Skip to content

chore: bump the npm-packages group with 12 updates#308

Merged
amannn merged 2 commits intomainfrom
dependabot/npm_and_yarn/npm-packages-9cf21b18e9
Apr 28, 2026
Merged

chore: bump the npm-packages group with 12 updates#308
amannn merged 2 commits intomainfrom
dependabot/npm_and_yarn/npm-packages-9cf21b18e9

Conversation

@dependabot
Copy link
Copy Markdown
Contributor

@dependabot dependabot Bot commented on behalf of github Apr 1, 2026

Bumps the npm-packages group with 12 updates:

Package From To
@actions/core 2.0.1 3.0.0
@actions/github 6.0.1 9.0.0
conventional-changelog-conventionalcommits 9.1.0 9.3.1
conventional-commits-parser 6.2.1 6.4.0
@rollup/plugin-commonjs 29.0.0 29.0.2
@semantic-release/github 12.0.2 12.0.6
eslint 9.39.2 10.1.0
globals 17.0.0 17.4.0
prettier 3.7.4 3.8.1
rollup 4.54.0 4.60.1
semantic-release 25.0.2 25.0.3
vitest 4.0.16 4.1.2

Updates @actions/core from 2.0.1 to 3.0.0

Changelog

Sourced from @​actions/core's changelog.

3.0.0

  • Breaking change: Package is now ESM-only
    • CommonJS consumers must use dynamic import() instead of require()

2.0.3

  • Bump @actions/http-client to 3.0.2
Commits

Updates @actions/github from 6.0.1 to 9.0.0

Changelog

Sourced from @​actions/github's changelog.

9.0.0

  • Breaking change: Package is now ESM-only
    • CommonJS consumers must use dynamic import() instead of require()
    • Example: const { getOctokit, context } = await import('@actions/github')
  • Fix TypeScript compilation by migrating to ESM, enabling proper imports from @octokit/core/types

8.0.1

  • Update undici to 6.23.0
  • Update @actions/http-client to 3.0.2

8.0.0

  • Update @​octokit dependencies
    • @octokit/core ^7.0.6
    • @octokit/plugin-paginate-rest ^14.0.0
    • @octokit/plugin-rest-endpoint-methods ^17.0.0
    • @octokit/request ^10.0.7
    • @octokit/request-error ^7.1.0
  • Breaking change: Minimum Node.js version is now 20 (previously 18)

7.0.0

  • Update to v3.0.1 of @actions/http-client
Commits
Maintainer changes

This version was pushed to npm by [GitHub Actions](https://www.npmjs.com/~GitHub Actions), a new releaser for @​actions/github since your current version.


Updates conventional-changelog-conventionalcommits from 9.1.0 to 9.3.1

Release notes

Sourced from conventional-changelog-conventionalcommits's releases.

conventional-changelog-conventionalcommits: v9.3.1

Bug Fixes

  • skip mention linkification inside inline code (#1444) (c598bf1)

conventional-changelog-conventionalcommits: v9.3.0

Features

conventional-changelog-conventionalcommits: v9.2.0

Features

Changelog

Sourced from conventional-changelog-conventionalcommits's changelog.

9.3.1 (2026-03-29)

Bug Fixes

  • skip mention linkification inside inline code (#1444) (c598bf1)

9.3.0 (2026-03-04)

Features

9.2.0 (2026-03-01)

Features

Commits
  • 08f44dc chore(release): monorepo release (#1442)
  • c598bf1 fix(conventional-changelog-angular,conventional-changelog-conventionalcommits...
  • 7d4a4f6 chore(release): monorepo release (#1435)
  • 0d5a4a6 feat(conventional-changelog-angular,conventional-changelog-atom,conventional-...
  • 44bc44d chore(release): monorepo release (#1423)
  • 441af37 docs: fix libraries io links
  • b0721e1 feat(conventional-changelog,conventional-changelog-angular,conventional-chang...
  • See full diff in compare view

Updates conventional-commits-parser from 6.2.1 to 6.4.0

Release notes

Sourced from conventional-commits-parser's releases.

conventional-commits-parser: v6.4.0

Features

  • support RegExp in noteKeywords, issuePrefixes, and referenceActions (#1441) (f84bfc4), closes #1436

conventional-commits-parser: v6.3.0

Features

Bug Fixes

  • deduplicate references when the same issue appears multiple times (#1425) (836ac77)
  • default gitlab revert message does not use a final dot in commit message. (#1422) (7391edf)
  • escape special chars in tokens (#1418) (2536e21)
Changelog

Sourced from conventional-commits-parser's changelog.

6.4.0 (2026-03-29)

Features

  • support RegExp in noteKeywords, issuePrefixes, and referenceActions (#1441) (f84bfc4), closes #1436

6.3.0 (2026-03-01)

Features

Bug Fixes

  • deduplicate references when the same issue appears multiple times (#1425) (836ac77)
  • default gitlab revert message does not use a final dot in commit message. (#1422) (7391edf)
  • escape special chars in tokens (#1418) (2536e21)
Commits
  • 08f44dc chore(release): monorepo release (#1442)
  • f84bfc4 feat(conventional-commits-parser): support RegExp in noteKeywords, issuePrefi...
  • 44bc44d chore(release): monorepo release (#1423)
  • 441af37 docs: fix libraries io links
  • 7d27d06 feat(conventional-changelog,conventional-changelog-writer,conventional-commit...
  • dfb633d ci: set custom timeout for cli tests
  • 836ac77 fix(conventional-commits-parser): deduplicate references when the same issue ...
  • 2536e21 fix(conventional-commits-parser): escape special chars in tokens (#1418)
  • 7391edf fix(conventional-commits-parser): default gitlab revert message does not use ...
  • See full diff in compare view

Updates @rollup/plugin-commonjs from 29.0.0 to 29.0.2

Changelog

Sourced from @​rollup/plugin-commonjs's changelog.

v29.0.2

2026-03-06

Bugfixes

  • commonjs: conditional exports (#1952)

v29.0.1

2026-03-05

Bugfixes

  • commonjs: correctly replaces shorthand "global" property in object (#1957)
Commits
  • 2de0d62 chore(release): commonjs v29.0.2
  • ab65325 fix(commonjs): conditional exports (#1952)
  • 7d22981 chore(repo): add rollup-plugin keyword in package.json (#1955)
  • a79ae55 chore(release): commonjs v29.0.1
  • bb41cfd chore(release): commonjs v29.0.1
  • 14ae186 fix(commonjs): correctly replaces shorthand "global" property in object (#1957)
  • See full diff in compare view
Maintainer changes

This version was pushed to npm by [GitHub Actions](https://www.npmjs.com/~GitHub Actions), a new releaser for @​rollup/plugin-commonjs since your current version.


Updates @semantic-release/github from 12.0.2 to 12.0.6

Release notes

Sourced from @​semantic-release/github's releases.

v12.0.6

12.0.6 (2026-02-12)

Bug Fixes

  • latest: add make_latest property to the GH release PATCH request during publish (#1169) (f516337)

v12.0.5

12.0.5 (2026-02-07)

Bug Fixes

  • latest: add make_latest property to the GH release POST request during publish (#1157) (38051ba)

v12.0.4

12.0.4 (2026-02-06)

Bug Fixes

  • remove failTitle arg in findSRIssues call (#1164) (f7bdd88)

v12.0.3

12.0.3 (2026-01-30)

Bug Fixes

  • extend GraphQL alias prefix to prevent hash collisions (#1134) (ea6386d)
Commits
  • f516337 fix(latest): add make_latest property to the GH release PATCH request during ...
  • f367e3a chore(deps): lock file maintenance (#1168)
  • 5ba629b chore(deps): update dependency cpy to v13.2.0 (#1167)
  • dfc7aa0 chore(deps): update npm to v11.9.0 (#1166)
  • ed2b0bd chore(deps): update dependency cpy to v13.1.0 (#1165)
  • 38051ba fix(latest): add make_latest property to the GH release POST request during...
  • be62f5e chore(deps): update dependency cpy to v13 (#1161)
  • f7bdd88 fix: remove failTitle arg in findSRIssues call (#1164)
  • fce4835 chore(deps): update dependency tempy to v3.2.0 (#1162)
  • e044f74 chore(deps): update dependency semantic-release to v25.0.3 (#1159)
  • Additional commits viewable in compare view

Updates eslint from 9.39.2 to 10.1.0

Release notes

Sourced from eslint's releases.

v10.1.0

Features

  • ff4382b feat: apply fix for no-var in TSModuleBlock (#20638) (Tanuj Kanti)
  • 0916995 feat: Implement api support for bulk-suppressions (#20565) (Blake Sager)

Bug Fixes

  • 2b8824e fix: Prevent no-var autofix when a variable is used before declaration (#20464) (Amaresh S M)
  • e58b4bf fix: update eslint (#20597) (renovate[bot])

Documentation

  • b7b57fe docs: use correct JSDoc link in require-jsdoc.md (#20641) (mkemna-clb)
  • 58e4cfc docs: add deprecation notice partial (#20639) (Milos Djermanovic)
  • 7143dbf docs: update v9 migration guide for @eslint/js usage (#20540) (fnx)
  • 035fc4f docs: note that globalReturn applies only with sourceType: "script" (#20630) (Milos Djermanovic)
  • e972c88 docs: merge ESLint option descriptions into type definitions (#20608) (Francesco Trotta)
  • 7f10d84 docs: Update README (GitHub Actions Bot)
  • aeed007 docs: open playground link in new tab (#20602) (Tanuj Kanti)
  • a0d1a37 docs: Add AI Usage Policy (#20510) (Nicholas C. Zakas)

Chores

  • a9f9cce chore: update dependency eslint-plugin-unicorn to ^63.0.0 (#20584) (Milos Djermanovic)
  • 1f42bd7 chore: update prettier to 3.8.1 (#20651) (루밀LuMir)
  • c0a6f4a chore: update dependency @​eslint/json to ^1.2.0 (#20652) (renovate[bot])
  • cc43f79 chore: update dependency c8 to v11 (#20650) (renovate[bot])
  • 2ce4635 chore: update dependency @​eslint/json to v1 (#20649) (renovate[bot])
  • f0406ee chore: update dependency markdownlint-cli2 to ^0.21.0 (#20646) (renovate[bot])
  • dbb4c95 chore: remove trunk (#20478) (sethamus)
  • c672a2a test: fix CLI test for empty output file (#20640) (kuldeep kumar)
  • c7ada24 ci: bump pnpm/action-setup from 4.3.0 to 4.4.0 (#20636) (dependabot[bot])
  • 07c4b8b test: fix RuleTester test without test runners (#20631) (Francesco Trotta)
  • 079bba7 test: Add tests for isValidWithUnicodeFlag (#20601) (Manish chaudhary)
  • 5885ae6 ci: unpin Node.js 25.x in CI (#20615) (Copilot)
  • f65e5d3 chore: update pnpm/action-setup digest to b906aff (#20610) (renovate[bot])

v10.0.3

Bug Fixes

  • e511b58 fix: update eslint (#20595) (renovate[bot])
  • f4c9cf9 fix: include variable name in no-useless-assignment message (#20581) (sethamus)
  • ee9ff31 fix: update dependency minimatch to ^10.2.4 (#20562) (Milos Djermanovic)

Documentation

  • 9fc31b0 docs: Update README (GitHub Actions Bot)
  • 4efaa36 docs: add info box for eslint-plugin-eslint-comments (#20570) (DesselBane)
  • 23b2759 docs: add v10 migration guide link to Use docs index (#20577) (Pixel998)
  • 80259a9 docs: Remove deprecated eslintrc documentation files (#20472) (Copilot)
  • 9b9b4ba docs: fix typo in no-await-in-loop documentation (#20575) (Pixel998)
  • e7d72a7 docs: document TypeScript 5.3 minimum supported version (#20547) (sethamus)

Chores

  • ef8fb92 chore: package.json update for eslint-config-eslint release (Jenkins)

... (truncated)

Commits

Updates globals from 17.0.0 to 17.4.0

Release notes

Sourced from globals's releases.

v17.4.0

  • Update globals (2026-03-01) (#338) d43a051

sindresorhus/globals@v17.3.0...v17.4.0

v17.3.0

  • Update globals (2026-02-01) (#336) 295fba9

sindresorhus/globals@v17.2.0...v17.3.0

v17.2.0

  • jasmine: Add throwUnless and throwUnlessAsync globals (#335) 97f23a7

sindresorhus/globals@v17.1.0...v17.2.0

v17.1.0

  • Add webpack and rspack globals (#333) 65cae73

sindresorhus/globals@v17.0.0...v17.1.0

Commits

Updates prettier from 3.7.4 to 3.8.1

Release notes

Sourced from prettier's releases.

3.8.1

🔗 Changelog

3.8.0

  • Support Angular v21.1

diff

🔗 Release note "Prettier 3.8: Support for Angular v21.1"

Changelog

Sourced from prettier's changelog.

3.8.1

diff

Include available printers in plugin type declarations (#18706 by @​porada)

// Input
import * as prettierPluginEstree from "prettier/plugins/estree";
// Prettier 3.8.0
// Property 'printers' does not exist on type 'typeof import("prettier/plugins/estree")'. ts(2339)
prettierPluginEstree.printers.estree; //=> any
// Prettier 3.8.1
prettierPluginEstree.printers.estree; //=> Printer
prettierPluginEstree.printers["estree-json"]; //=> Printer

3.8.0

diff

🔗 Release Notes

Commits

Updates rollup from 4.54.0 to 4.60.1

Release notes

Sourced from rollup's releases.

v4.60.1

4.60.1

2026-03-30

Bug Fixes

  • Resolve a situation where side effect imports could be dropped due to a caching issue (#6286)

Pull Requests

v4.60.0

4.60.0

2026-03-22

Features

  • Support source phase imports as long as they are external (#6279)

Pull Requests

v4.59.1

4.59.1

2026-03-21

Bug Fixes

  • Fix a crash when using lazy dynamic imports with moduleSideEffects:false (#6306)

Pull Requests

... (truncated)

Changelog

Sourced from rollup's changelog.

4.60.1

2026-03-30

Bug Fixes

  • Resolve a situation where side effect imports could be dropped due to a caching issue (#6286)

Pull Requests

4.60.0

2026-03-22

Features

  • Support source phase imports as long as they are external (#6279)

Pull Requests

4.59.1

2026-03-21

Bug Fixes

  • Fix a crash when using lazy dynamic imports with moduleSideEffects:false (#6306)

Pull Requests

... (truncated)

Commits

Updates semantic-release from 25.0.2 to 25.0.3

Release notes

Sourced from semantic-release's releases.

v25.0.3

25.0.3 (2026-01-30)

Bug Fixes

Commits
  • f404124 fix(deps): remove deprecated semver-diff (#3980)
  • fef7e34 docs: warn against using registry-url in setup-node (#4024)
  • 699d470 chore(deps): update dependency lockfile-lint to v5 (#4022)
  • c7c6f7a chore(deps): update dependency tempy to v3.1.2 (#4021)
  • 1ce5088 ci(action): update github/codeql-action action to v4.32.0 (#4019)
  • 9bb0d87 chore(deps): lock file maintenance (#4016)
  • 490171c chore(deps): update npm to v11.8.0 (#4015)
  • f6411e9 chore(deps): update dependency prettier to v3.8.1 (#4014)
  • c71c576 chore(deps): update dependency publint to v0.3.17 (#4013)
  • 989e18c chore(deps): update dependency tempy to v3.1.1 (#4012)
  • Additional commits viewable in compare view

Updates vitest from 4.0.16 to 4.1.2

Release notes

Sourced from vitest's releases.

v4.1.2

This release bumps Vitest's flatted version and removes version pinning to resolve flatted's CVE related issues (vitest-dev/vitest#9975).

   🐞 Bug Fixes

    View changes on GitHub

v4.1.1

   🚀 Features

   🐞 Bug Fixes

@dependabot
chore: bump the npm-packages group with 12 updates
abb04fd 
Bumps the npm-packages group with 12 updates:

| Package | From | To |
| --- | --- | --- |
| [@actions/core](https://github.com/actions/toolkit/tree/HEAD/packages/core) | `2.0.1` | `3.0.0` |
| [@actions/github](https://github.com/actions/toolkit/tree/HEAD/packages/github) | `6.0.1` | `9.0.0` |
| [conventional-changelog-conventionalcommits](https://github.com/conventional-changelog/conventional-changelog/tree/HEAD/packages/conventional-changelog-conventionalcommits) | `9.1.0` | `9.3.1` |
| [conventional-commits-parser](https://github.com/conventional-changelog/conventional-changelog/tree/HEAD/packages/conventional-commits-parser) | `6.2.1` | `6.4.0` |
| [@rollup/plugin-commonjs](https://github.com/rollup/plugins/tree/HEAD/packages/commonjs) | `29.0.0` | `29.0.2` |
| [@semantic-release/github](https://github.com/semantic-release/github) | `12.0.2` | `12.0.6` |
| [eslint](https://github.com/eslint/eslint) | `9.39.2` | `10.1.0` |
| [globals](https://github.com/sindresorhus/globals) | `17.0.0` | `17.4.0` |
| [prettier](https://github.com/prettier/prettier) | `3.7.4` | `3.8.1` |
| [rollup](https://github.com/rollup/rollup) | `4.54.0` | `4.60.1` |
| [semantic-release](https://github.com/semantic-release/semantic-release) | `25.0.2` | `25.0.3` |
| [vitest](https://github.com/vitest-dev/vitest/tree/HEAD/packages/vitest) | `4.0.16` | `4.1.2` |


Updates `@actions/core` from 2.0.1 to 3.0.0
- [Changelog](https://github.com/actions/toolkit/blob/main/packages/core/RELEASES.md)
- [Commits](https://github.com/actions/toolkit/commits/HEAD/packages/core)

Updates `@actions/github` from 6.0.1 to 9.0.0
- [Changelog](https://github.com/actions/toolkit/blob/main/packages/github/RELEASES.md)
- [Commits](https://github.com/actions/toolkit/commits/HEAD/packages/github)

Updates `conventional-changelog-conventionalcommits` from 9.1.0 to 9.3.1
- [Release notes](https://github.com/conventional-changelog/conventional-changelog/releases)
- [Changelog](https://github.com/conventional-changelog/conventional-changelog/blob/master/packages/conventional-changelog-conventionalcommits/CHANGELOG.md)
- [Commits](https://github.com/conventional-changelog/conventional-changelog/commits/conventional-changelog-conventionalcommits-v9.3.1/packages/conventional-changelog-conventionalcommits)

Updates `conventional-commits-parser` from 6.2.1 to 6.4.0
- [Release notes](https://github.com/conventional-changelog/conventional-changelog/releases)
- [Changelog](https://github.com/conventional-changelog/conventional-changelog/blob/master/packages/conventional-commits-parser/CHANGELOG.md)
- [Commits](https://github.com/conventional-changelog/conventional-changelog/commits/conventional-commits-parser-v6.4.0/packages/conventional-commits-parser)

Updates `@rollup/plugin-commonjs` from 29.0.0 to 29.0.2
- [Changelog](https://github.com/rollup/plugins/blob/master/packages/commonjs/CHANGELOG.md)
- [Commits](https://github.com/rollup/plugins/commits/commonjs-v29.0.2/packages/commonjs)

Updates `@semantic-release/github` from 12.0.2 to 12.0.6
- [Release notes](https://github.com/semantic-release/github/releases)
- [Commits](semantic-release/github@v12.0.2...v12.0.6)

Updates `eslint` from 9.39.2 to 10.1.0
- [Release notes](https://github.com/eslint/eslint/releases)
- [Commits](eslint/eslint@v9.39.2...v10.1.0)

Updates `globals` from 17.0.0 to 17.4.0
- [Release notes](https://github.com/sindresorhus/globals/releases)
- [Commits](sindresorhus/globals@v17.0.0...v17.4.0)

Updates `prettier` from 3.7.4 to 3.8.1
- [Release notes](https://github.com/prettier/prettier/releases)
- [Changelog](https://github.com/prettier/prettier/blob/main/CHANGELOG.md)
- [Commits](prettier/prettier@3.7.4...3.8.1)

Updates `rollup` from 4.54.0 to 4.60.1
- [Release notes](https://github.com/rollup/rollup/releases)
- [Changelog](https://github.com/rollup/rollup/blob/master/CHANGELOG.md)
- [Commits](rollup/rollup@v4.54.0...v4.60.1)

Updates `semantic-release` from 25.0.2 to 25.0.3
- [Release notes](https://github.com/semantic-release/semantic-release/releases)
- [Commits](semantic-release/semantic-release@v25.0.2...v25.0.3)

Updates `vitest` from 4.0.16 to 4.1.2
- [Release notes](https://github.com/vitest-dev/vitest/releases)
- [Commits](https://github.com/vitest-dev/vitest/commits/v4.1.2/packages/vitest)

---
updated-dependencies:
- dependency-name: "@actions/core"
  dependency-version: 3.0.0
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: npm-packages
- dependency-name: "@actions/github"
  dependency-version: 9.0.0
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: npm-packages
- dependency-name: conventional-changelog-conventionalcommits
  dependency-version: 9.3.1
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: npm-packages
- dependency-name: conventional-commits-parser
  dependency-version: 6.4.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: npm-packages
- dependency-name: "@rollup/plugin-commonjs"
  dependency-version: 29.0.2
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: npm-packages
- dependency-name: "@semantic-release/github"
  dependency-version: 12.0.6
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: npm-packages
- dependency-name: eslint
  dependency-version: 10.1.0
  dependency-type: direct:development
  update-type: version-update:semver-major
  dependency-group: npm-packages
- dependency-name: globals
  dependency-version: 17.4.0
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: npm-packages
- dependency-name: prettier
  dependency-version: 3.8.1
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: npm-packages
- dependency-name: rollup
  dependency-version: 4.60.1
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: npm-packages
- dependency-name: semantic-release
  dependency-version: 25.0.3
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: npm-packages
- dependency-name: vitest
  dependency-version: 4.1.2
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: npm-packages
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot Bot added dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code labels Apr 1, 2026
@amannn
Copy link
Copy Markdown
Owner

amannn commented Apr 28, 2026

@cursor ci is failing, investigate and fix

@cursor
Copy link
Copy Markdown

cursor Bot commented Apr 28, 2026 •
edited
Loading

Here is what was wrong and what we changed.

Cause

  1. ESLint 10 does not fit eslint-config-molindo@8 (peer eslint@^9). Lint blew up (unused-imports using legacy configType: "eslintrc" with ESLint 10; after pinning newer unused-imports, ESLint 10 still broke preset loading).
  2. @actions/core@3 and @actions/github@9 are ESM-only with named exports. Default imports made eslint-plugin-import fail (import/default).

Changes

  • Set eslint to ^9.39.2 (still satisfies "eslint": "^9" range without pinning wrong semver).
  • In src/index.js and src/validatePrTitle.js, switched to import * as core / import * as github.
  • pnpm-lock.yaml updated from install.
  • dist/ left aligned with origin/main so the “don’t change dist in PRs” job stays green; release.yml still runs pnpm build on merge to refresh dist.

Pushed commit b2bc15be on dependabot/npm_and_yarn/npm-packages-9cf21b18e9 and updated PR #308.

Open in Web Open in Cursor 

@cursoragent @amannn
fix(ci): align ESLint with molindo and ESM @actions imports
b2bc15b 
eslint-config-molindo targets ESLint 9; ESLint 10 breaks lint with unused-imports and loading presets.

@actions/core and @actions/github v3/v9 are ESM-only without default exports—use namespace imports so eslint-plugin-import/default passes.

Co-authored-by: Jan Amann <jan@amann.work>
@amannn
Copy link
Copy Markdown
Owner

amannn commented Apr 28, 2026

@cursor are there relevant breaking changes in the changelogs of the bumped major releases?

@cursor
Copy link
Copy Markdown

cursor Bot commented Apr 28, 2026 •
edited
Loading

Here is a concise answer you can use for that thread.

Majors that actually ship on this branch

@actions/core 2 → 3

  • Breaking: package is ESM-only; CommonJS require() is not supported (use import / dynamic import()).
  • For this repo: You already use ESM ("type": "module"). Default imports were wrong for ESM exports; switching to import * as core / import * as github matches how those packages export.

@actions/github 6 → 9

  • Breaking: also ESM-only (same as above).
  • Upstream: newer Octokit stack and, on the path to 9, Node ≥ 20 is required for that dependency line (see toolkit changelog around the 8.x bump).
  • For this repo: engines.node is ^24, so the Node floor is satisfied.

Major that Dependabot listed but this branch does not take

eslint 9 → 10

  • Dependabot proposed ESLint 10, but package.json keeps eslint at ^9.39.x so eslint-config-molindo and the rest of the lint stack stay compatible.
  • ESLint 10 breaking changes do not apply on this PR unless you bump ESLint again later with config/plugin upgrades.

Everything else in the table

Updates like conventional-changelog-conventionalcommits, conventional-commits-parser, rollup, vitest, etc. are minor/patch bumps on this branch (same major lines as before), so they are not “major release” breaks in the sense of your question—only normal release notes / semver expectations.

Bottom line: The meaningful breaks for this repo are ESM-only @actions/* (already addressed in source) and Node ≥ 20 for the GitHub toolkit line (already satisfied). ESLint 10 is not part of the merged dependency set here.

Open in Web Open in Cursor 

@amannn amannn merged commit 45b9ed7 into main Apr 28, 2026
8 checks passed
@dependabot dependabot Bot deleted the dependabot/npm_and_yarn/npm-packages-9cf21b18e9 branch April 28, 2026 08:21
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

2 participants

@amannn @cursoragent