chore(deps): update fro-bot/agent to v0.98.2

[fro-bot]

This PR contains the following updates:

Package	Type	Update	Change	OpenSSF
fro-bot/agent	action	patch	v0.98.1 → v0.98.2

---

Warning

Some dependencies could not be looked up. Check the Dependency Dashboard for more information.

---

Release Notes

fro-bot/agent (fro-bot/agent)

v0.98.2

Compare Source

What's new

The gateway logger now redacts sensitive fields before writing them to the console. Both GatewayLogger implementations in the gateway package — makeLogger in program.ts and CONSOLE_GATEWAY_LOGGER in discord/client.ts — previously serialized caller-supplied context verbatim, meaning any field named token or clientSecret could appear in log output. The same redactSensitiveFields function the Action runtime already uses is now applied at both sinks, closing a latent gap that surfaced while investigating a CodeQL alert. #​1361

GitHub's dependency graph parses only direct dependencies from bun.lock, leaving roughly 94% of the resolved tree — about 1036 of 1169 packages — invisible to Dependabot. A new osv-scanner.yaml workflow reads the lockfile directly, giving the same coverage that OpenSSF Scorecard already applies in its own scan. The initial run confirmed 24 known advisories across nine transitive packages (tar, undici, fast-uri, ip-address, brace-expansion, nanoid, fast-xml-parser, postcss, js-yaml); Dependabot had reported zero open alerts the entire time. Findings upload to code scanning without failing the job, since a blocking gate would have stopped every pull request from the first run — enabling that is a deliberate one-line change when the team is ready.

Those 24 advisories are now cleared. Seven of the nine affected packages already had entries in the root overrides block; they had simply drifted below the patched versions — for example, tar's floor was >=7.5.11 while the fix landed in 7.5.21. nanoid is bounded to <4.0.0 rather than left open, because a bare >=3.3.17 resolves to 6.0.1 and would have introduced a breaking change wearing a security fix as cover. Elsewhere the floors are left open-ended and the resolver picks up newer releases. #​1364, #​1365

harness-integrate.yaml gains a top-level permissions: {} block, resolving an OpenSSF Scorecard high-severity alert. The workflow's single job already declared its own id-token: write / contents: read scopes, which replace rather than merge with the workflow-level block — so effective permissions are unchanged today. The value is forward-looking: the broker allowlist pins credentials to this file, so any new job added without its own permissions block will now fail loudly at checkout rather than silently inherit whatever the repository default is. #​1359

Full changelog

0.98.2 (2026-08-10)

Build System

• deps: update dependency @​opencode-ai/sdk to v1.18.14 (#​1356) (a9bc5d7)

Bug Fixes

• deps: raise dependency security floors to clear known advisories (#​1365) (3746faa)
• gateway: redact sensitive fields from logger context (#​1361) (9653529)

Documentation

• solutions: capture blind checks and machine-checked dependency triage (#​1366) (6f1eae3)

Continuous Integration

• harness: deny workflow-level permissions by default on integrate (#​1359) (4c74447)
• scan the full dependency tree with osv-scanner (#​1364) (48d09ad)

---

Configuration

📅 Schedule: (in timezone America/Phoenix)

• Branch creation
  • At any time (no schedule defined)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Enabled.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR has been generated by Mend Renovate CLI.