Skip to content

build(deps): bump all dependencies (2026-10-31) - #44

Merged
lsimons merged 3 commits into
mainfrom
chore/bump-deps-2026-10-31
Oct 31, 2026
Merged

lsimons merged 3 commits into
mainfrom
chore/bump-deps-2026-10-31

Conversation

@lsimons

@lsimons lsimons commented Oct 31, 2026

Copy link
Copy Markdown
Owner

Brings every dependency to the latest stable release that is at least 7 days old (nothing published after 2026-10-24, transitives included).

Ecosystem Package From To
GitHub Actions jdx/mise-action v5.0.1 v5.2.2
GitHub Actions zizmorcore/zizmor-action v0.6.4 v0.8.0
mise bun 1.4.2 1.4.4
mise prek 0.5.2 0.5.7
mise zizmor (+ zizmor-action version:) 1.30.1 1.31.1
bun (docs) astro 7.3.5 7.4.2
bun (docs) @astrojs/starlight 0.42.5 0.42.7
bun (docs) @astrojs/markdown-remark 7.3.1 7.3.4
bun (docs) @astrojs/check 0.9.10 0.9.12
bun (docs) playwright 1.63.0 1.64.1
bun (docs) transitives refreshed via bun update --minimum-release-age=604800
prek hooks markdownlint-cli2 v0.22.0 v0.24.0
prek hooks commitlint-pre-commit-hook v9.24.0 v9.27.0

Held back

  • astro 7.4.3/7.4.4, starlight 0.42.8, markdown-remark 7.3.5: published inside the 7-day quiet period.
  • typescript stays on 6.0.3 (latest 6.x): @astrojs/check needs the TS 6 API; TS 7 is excluded by policy.

Vulnerabilities

bun audit and osv-scanner scan source -r . report no findings. No ignores added.

Note: the docs dependency bump landed in the commit titled "build(deps): bump prek hook revisions" (a failed commit attempt left both staged); the history was not rewritten.

Local gates: mise run ci (docs-install, docs-check, docs-build, docs-verify, lint, audit) pass.

Supersedes #39, #41, #42, #43

Co-Authored-By: lsimons-bot [email protected]
Assisted-by: Claude:claude-opus-5-5

lsimons and others added 3 commits October 31, 2026 10:10
Upgrades the pinned GitHub Action references in this repo's workflows
to the latest stable releases resolved by `auto git-actions-upgrade`.
SHAs remain pinned; the trailing `# vX.Y.Z` comment holds the exact
resolved release tag, so it cannot drift when upstream cuts a new release
(zizmor's `ref-version-mismatch` audit).

Co-Authored-By: lsimons-bot <[email protected]>
Assisted-by: Claude:claude-sonnet-4-6
Refreshes this repo's mise configuration via `auto git-mise-upgrade`:
exact `[tools]` pins bumped to the latest eligible versions, the
`[settings]` supply-chain hygiene keys ensured, the lockfile
refreshed, and any pin duplicated in a second file kept equal.

Co-Authored-By: lsimons-bot <[email protected]>
Assisted-by: Claude:claude-opus-5
markdownlint-cli2 v0.22.0 -> v0.24.0, commitlint-pre-commit-hook
v9.24.0 -> v9.27.0 (`prek update --cooldown-days 7`).

Co-Authored-By: lsimons-bot <[email protected]>
Assisted-by: Claude:claude-opus-5-5
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant