Repository navigation
build(deps): bump openai from 7.14.0 to 7.28.0 - #403
Merged
Merged
Conversation
Contributor
Author
LabelsThe following labels could not be found: Please fix the above issues or remove invalid values from |
Owner
|
@dependabot rebase |
Contributor
Author
|
Looks like this PR has been edited by someone other than Dependabot. That means Dependabot can't rebase it - sorry! If you're happy for Dependabot to recreate it from scratch, overwriting any edits, you can request |
Owner
|
@dependabot recreate |
Contributor
Author
|
Dependabot can't authenticate to a private package registry. Because of this, Dependabot cannot update this pull request. |
Owner
|
@dependabot recreate |
Contributor
Author
|
Dependabot can't authenticate to a private package registry. Because of this, Dependabot cannot update this pull request. |
This was referenced Oct 8, 2026
saquibrashid
added a commit
that referenced
this pull request
Oct 8, 2026
…ry (#416) `package-lock.json` carried 442 `resolved` URLs naming `ms-feed-*.pkgs.visualstudio.com`, the internal Microsoft proxy feed. They entered through a local `npm install` on a Microsoft-managed machine, which is exactly the hazard `docs/runbooks/update-dependencies.md` section 6 warns about. The consequence was NOT cosmetic. Dependabot treats that host as a private registry it has no credential for, and refuses the whole update: Dependabot can't authenticate to a private package registry. Because of this, Dependabot cannot update this pull request. So #403 (openai), #404 (@azure/storage-blob) and #405 (jsdom) could not rebase or recreate, and every future bump touching those packages would have failed the same way. CI never showed it: the `1es-public` feed is anonymously readable, so GitHub runners install from it happily and all 13 jobs stay green. The only symptom was `Dependabot Updates` workflow runs ending in `failure`. The change is a host-prefix rewrite and nothing else: https://ms-feed-N.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/<pkg>/-/<file>.tgz -> https://registry.npmjs.org/<pkg>/-/<file>.tgz No `npm install` was run, so no version moved and no transitive dependency changed. No `integrity` hash changed either - it is the same tarball at its public address, so the recorded hash stays valid. The sha1/sha512 populations are identical before and after (412 / 135), which is the point: regenerating the lockfile here would have DOWNGRADED sha512 entries to sha1 (section 6), so this deliberately does not do that. Verified: every one of the 884 changed lines is a `resolved` line, the file still parses, and `check:deps` + `check:licences` pass. Docs: adds runbook section 6a for the lockout and its repair, and corrects the `sha1-` / `ms-feed-*` correlation in section 6 in place - sha1 hashes and public URLs now coexist, so that correlation is no longer a valid test. Unblocks #403, #404, #405. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> Copilot-Session: c372e6ba-4c3f-419a-9f77-b9e23adfc874
Owner
|
@dependabot recreate |
Bumps [openai](https://github.com/openai/openai-node) from 7.14.0 to 7.28.0. - [Release notes](https://github.com/openai/openai-node/releases) - [Changelog](https://github.com/openai/openai-node/blob/main/CHANGELOG.md) - [Commits](openai/openai-node@v7.14.0...v7.28.0) --- updated-dependencies: - dependency-name: openai dependency-version: 7.22.0 dependency-type: direct:production update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] <support@github.com>
dependabot
Bot
changed the title
dependabot
Bot
force-pushed
the
dependabot/npm_and_yarn/openai-7.22.0
branch
from
October 8, 2026 13:32
83e7545 to
34bcf71
Compare
Generated from the updated lockfile by .github/workflows/dependabot-notices.yml. Dependabot changes the installed tree but cannot run the repo script that regenerates this file, so every bump would otherwise fail check:licences and T-LICENSE-001c for a reason unrelated to the dependency being bumped.
10 of 12 tasks
saquibrashid
added a commit
that referenced
this pull request
Oct 8, 2026
…-011) (#431) Closes #417. main once carried 442 "resolved" URLs naming ms-feed-*.pkgs.visualstudio.com, written by a local `npm install` on a Microsoft-managed machine. That both published an internal host from a public repository and SILENTLY DISABLED dependabot for every affected package -- #403/#404/#405 could neither rebase nor recreate for nine days -- while all twelve CI jobs stayed green, because the 1es-public feed is anonymously readable. Repaired in #416; this closes the three open questions #417 left. Q1, a CI gate: tools/check-lockfile-registry.mjs + npm run check:lockfile, asserted by T-CI-011 in tests/infra/lockfileRegistry.spec.ts and run in the "3 . audit" job. An ALLOW-list of registry.npmjs.org, not an ms-feed-* denylist: the next proxy to leak in will have a different hostname. It keys on the URL, never on sha1- -- after #416 the two populations no longer correlate (~412 sha1- hashes, zero proxy URLs), so a sha1- check would fail the clean tree, which is why runbook section 6 still declines that one. Q2, other leaks of the internal host: the same gate fails on any committed .npmrc, whatever it contains. .npmrc is not gitignored, so one would be a real and visible risk; machine-specific registry config belongs in ~/.npmrc. Q3, the local-install story: runbook sections 2 and 4 both instructed a local `npm install`, which is the action that CAUSES this defect and contradicted sections 6/6a. Both corrected in place with the superseded text struck through below (F-001 rule). Section 6a's "No CI gate" conclusion is likewise corrected: it was sound for sha1- and wrongly extended to the resolved URL. Verified end-to-end against the real contamination: pointed at the lockfile of a branch that still carries it, the gate reports 447 entries across four hosts collapsed to four lines, and exits 1. WARNING for anyone with in-flight branches: 194 of 198 local branches in this clone are still contaminated and will now fail CI. Apply the section 6a host rewrite before pushing; it needs no install, no version change and no integrity change. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> Copilot-Session: c372e6ba-4c3f-419a-9f77-b9e23adfc874
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Bumps openai from 7.14.0 to 7.28.0.
Release notes
Sourced from openai's releases.
... (truncated)
Changelog
Sourced from openai's changelog.
... (truncated)
Commits
fb69556release: 7.28.0 (#2859)11b9283feat(api): add custom voice creation and agent session events (#2858)e39bd99release: 7.27.0 (#2857)7b5a9e0feat(agents): prepare hosted files and download result artifacts (#2855)a06c456release: 7.26.0 (#2844)0afb3dafix(responses): refresh credentials on WebSocket reconnects (#2856)95b197bfeat(agents): [1/n] parse typed output from agent streams (#2853)6198ba0feat(beta): bind typed application functions to Agents tools (#2852)71d2412feat: collect final output from beta Agents streams (#2850)a1421b1fix(deps-dev): upgrade Vitest and migrate performance benchmarks (#2831)