Update npm_and_yarn dependencies and add CodeQL analysis workflow#14897
Closed
JaclynCodes wants to merge 9 commits into
Closed
Update npm_and_yarn dependencies and add CodeQL analysis workflow#14897JaclynCodes wants to merge 9 commits into
JaclynCodes wants to merge 9 commits into
Conversation
Bumps the npm_and_yarn group with 4 updates in the /bun/helpers directory: [@tootallnate/once](https://github.com/TooTallNate/once), [lodash](https://github.com/lodash/lodash), [picomatch](https://github.com/micromatch/picomatch) and [yaml](https://github.com/eemeli/yaml). Bumps the npm_and_yarn group with 2 updates in the /npm_and_yarn/helpers/test/npm6/fixtures/conflicting-dependency-parser/deeply-nested directory: [lodash](https://github.com/lodash/lodash) and [async](https://github.com/caolan/async). Bumps the npm_and_yarn group with 2 updates in the /npm_and_yarn/helpers/test/yarn/fixtures/conflicting-dependency-parser/deeply-nested directory: [lodash](https://github.com/lodash/lodash) and [es5-ext](https://github.com/medikoo/es5-ext). Bumps the npm_and_yarn group with 2 updates in the /bun/helpers/test/yarn/fixtures/conflicting-dependency-parser/deeply-nested directory: [lodash](https://github.com/lodash/lodash) and [es5-ext](https://github.com/medikoo/es5-ext). Bumps the npm_and_yarn group with 3 updates in the /bun/helpers/test/npm6/fixtures/conflicting-dependency-parser/deeply-nested directory: [brace-expansion](https://github.com/juliangruber/brace-expansion), [lodash](https://github.com/lodash/lodash) and [async](https://github.com/caolan/async). Removes `@tootallnate/once` Updates `lodash` from 4.17.23 to 4.18.1 - [Release notes](https://github.com/lodash/lodash/releases) - [Commits](lodash/lodash@4.17.23...4.18.1) Updates `picomatch` from 2.3.1 to 2.3.2 - [Release notes](https://github.com/micromatch/picomatch/releases) - [Changelog](https://github.com/micromatch/picomatch/blob/master/CHANGELOG.md) - [Commits](micromatch/picomatch@2.3.1...2.3.2) Updates `yaml` from 2.3.1 to 2.8.4 - [Release notes](https://github.com/eemeli/yaml/releases) - [Commits](eemeli/yaml@v2.3.1...v2.8.4) Updates `lodash` from 4.17.23 to 4.18.1 - [Release notes](https://github.com/lodash/lodash/releases) - [Commits](lodash/lodash@4.17.23...4.18.1) Updates `async` from 2.6.3 to 2.6.4 - [Release notes](https://github.com/caolan/async/releases) - [Changelog](https://github.com/caolan/async/blob/v2.6.4/CHANGELOG.md) - [Commits](caolan/async@v2.6.3...v2.6.4) Updates `lodash` from 4.17.23 to 4.18.1 - [Release notes](https://github.com/lodash/lodash/releases) - [Commits](lodash/lodash@4.17.23...4.18.1) Updates `es5-ext` from 0.10.53 to 0.10.64 - [Release notes](https://github.com/medikoo/es5-ext/releases) - [Changelog](https://github.com/medikoo/es5-ext/blob/main/CHANGELOG.md) - [Commits](medikoo/es5-ext@v0.10.53...v0.10.64) Updates `lodash` from 4.17.23 to 4.18.1 - [Release notes](https://github.com/lodash/lodash/releases) - [Commits](lodash/lodash@4.17.23...4.18.1) Updates `es5-ext` from 0.10.53 to 0.10.64 - [Release notes](https://github.com/medikoo/es5-ext/releases) - [Changelog](https://github.com/medikoo/es5-ext/blob/main/CHANGELOG.md) - [Commits](medikoo/es5-ext@v0.10.53...v0.10.64) Updates `brace-expansion` from 1.1.11 to 1.1.14 - [Release notes](https://github.com/juliangruber/brace-expansion/releases) - [Commits](juliangruber/brace-expansion@1.1.11...v1.1.14) Updates `lodash` from 4.17.23 to 4.18.1 - [Release notes](https://github.com/lodash/lodash/releases) - [Commits](lodash/lodash@4.17.23...4.18.1) Updates `async` from 2.6.3 to 2.6.4 - [Release notes](https://github.com/caolan/async/releases) - [Changelog](https://github.com/caolan/async/blob/v2.6.4/CHANGELOG.md) - [Commits](caolan/async@v2.6.3...v2.6.4) --- updated-dependencies: - dependency-name: "@tootallnate/once" dependency-version: dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: lodash dependency-version: 4.18.1 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: picomatch dependency-version: 2.3.2 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: yaml dependency-version: 2.8.4 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: lodash dependency-version: 4.18.1 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: async dependency-version: 2.6.4 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: lodash dependency-version: 4.18.1 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: es5-ext dependency-version: 0.10.64 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: lodash dependency-version: 4.18.1 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: es5-ext dependency-version: 0.10.64 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: brace-expansion dependency-version: 1.1.14 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: lodash dependency-version: 4.18.1 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: async dependency-version: 2.6.4 dependency-type: indirect dependency-group: npm_and_yarn ... Signed-off-by: dependabot[bot] <support@github.com>
This workflow file sets up CodeQL analysis for multiple programming languages, defining triggers for pushes and pull requests to the main branch, as well as a scheduled analysis.
![github-advanced-security[bot]](https://avatars.githubusercontent.com/in/57789?s=60&v=4){kind=small}
| # your codebase is analyzed, see https://docs.github.com/en/code-security/code-scanning/creating-an-advanced-setup-for-code-scanning/codeql-code-scanning-for-compiled-languages | ||
| steps: | ||
| - name: Checkout repository | ||
| uses: actions/checkout@v4 |
|
|
||
| # Initializes the CodeQL tools for scanning. | ||
| - name: Initialize CodeQL | ||
| uses: github/codeql-action/init@v4 |
| exit 1 | ||
|
|
||
| - name: Perform CodeQL Analysis | ||
| uses: github/codeql-action/analyze@v4 |
Comment on lines
+67
to
+76
| - name: Checkout repository | ||
| uses: actions/checkout@v4 | ||
|
|
||
| # Add any setup steps before running the `github/codeql-action/init` action. | ||
| # This includes steps like installing compilers or runtimes (`actions/setup-node` | ||
| # or others). This is typically only required for manual builds. | ||
| # - name: Setup runtime (example) | ||
| # uses: actions/setup-example@v1 | ||
|
|
||
| # Initializes the CodeQL tools for scanning. |
Contributor
|
You are seeing this message because GitHub Code Scanning has recently been set up for this repository, or this pull request contains the workflow file for the Code Scanning tool. What Enabling Code Scanning Means:
For more information about GitHub Code Scanning, check out the documentation. |
Co-authored-by: Copilot Autofix powered by AI <62310815+github-advanced-security[bot]@users.noreply.github.com>
Bumps the uv-ecosystem group in /uv/helpers with 8 updates: | Package | From | To | | --- | --- | --- | | [pip](https://github.com/pypa/pip) | `24.0` | `24.3.1` | | [pip-tools](https://github.com/jazzband/pip-tools) | `7.4.1` | `7.5.3` | | [flake8](https://github.com/pycqa/flake8) | `7.1.0` | `7.3.0` | | [hashin](https://github.com/peterbe/hashin) | `1.0.3` | `1.0.5` | | [pipenv](https://github.com/pypa/pipenv) | `2024.0.2` | `2024.4.1` | | [plette](https://github.com/sarugaku/plette) | `2.1.0` | `2.2.1` | | [tomli](https://github.com/hukkin/tomli) | `2.0.1` | `2.4.1` | | [cython](https://github.com/cython/cython) | `3.0.10` | `3.2.4` | Updates `pip` from 24.0 to 24.3.1 - [Changelog](https://github.com/pypa/pip/blob/main/NEWS.rst) - [Commits](pypa/pip@24.0...24.3.1) Updates `pip-tools` from 7.4.1 to 7.5.3 - [Release notes](https://github.com/jazzband/pip-tools/releases) - [Changelog](https://github.com/jazzband/pip-tools/blob/main/CHANGELOG.md) - [Commits](jazzband/pip-tools@7.4.1...v7.5.3) Updates `flake8` from 7.1.0 to 7.3.0 - [Commits](PyCQA/flake8@7.1.0...7.3.0) Updates `hashin` from 1.0.3 to 1.0.5 - [Release notes](https://github.com/peterbe/hashin/releases) - [Commits](peterbe/hashin@1.0.3...1.0.5) Updates `pipenv` from 2024.0.2 to 2024.4.1 - [Release notes](https://github.com/pypa/pipenv/releases) - [Changelog](https://github.com/pypa/pipenv/blob/main/CHANGELOG.md) - [Commits](pypa/pipenv@v2024.0.2...v2024.4.1) Updates `plette` from 2.1.0 to 2.2.1 - [Release notes](https://github.com/sarugaku/plette/releases) - [Changelog](https://github.com/sarugaku/plette/blob/master/CHANGELOG.rst) - [Commits](sarugaku/plette@v2.1.0...v2.2.1) Updates `tomli` from 2.0.1 to 2.4.1 - [Changelog](https://github.com/hukkin/tomli/blob/master/CHANGELOG.md) - [Commits](hukkin/tomli@2.0.1...2.4.1) Updates `cython` from 3.0.10 to 3.2.4 - [Release notes](https://github.com/cython/cython/releases) - [Changelog](https://github.com/cython/cython/blob/master/CHANGES.rst) - [Commits](cython/cython@3.0.10...3.2.4) --- updated-dependencies: - dependency-name: pip dependency-version: 24.3.1 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: uv-ecosystem - dependency-name: pip-tools dependency-version: 7.5.3 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: uv-ecosystem - dependency-name: flake8 dependency-version: 7.3.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: uv-ecosystem - dependency-name: hashin dependency-version: 1.0.5 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: uv-ecosystem - dependency-name: pipenv dependency-version: 2024.4.1 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: uv-ecosystem - dependency-name: plette dependency-version: 2.2.1 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: uv-ecosystem - dependency-name: tomli dependency-version: 2.4.1 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: uv-ecosystem - dependency-name: cython dependency-version: 3.2.4 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: uv-ecosystem ... Signed-off-by: dependabot[bot] <support@github.com>
| runs-on: ubuntu-latest | ||
| steps: | ||
| - name: Checkout | ||
| uses: actions/checkout@v4 |
| - name: Checkout | ||
| uses: actions/checkout@v4 | ||
| - name: Setup Pages | ||
| uses: actions/configure-pages@v5 |
| - name: Setup Pages | ||
| uses: actions/configure-pages@v5 | ||
| - name: Upload artifact | ||
| uses: actions/upload-pages-artifact@v3 |
| path: '.' | ||
| - name: Deploy to GitHub Pages | ||
| id: deployment | ||
| uses: actions/deploy-pages@v5 |
Comment on lines
+32
to
+33
| - name: Checkout | ||
| uses: actions/checkout@v4 |
Bumps [lodash](https://github.com/lodash/lodash) from 4.17.23 to 4.18.1. - [Release notes](https://github.com/lodash/lodash/releases) - [Commits](lodash/lodash@4.17.23...4.18.1) --- updated-dependencies: - dependency-name: lodash dependency-version: 4.18.1 dependency-type: indirect ... Signed-off-by: dependabot[bot] <support@github.com>
Bumps [dotnet-sdk](https://github.com/dotnet/sdk) from 10.0.103 to 10.0.203. - [Release notes](https://github.com/dotnet/sdk/releases) - [Commits](https://github.com/dotnet/sdk/commits) --- updated-dependencies: - dependency-name: dotnet-sdk dependency-version: 10.0.203 dependency-type: direct:production update-type: version-update:semver-patch ... Signed-off-by: dependabot[bot] <support@github.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What are you trying to accomplish?
Anything you want to highlight for special attention from reviewers?
How will you know you've accomplished your goal?
Checklist