9.0) + vite-plus: 0.1.24(@types/node@25.9.3)(@vitest/coverage-v8@4.1.8)(esbuild@0.28.1)(jiti@2.6.1)(jsdom@29.1.1)(svelte@5.56.3(@typescript-eslint/types@8.61.0))(typescript@6.0.3)(vite@8.0.16(@types/node@25.9.3)(esbuild@0.28.1)(jiti@2.6.1)(yaml@2.9.0))(yaml@2.9.0) oxlint-tsgolint@0.23.0: optionalDependencies: @@ -5553,7 +5553,7 @@ snapshots: '@oxlint-tsgolint/win32-arm64': 0.23.0 '@oxlint-tsgolint/win32-x64': 0.23.0 - oxlint@1.67.0(oxlint-tsgolint@0.23.0)(vite-plus@0.1.24(@types/node@25.9.2)(@vitest/coverage-v8@4.1.8)(esbuild@0.28.1)(jiti@2.6.1)(jsdom@29.1.1)(svelte@5.56.3(@typescript-eslint/types@8.61.0))(typescript@6.0.3)(vite@8.0.16(@types/node@25.9.2)(esbuild@0.28.1)(jiti@2.6.1)(yaml@2.9.0))(yaml@2.9.0)): + oxlint@1.67.0(oxlint-tsgolint@0.23.0)(vite-plus@0.1.24(@types/node@25.9.3)(@vitest/coverage-v8@4.1.8)(esbuild@0.28.1)(jiti@2.6.1)(jsdom@29.1.1)(svelte@5.56.3(@typescript-eslint/types@8.61.0))(typescript@6.0.3)(vite@8.0.16(@types/node@25.9.3)(esbuild@0.28.1)(jiti@2.6.1)(yaml@2.9.0))(yaml@2.9.0)): optionalDependencies: '@oxlint/binding-android-arm-eabi': 1.67.0 '@oxlint/binding-android-arm64': 1.67.0 @@ -5575,7 +5575,7 @@ snapshots: '@oxlint/binding-win32-ia32-msvc': 1.67.0 '@oxlint/binding-win32-x64-msvc': 1.67.0 oxlint-tsgolint: 0.23.0 - vite-plus: 0.1.24(@types/node@25.9.2)(@vitest/coverage-v8@4.1.8)(esbuild@0.28.1)(jiti@2.6.1)(jsdom@29.1.1)(svelte@5.56.3(@typescript-eslint/types@8.61.0))(typescript@6.0.3)(vite@8.0.16(@types/node@25.9.2)(esbuild@0.28.1)(jiti@2.6.1)(yaml@2.9.0))(yaml@2.9.0) + vite-plus: 0.1.24(@types/node@25.9.3)(@vitest/coverage-v8@4.1.8)(esbuild@0.28.1)(jiti@2.6.1)(jsdom@29.1.1)(svelte@5.56.3(@typescript-eslint/types@8.61.0))(typescript@6.0.3)(vite@8.0.16(@types/node@25.9.3)(esbuild@0.28.1)(jiti@2.6.1)(yaml@2.9.0))(yaml@2.9.0) p-each-series@3.0.0: {} @@ -6003,7 +6003,7 @@ snapshots: transitivePeerDependencies: - picomatch - svelte-dnd-action@0.9.69(svelte@5.56.3(@typescript-eslint/types@8.61.0)): + svelte-dnd-action@0.9.70(svelte@5.56.3(@typescript-eslint/types@8.61.0)): dependencies: svelte: 5.56.3(@typescript-eslint/types@8.61.0) @@ -6185,14 +6185,14 @@ snapshots: spdx-correct: 3.2.0 spdx-expression-parse: 3.0.1 - vite-plus@0.1.24(@types/node@25.9.2)(@vitest/coverage-v8@4.1.8)(esbuild@0.28.1)(jiti@2.6.1)(jsdom@29.1.1)(svelte@5.56.3(@typescript-eslint/types@8.61.0))(typescript@6.0.3)(vite@8.0.16(@types/node@25.9.2)(esbuild@0.28.1)(jiti@2.6.1)(yaml@2.9.0))(yaml@2.9.0): + vite-plus@0.1.24(@types/node@25.9.3)(@vitest/coverage-v8@4.1.8)(esbuild@0.28.1)(jiti@2.6.1)(jsdom@29.1.1)(svelte@5.56.3(@typescript-eslint/types@8.61.0))(typescript@6.0.3)(vite@8.0.16(@types/node@25.9.3)(esbuild@0.28.1)(jiti@2.6.1)(yaml@2.9.0))(yaml@2.9.0): dependencies: '@oxc-project/types': 0.133.0 '@oxlint/plugins': 1.61.0 - '@voidzero-dev/vite-plus-core': 0.1.24(@types/node@25.9.2)(esbuild@0.28.1)(jiti@2.6.1)(typescript@6.0.3)(yaml@2.9.0) - '@voidzero-dev/vite-plus-test': 0.1.24(@types/node@25.9.2)(@vitest/coverage-v8@4.1.8)(esbuild@0.28.1)(jiti@2.6.1)(jsdom@29.1.1)(typescript@6.0.3)(vite@8.0.16(@types/node@25.9.2)(esbuild@0.28.1)(jiti@2.6.1)(yaml@2.9.0))(yaml@2.9.0) - oxfmt: 0.52.0(svelte@5.56.3(@typescript-eslint/types@8.61.0))(vite-plus@0.1.24(@types/node@25.9.2)(@vitest/coverage-v8@4.1.8)(esbuild@0.28.1)(jiti@2.6.1)(jsdom@29.1.1)(svelte@5.56.3(@typescript-eslint/types@8.61.0))(typescript@6.0.3)(vite@8.0.16(@types/node@25.9.2)(esbuild@0.28.1)(jiti@2.6.1)(yaml@2.9.0))(yaml@2.9.0)) - oxlint: 1.67.0(oxlint-tsgolint@0.23.0)(vite-plus@0.1.24(@types/node@25.9.2)(@vitest/coverage-v8@4.1.8)(esbuild@0.28.1)(jiti@2.6.1)(jsdom@29.1.1)(svelte@5.56.3(@typescript-eslint/types@8.61.0))(typescript@6.0.3)(vite@8.0.16(@types/node@25.9.2)(esbuild@0.28.1)(jiti@2.6.1)(yaml@2.9.0))(yaml@2.9.0)) + '@voidzero-dev/vite-plus-core': 0.1.24(@types/node@25.9.3)(esbuild@0.28.1)(jiti@2.6.1)(typescript@6.0.3)(yaml@2.9.0) + '@voidzero-dev/vite-plus-test': 0.1.24(@types/node@25.9.3)(@vitest/coverage-v8@4.1.8)(esbuild@0.28.1)(jiti@2.6.1)(jsdom@29.1.1)(typescript@6.0.3)(vite@8.0.16(@types/node@25.9.3)(esbuild@0.28.1)(jiti@2.6.1)(yaml@2.9.0))(yaml@2.9.0) + oxfmt: 0.52.0(svelte@5.56.3(@typescript-eslint/types@8.61.0))(vite-plus@0.1.24(@types/node@25.9.3)(@vitest/coverage-v8@4.1.8)(esbuild@0.28.1)(jiti@2.6.1)(jsdom@29.1.1)(svelte@5.56.3(@typescript-eslint/types@8.61.0))(typescript@6.0.3)(vite@8.0.16(@types/node@25.9.3)(esbuild@0.28.1)(jiti@2.6.1)(yaml@2.9.0))(yaml@2.9.0)) + oxlint: 1.67.0(oxlint-tsgolint@0.23.0)(vite-plus@0.1.24(@types/node@25.9.3)(@vitest/coverage-v8@4.1.8)(esbuild@0.28.1)(jiti@2.6.1)(jsdom@29.1.1)(svelte@5.56.3(@typescript-eslint/types@8.61.0))(typescript@6.0.3)(vite@8.0.16(@types/node@25.9.3)(esbuild@0.28.1)(jiti@2.6.1)(yaml@2.9.0))(yaml@2.9.0)) oxlint-tsgolint: 0.23.0 optionalDependencies: '@voidzero-dev/vite-plus-darwin-arm64': 0.1.24 @@ -6235,7 +6235,7 @@ snapshots: - vite - yaml - vite@8.0.16(@types/node@25.9.2)(esbuild@0.28.1)(jiti@2.6.1)(yaml@2.9.0): + vite@8.0.16(@types/node@25.9.3)(esbuild@0.28.1)(jiti@2.6.1)(yaml@2.9.0): dependencies: lightningcss: 1.32.0 picomatch: 4.0.4 @@ -6243,20 +6243,20 @@ snapshots: rolldown: 1.0.3 tinyglobby: 0.2.17 optionalDependencies: - '@types/node': 25.9.2 + '@types/node': 25.9.3 esbuild: 0.28.1 fsevents: 2.3.3 jiti: 2.6.1 yaml: 2.9.0 - vitefu@1.1.3(vite@8.0.16(@types/node@25.9.2)(esbuild@0.28.1)(jiti@2.6.1)(yaml@2.9.0)): + vitefu@1.1.3(vite@8.0.16(@types/node@25.9.3)(esbuild@0.28.1)(jiti@2.6.1)(yaml@2.9.0)): optionalDependencies: - vite: 8.0.16(@types/node@25.9.2)(esbuild@0.28.1)(jiti@2.6.1)(yaml@2.9.0) + vite: 8.0.16(@types/node@25.9.3)(esbuild@0.28.1)(jiti@2.6.1)(yaml@2.9.0) - vitest@4.1.8(@types/node@25.9.2)(@vitest/coverage-v8@4.1.8)(jsdom@29.1.1)(vite@8.0.16(@types/node@25.9.2)(esbuild@0.28.1)(jiti@2.6.1)(yaml@2.9.0)): + vitest@4.1.8(@types/node@25.9.3)(@vitest/coverage-v8@4.1.8)(jsdom@29.1.1)(vite@8.0.16(@types/node@25.9.3)(esbuild@0.28.1)(jiti@2.6.1)(yaml@2.9.0)): dependencies: '@vitest/expect': 4.1.8 - '@vitest/mocker': 4.1.8(vite@8.0.16(@types/node@25.9.2)(esbuild@0.28.1)(jiti@2.6.1)(yaml@2.9.0)) + '@vitest/mocker': 4.1.8(vite@8.0.16(@types/node@25.9.3)(esbuild@0.28.1)(jiti@2.6.1)(yaml@2.9.0)) '@vitest/pretty-format': 4.1.8 '@vitest/runner': 4.1.8 '@vitest/snapshot': 4.1.8 @@ -6273,10 +6273,10 @@ snapshots: tinyexec: 1.2.4 tinyglobby: 0.2.17 tinyrainbow: 3.1.0 - vite: 8.0.16(@types/node@25.9.2)(esbuild@0.28.1)(jiti@2.6.1)(yaml@2.9.0) + vite: 8.0.16(@types/node@25.9.3)(esbuild@0.28.1)(jiti@2.6.1)(yaml@2.9.0) why-is-node-running: 2.3.0 optionalDependencies: - '@types/node': 25.9.2 + '@types/node': 25.9.3 '@vitest/coverage-v8': 4.1.8(vitest@4.1.8) jsdom: 29.1.1 transitivePeerDependencies: From f1fca37e02cb3b439f2703538dbaab8a9dd833ae Mon Sep 17 00:00:00 2001 From: Christian Bager Bach Houmann Date: Sat, 13 Jun 2026 20:43:34 +0200 Subject: [PATCH 4/5] ci: release via QuickAdd Release Bot app token; run CI on every PR Prereq for enforced branch protection on master: - release.yml: mint a short-lived token from the QuickAdd Release Bot GitHub App (actions/create-github-app-token, SHA-pinned) and use it for checkout + the semantic-release step. The release push is then attributed to the App, which is an allowed bypass actor on the master ruleset; GITHUB_TOKEN's github-actions[bot] push cannot be a bypass actor and would be blocked. - ci.yml: drop docs/** + **/*.md paths-ignore so Test + Build + Lint run on every PR and can be required without deadlocking docs-only PRs. --- .github/workflows/ci.yml | 9 +++------ .github/workflows/release.yml | 18 +++++++++++++++--- 2 files changed, 18 insertions(+), 9 deletions(-) diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index 5a99fac3..55e578cc 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -1,16 +1,13 @@ name: CI on: + # No paths-ignore: Test + Build + Lint run on every PR so they can be + # required status checks without deadlocking docs-only / markdown-only PRs + # (a required check that never runs stays pending forever and blocks merge). push: branches: [master] - paths-ignore: - - 'docs/**' - - '**/*.md' pull_request: branches: [master] - paths-ignore: - - 'docs/**' - - '**/*.md' workflow_dispatch: concurrency: diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml index 14853dcb..c71e0652 100644 --- a/.github/workflows/release.yml +++ b/.github/workflows/release.yml @@ -37,13 +37,25 @@ jobs: with: egress-policy: audit + # Mint a short-lived token for the "QuickAdd Release Bot" GitHub App. + # semantic-release pushes the release commit/tag with this token, so the + # push is attributed to the App, which is an allowed bypass actor on the + # master ruleset. The default GITHUB_TOKEN (github-actions[bot]) cannot + # be made a bypass actor, so its push would be blocked by branch protection. + - name: Generate release-bot token + id: app-token + uses: actions/create-github-app-token@bcd2ba49218906704ab6c1aa796996da409d3eb1 # v3.2.0 + with: + app-id: ${{ secrets.RELEASE_APP_ID }} + private-key: ${{ secrets.RELEASE_APP_PRIVATE_KEY }} + - name: Checkout uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3 with: - # semantic-release needs full history + tags and the persisted + # semantic-release needs full history + tags and the persisted App # credential to push the release commit. Do not change these. fetch-depth: 0 - token: ${{ secrets.GITHUB_TOKEN }} + token: ${{ steps.app-token.outputs.token }} - name: Setup pnpm uses: pnpm/action-setup@0e279bb959325dab635dd2c09392533439d90093 # v6.0.8 @@ -74,7 +86,7 @@ jobs: - name: Release id: release env: - GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} + GITHUB_TOKEN: ${{ steps.app-token.outputs.token }} DRY_RUN: ${{ github.event.inputs.dryRun || 'false' }} run: | EXTRA_ARGS="" From 82bf126a47c7a021d19f4964715a7008584076a6 Mon Sep 17 00:00:00 2001 From: Christian Bager Bach Houmann Date: Sat, 13 Jun 2026 20:48:40 +0200 Subject: [PATCH 5/5] build(deps): use caret range for @types/node devDependency Allow semver-compatible @types/node patch/minor updates (25.9.3 -> ^25.9.3), consistent with the caret-ranged devDependencies. Verified: frozen-lockfile consistent, tsc build + svelte-check clean. --- package.json | 2 +- pnpm-lock.yaml | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/package.json b/package.json index e64ded6c..634284a8 100644 --- a/package.json +++ b/package.json @@ -23,7 +23,7 @@ "@testing-library/jest-dom": "^6.9.1", "@testing-library/svelte": "^5.3.1", "@testing-library/user-event": "^14.6.1", - "@types/node": "25.9.3", + "@types/node": "^25.9.3", "@typescript-eslint/eslint-plugin": "^8.60.1", "@typescript-eslint/parser": "^8.60.1", "@vitest/coverage-v8": "4.1.8", diff --git a/pnpm-lock.yaml b/pnpm-lock.yaml index 8db276c5..67655c0d 100644 --- a/pnpm-lock.yaml +++ b/pnpm-lock.yaml @@ -55,7 +55,7 @@ importers: specifier: ^14.6.1 version: 14.6.1(@testing-library/dom@10.4.1) '@types/node': - specifier: 25.9.3 + specifier: ^25.9.3 version: 25.9.3 '@typescript-eslint/eslint-plugin': specifier: ^8.60.1