build: group coupled dependencies in dependabot config by Skitionek · Pull Request #629 · actions/javascript-action

Skitionek · 2026-09-15T23:37:02Z

Follows on from the semantic-release group already on master, filling in the other coupled sets.

Groups added:

npm

babel — @babel/cli, preset-env and the proposal plugins peer on @babel/core and ship from one monorepo release. dist/ is produced by this toolchain, so a half-updated Babel means a rebuilt bundle against mismatched plugins.
eslint — @eslint/js is versioned in step with the eslint major it ships for.

@actions/core, @actions/github, @octokit/rest, @vercel/ncc, cspell, husky and jest stay ungrouped — they version independently.

Get first line if commit message includes newline

If the committer is a bot (like github actions), the author field will be empty. In that case, just leave out the author field.

[slack.ts] fixes #59 Make author optional

[UPDATE] Update package libraries

Fix @actions/github bug

Integrate yarn from npm

Bumps [acorn](https://github.com/acornjs/acorn) from 5.7.3 to 5.7.4. - [Release notes](https://github.com/acornjs/acorn/releases) - [Commits](acornjs/acorn@5.7.3...5.7.4) Signed-off-by: dependabot[bot] <support@github.com>

…5.7.4 Bump acorn from 5.7.3 to 5.7.4

# Conflicts: # .github/workflows/test.yml # .gitignore # LICENSE # README.md # action.yml # dist/index.js # package.json

Bumps [github/codeql-action/init](https://github.com/github/codeql-action) from 4.37.0 to 4.37.2. - [Release notes](https://github.com/github/codeql-action/releases) - [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md) - [Commits](github/codeql-action@99df26d...e064762) --- updated-dependencies: - dependency-name: github/codeql-action/init dependency-version: 4.37.2 dependency-type: direct:production update-type: version-update:semver-patch ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>

Bumps [github/codeql-action/upload-sarif](https://github.com/github/codeql-action) from 4.37.2 to 4.37.3. - [Release notes](https://github.com/github/codeql-action/releases) - [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md) - [Commits](github/codeql-action@e064762...e4fba86) --- updated-dependencies: - dependency-name: github/codeql-action/upload-sarif dependency-version: 4.37.3 dependency-type: direct:production update-type: version-update:semver-patch ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>

Bumps [github/codeql-action/analyze](https://github.com/github/codeql-action) from 4.37.2 to 4.37.3. - [Release notes](https://github.com/github/codeql-action/releases) - [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md) - [Commits](github/codeql-action@e064762...e4fba86) --- updated-dependencies: - dependency-name: github/codeql-action/analyze dependency-version: 4.37.3 dependency-type: direct:production update-type: version-update:semver-patch ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>

Bumps [github/codeql-action/init](https://github.com/github/codeql-action) from 4.37.2 to 4.37.3. - [Release notes](https://github.com/github/codeql-action/releases) - [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md) - [Commits](github/codeql-action@e064762...e4fba86) --- updated-dependencies: - dependency-name: github/codeql-action/init dependency-version: 4.37.3 dependency-type: direct:production update-type: version-update:semver-patch ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>

…protection rules

…e documentation (#199)

Bumps [github/codeql-action/upload-sarif](https://github.com/github/codeql-action) from 4.37.3 to 4.37.4. - [Release notes](https://github.com/github/codeql-action/releases) - [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md) - [Commits](github/codeql-action@e4fba86...f205ea1) --- updated-dependencies: - dependency-name: github/codeql-action/upload-sarif dependency-version: 4.37.4 dependency-type: direct:production update-type: version-update:semver-patch ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>

It's too much effort to maintain * ci: bump github/codeql-action/init from 4.37.3 to 4.37.4 Bumps [github/codeql-action/init](https://github.com/github/codeql-action) from 4.37.3 to 4.37.4. - [Release notes](https://github.com/github/codeql-action/releases) - [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md) - [Commits](github/codeql-action@e4fba86...f205ea1) --- updated-dependencies: - dependency-name: github/codeql-action/init dependency-version: 4.37.4 dependency-type: direct:production update-type: version-update:semver-patch ... Signed-off-by: dependabot[bot] <support@github.com> * Update codeql.yml --------- Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Co-authored-by: Dominik Maszczyk <Skitionek@gmail.com>

Bumps [github/codeql-action/upload-sarif](https://github.com/github/codeql-action) from 4.37.4 to 4.37.6. - [Release notes](https://github.com/github/codeql-action/releases) - [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md) - [Commits](github/codeql-action@f205ea1...5595cca) --- updated-dependencies: - dependency-name: github/codeql-action/upload-sarif dependency-version: 4.37.6 dependency-type: direct:production update-type: version-update:semver-patch ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>

Bumps [github/codeql-action/upload-sarif](https://github.com/github/codeql-action) from 4.37.6 to 4.37.7. - [Release notes](https://github.com/github/codeql-action/releases) - [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md) - [Commits](github/codeql-action@5595cca...ff2f1c6) --- updated-dependencies: - dependency-name: github/codeql-action/upload-sarif dependency-version: 4.37.7 dependency-type: direct:production update-type: version-update:semver-patch ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>

Bumps [github/codeql-action/upload-sarif](https://github.com/github/codeql-action) from 4.37.7 to 4.37.8. - [Release notes](https://github.com/github/codeql-action/releases) - [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md) - [Commits](github/codeql-action@ff2f1c6...db488dd) --- updated-dependencies: - dependency-name: github/codeql-action/upload-sarif dependency-version: 4.37.8 dependency-type: direct:production update-type: version-update:semver-patch ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>

Bumps [eslint](https://github.com/eslint/eslint) from 9.39.4 to 10.8.0. - [Release notes](https://github.com/eslint/eslint/releases) - [Commits](eslint/eslint@v9.39.4...v10.8.0) --- updated-dependencies: - dependency-name: eslint dependency-version: 10.4.0 dependency-type: direct:development update-type: version-update:semver-major ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>

Bumps [@actions/core](https://github.com/actions/toolkit/tree/HEAD/packages/core) from 1.11.1 to 3.0.1. - [Changelog](https://github.com/actions/toolkit/blob/main/packages/core/RELEASES.md) - [Commits](https://github.com/actions/toolkit/commits/HEAD/packages/core) --- updated-dependencies: - dependency-name: "@actions/core" dependency-version: 3.0.1 dependency-type: direct:production update-type: version-update:semver-major ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>

Bumps [jest](https://github.com/jestjs/jest/tree/HEAD/packages/jest) from 29.4.1 to 30.4.2. - [Release notes](https://github.com/jestjs/jest/releases) - [Changelog](https://github.com/jestjs/jest/blob/main/CHANGELOG.md) - [Commits](https://github.com/jestjs/jest/commits/v30.4.2/packages/jest) --- updated-dependencies: - dependency-name: jest dependency-version: 30.4.2 dependency-type: direct:development update-type: version-update:semver-major ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>

Bumps [github/codeql-action/upload-sarif](https://github.com/github/codeql-action) from 4.37.8 to 4.37.9. - [Release notes](https://github.com/github/codeql-action/releases) - [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md) - [Commits](github/codeql-action@db488dd...cdf488f) --- updated-dependencies: - dependency-name: github/codeql-action/upload-sarif dependency-version: 4.37.9 dependency-type: direct:production update-type: version-update:semver-patch ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>

…e payload at info level - parseRetryInput now requires a strict non-negative integer string (rejects '1.5', '2junk', '0x10', etc.) - actions input is validated to be a JSON array of plain objects, with a clear error otherwise - full generated/raw payload and full parsed inputs are now only logged at debug level; info logs use safe summaries (payload keys, input types) to avoid leaking secrets in default logs

… add missing @eslint/js master was broken independent of this change: - @actions/core 2.0.0+ is ESM-only (no CJS require export), breaking jest and the ncc dist build for this CommonJS codebase; pin back to the last CJS-compatible 1.x release. - eslint.config.mjs imports @eslint/js, which eslint no longer bundles as of the eslint 10 upgrade; add it as an explicit devDependency.

Bumps [github/codeql-action/upload-sarif](https://github.com/github/codeql-action) from 4.37.9 to 4.38.0. - [Release notes](https://github.com/github/codeql-action/releases) - [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md) - [Commits](github/codeql-action@cdf488f...b96794f) --- updated-dependencies: - dependency-name: github/codeql-action/upload-sarif dependency-version: 4.38.0 dependency-type: direct:production update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Co-authored-by: Dominik Maszczyk <Skitionek@gmail.com>

Remediate all production dependency vulnerabilities (was 13: 4 high + 9 moderate; npm audit --omit=dev now reports 0). - Remove unused botbuilder@^4.23.2 — src/ only imports IncomingWebhook from ms-teams-webhook; botbuilder was never referenced in source. Eliminates the ws high vuln and the entire botbuilder chain. - Move cspell@^10.0.0 to devDependencies (CI-only spell checker that pulled vulnerable transitive deps into the production graph). - Extend overrides to pin fixed versions on the required ms-teams-webhook transitive chain: axios ^1.20.0, form-data ^4.0.6, uuid ^11.1.1, @xmldom/xmldom ^0.9.12, fast-xml-builder ^1.3.1, fast-xml-parser ^5.11.1. - Rebuild dist/index.js so the patched transitive deps ship in the action bundle. Tests: npm test passes (39/39, lint clean). npm audit --omit=dev: 0 vulnerabilities.

Bundles semantic-release and @semantic-release/* devDependency bumps so they land as a single PR instead of one per package.

- Remove copilot-auto-fix.yml (never worked) - Pin github/codeql-action/* to a fixed commit instead of the floating v4 tag - Migrate lint.yml to the Skitionek/lint composite action where still inlined - Group github/codeql-action/* updates in dependabot.yml

Dependencies that pin each other or ship from one release train were being bumped one PR at a time, which produces builds with a half-updated toolchain. Group them so each release train lands as a single PR, with a comment on each group recording why its members are coupled.

Skitionek · 2026-09-15T23:37:22Z

Opened against the wrong repository by mistake — this change belongs in the Skitionek fork, not upstream. Closing; apologies for the noise.

ChrisBrown1991 · 2026-10-29T03:15:44Z

Follows on from the semantic-release group already on master, filling in the other coupled sets.

Groups added:

npm

babel — @babel/cli, preset-env and the proposal plugins peer on @babel/core and ship from one monorepo release. dist/ is produced by this toolchain, so a half-updated Babel means a rebuilt bundle against mismatched plugins.

eslint — @eslint/js is versioned in step with the eslint major it ships for.

@actions/core, @actions/github, @octokit/rest, @vercel/ncc, cspell, husky and jest stay ungrouped — they version independently.

homoluctus and others added 30 commits December 7, 2019 00:04

[slack.ts] Fix typo

f8c06dd

[CI] Fix node version

f3f2617

Merge pull request #58 from homoluctus/fix/commit_message

61c6b12

Get first line if commit message includes newline

[slack.ts] fixes #59 Make author optional

1bc68f8

If the committer is a bot (like github actions), the author field will be empty. In that case, just leave out the author field.

Merge pull request #60 from paul-sachs/master

f42f5e8

[slack.ts] fixes #59 Make author optional

[UPDATE] Update package libraries

16cee99

Merge pull request #61 from homoluctus/feature/update_libraries

1d0cbda

[UPDATE] Update package libraries

[.gitignore] delete package-lock.json for tracking

ce6eb13

[slack.ts] Fix bug "Property repos does not exist on type GitHub"

ce614f3

Merge pull request #64 from homoluctus/fix/bug_of_dependencies

56b3815

Fix @actions/github bug

update: add ToC to README.md and format a bit

70d5984

update: Integrate yarn from npm

481530b

Merge pull request #65 from homoluctus/feature/migrate_to_yarn

76a6dcd

Integrate yarn from npm

Bump acorn from 5.7.3 to 5.7.4

d2d5326

Bumps [acorn](https://github.com/acornjs/acorn) from 5.7.3 to 5.7.4. - [Release notes](https://github.com/acornjs/acorn/releases) - [Commits](acornjs/acorn@5.7.3...5.7.4) Signed-off-by: dependabot[bot] <support@github.com>

Merge pull request #66 from homoluctus/dependabot/npm_and_yarn/acorn-…

9ce165b

…5.7.4 Bump acorn from 5.7.3 to 5.7.4

Merge remote-tracking branch 'slatify/master'

b447e5c

# Conflicts: # .github/workflows/test.yml # .gitignore # LICENSE # README.md # action.yml # dist/index.js # package.json

CI

10c2584

fix wrong path

fe21f55

missed deps

d244c06

another try

851cf4a

Create env.yml

e705bc0

Fancy

c54c83d

wrong script..

427640c

corr tests

a563d05

corr tests

efdd01e

corr tests

910df76

corr tests

7e2c455

corr tests

4d5d9aa

corr tests

4bb57a0

corr tests

6cc8a83

dependabot Bot and others added 25 commits July 22, 2026 19:29

ci: simplify semantic-release setup to prevent conflicts with branch …

dc5e0fb

…protection rules

fix: workflow name for clarity

96f8e0d

feat: add retry mechanism for Microsoft Teams notifications and updat…

216b8b2

…e documentation (#199)

build: rebuild dist/

cf97589

chore: align CodeQL workflow permissions

37dcaf4

build: group @semantic-release dependabot updates into one PR (#220)

6cf5825

Bundles semantic-release and @semantic-release/* devDependency bumps so they land as a single PR instead of one per package.

Skitionek requested a review from a team as a code owner September 15, 2026 23:37

Skitionek closed this Sep 15, 2026

Skitionek deleted the build/dependabot-dependency-groups branch September 17, 2026 20:28

Navigation Menu

Repository navigation

build: group coupled dependencies in dependabot config - #629

build: group coupled dependencies in dependabot config#629
Skitionek wants to merge 493 commits into
actions:mainfrom
Skitionek:build/dependabot-dependency-groups

Skitionek commented Sep 15, 2026

Uh oh!

Skitionek commented Sep 15, 2026

Uh oh!

ChrisBrown1991 commented Oct 29, 2026

Uh oh!

Reviewers

Uh oh!

Assignees

Labels

Projects

Milestone

Development

Uh oh!

11 participants

Conversation

Skitionek commented Sep 15, 2026

Uh oh!

Skitionek commented Sep 15, 2026

Uh oh!

ChrisBrown1991 commented Oct 29, 2026

Uh oh!

Reviewers

Uh oh!

Assignees

Labels

Projects

Milestone

Development

Uh oh!

11 participants