deps: bump the go-deps group with 4 updates - #481
Closed
dependabot[bot] wants to merge 1 commit into
Closed
Conversation
Bumps the go-deps group with 4 updates: [github.com/nats-io/nats-server/v2](https://github.com/nats-io/nats-server), [github.com/nats-io/nats.go](https://github.com/nats-io/nats.go), [github.com/stretchr/testify](https://github.com/stretchr/testify) and [github.com/testcontainers/testcontainers-go](https://github.com/testcontainers/testcontainers-go). Updates `github.com/nats-io/nats-server/v2` from 2.14.4 to 2.14.5 - [Release notes](https://github.com/nats-io/nats-server/releases) - [Changelog](https://github.com/nats-io/nats-server/blob/main/RELEASES.md) - [Commits](nats-io/nats-server@v2.14.4...v2.14.5) Updates `github.com/nats-io/nats.go` from 1.52.0 to 1.53.1 - [Release notes](https://github.com/nats-io/nats.go/releases) - [Commits](nats-io/nats.go@v1.52.0...v1.53.1) Updates `github.com/stretchr/testify` from 1.11.1 to 1.12.0 - [Release notes](https://github.com/stretchr/testify/releases) - [Commits](stretchr/testify@v1.11.1...v1.12.0) Updates `github.com/testcontainers/testcontainers-go` from 0.43.0 to 0.44.0 - [Release notes](https://github.com/testcontainers/testcontainers-go/releases) - [Commits](testcontainers/testcontainers-go@v0.43.0...v0.44.0) --- updated-dependencies: - dependency-name: github.com/nats-io/nats-server/v2 dependency-version: 2.14.5 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: go-deps - dependency-name: github.com/nats-io/nats.go dependency-version: 1.53.1 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: go-deps - dependency-name: github.com/stretchr/testify dependency-version: 1.12.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: go-deps - dependency-name: github.com/testcontainers/testcontainers-go dependency-version: 0.44.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: go-deps ... Signed-off-by: dependabot[bot] <support@github.com>
dependabot
Bot
added
dependencies
dependabot
Bot
added
dependencies
Contributor
This was referenced Aug 18, 2026
EricAndrechek
added a commit
that referenced
this pull request
Aug 18, 2026
Folds the three open Dependabot PRs into one reviewable change, fixes the pnpm advisories from #486, and repairs the Dependabot config gap that let the `setup-env` composite action drift out of sync in the first place. Closes #486. Supersedes #480, #481, #482. ## Why one PR instead of merging the three They are not independent: - **#486 and #480 touch the same files.** The pnpm pin lives in `publish-npm.yml` and `.github/actions/setup-env/action.yml`; #480 bumps action SHAs in the same two files. Sequencing them costs a rebase either way. - **#480 alone would have made things worse.** Dependabot only sees `.github/workflows/` — see below — so #480 moves the workflows to `actions/cache` v6.1.0 while `setup-env`, which owns every cache in CI, stays on v5.0.5. Only a hand-written commit can close that. - **#482 cannot be rebased into a green state.** Its TypeScript 7 bump is blocked upstream, permanently for now — see below. - **#481 is trivially includable** (`go.mod` / `go.sum`, all patch/minor). One CI run, one review, no interleaving. ## 1. pnpm 11.1.3 → 11.21.0 (#486) **Eight declaration lines across six files**, not the four sites the issue listed: | Site | | | --- | --- | | `package.json` | `packageManager` | | `.github/workflows/publish-npm.yml` | dev + release jobs | | `.github/actions/setup-env/action.yml` | every CI job | | `docs/src/content/docs/development.md` | `corepack prepare` line, prerequisites table, **and** the "verify your setup" snippet | | `README.md` | the `pnpm 11+` floor in Local Development | | `AGENTS.md` | the `pnpm (≥ 11.1)` floor in the toolchain list | **The issue's advisory table is off by four.** #486 lists ten; the actual count affecting 11.1.3 is **fourteen** — 8 high, 6 medium. Its table includes [GHSA-v23m-ccfg-pq9h](GHSA-v23m-ccfg-pq9h), whose range is `>= 11.3.0, < 11.5.3` and so does *not* cover 11.1.3, and omits five that do: GHSA-hwx4-2j3j-g496 (**high**), GHSA-cjhr-43r9-cfmw, GHSA-p4xf-rf54-rj3x, GHSA-q6j5-fjx5-2mc3 and GHSA-54hh-g5mx-jqcp. "Eight high" happens to survive only because the wrongly-included high and the omitted high cancel out. All five were published 2026-06-26, so this was a counting slip when the issue was written, not new information. The remediation is unchanged — the highest `first_patched_version` is still **11.8.0**, and 11.21.0 clears all fourteen. Worth correcting the table on #486 so the issue and this PR agree. **Why 11.21.0 and not 11.22.0 (latest).** 11.22.0 shipped 2026-08-15, three days ago. `pnpm-workspace.yaml` sets `minimumReleaseAge: 10080` — a deliberate 7-day cooldown against compromised releases. That knob governs dependency resolution, not the `packageManager` pin, but the reasoning applies harder here: pnpm runs postinstall scripts under `allowBuilds:` in every CI job, and in `publish-npm.yml`, which holds `id-token: write` for npm trusted publishing. 11.21.0 is 9 days old and equally clear of every advisory. Say the word and I'll move it to 11.22.0. **`lockfileVersion` is unchanged at `9.0`.** The issue flagged a possible bump; 11.21.0 reads and writes the existing format, and `pnpm install --frozen-lockfile` passed against the *pre-existing* lockfile before it was regenerated. ## 2. Dependabot never scanned the composite action `directory: /` for `package-ecosystem: github-actions` reaches `.github/workflows/` and stops. It does **not** descend into `.github/actions/*/action.yml`. `setup-env` has been invisible to Dependabot since it was created. Its only caller is `ci.yml`, which pins none of these actions itself — they all live *inside* `setup-env` — so the staleness shows up against upstream, and against `publish-npm.yml`, a workflow Dependabot *does* track and which does **not** call `setup-env`: | Action | `setup-env` on `main` | elsewhere on `main` | | --- | --- | --- | | `actions/setup-node` | v6.4.0 | **v7.0.0** in `publish-npm.yml` | | `pnpm/action-setup` | v6.0.8 | v6.0.9 in `publish-npm.yml` | | `actions/cache` (×6) | v5.0.5 | v5.0.5 everywhere — no divergence, just a major behind upstream | The `setup-node` row is the tell: that major landed in `publish-npm.yml` in an earlier Dependabot PR and `setup-env`, being invisible, never followed. (#480 would then have *introduced* a cache skew, bumping `publish-dev.yml` to v6.1.0 while `setup-env` stayed on v5.0.5.) This PR aligns all three to the versions the workflows already use — no version is introduced here that Dependabot has not already proposed and CI has not already run — and switches the config to `directories: [/, /.github/actions/setup-env]` so the group covers it from now on. ## 3. actions-deps (#480), verbatim `upload-code-coverage` 1.4.1→1.4.2 · `labeler` 6.2.0→**7.0.0** · `cache` + `cache/restore` 5.0.5→**6.1.0** · `docker/login-action` 4.4.0→4.6.0 · `attest-build-provenance` 4.1.1→4.2.2 · `pnpm/action-setup` 6.0.9→6.0.10. Both majors are ESM migrations with no config surface change, and #480's own CI run was fully green on them. ## 4. go-deps (#481), verbatim `nats-server` 2.14.4→2.14.5 · `nats.go` 1.52.0→1.53.1 · `testify` 1.11.1→1.12.0 · `testcontainers-go` 0.43.0→0.44.0, plus indirects. All patch/minor. #481's only red check was `PR housekeeping` failing on a transient GitHub API 500 inside `actions/labeler` — not a code problem, and now not a red check either (see below). ## 5. npm-deps (#482), minus TypeScript 7 Taken: `tsx` 4.23.5→4.23.12 · `@astrojs/starlight` 0.41.6→0.41.7 · `katex` 0.18.1→0.18.4 · `@types/node` catalog ^26.1.2→^26.2.0. **Held: `typescript` ^6.0.3 → ^7.0.2.** This is why every Node job on #482 went red. Reproduced locally: ``` TypeError: Cannot read properties of undefined (reading 'useCaseSensitiveFileNames') at node_modules/.pnpm/rollup-plugin-dts@6.1.1_.../rollup-plugin-dts.cjs at .../tsup@8.5.1_.../tsup/dist/rollup.js:4857:37 ``` `tsup` 8.5.1 — the current release — **vendors** `rollup-plugin-dts` 6.1.1 into its own bundle, so it is not overridable from our side. 6.1.1 reaches for TS 5-era compiler internals and dies the moment `dts: true` runs. That is `clients/ts`'s `prepare` script, so the crash happens *inside* `pnpm install` and takes down Lint, Unit, E2E, Coverage and Docs build at once. `rollup-plugin-dts` **6.5.0** is the first release declaring `typescript: "^4.5 || ^5 || ^6 || ^7"` (6.4.0 stops at `^6.0`); we need a `tsup` release that vendors ≥ 6.5.0. No rebase of #482 can fix this, and left alone Dependabot re-proposes it every Monday — so `.github/dependabot.yml` now ignores `version-update:semver-major` for `typescript`, with the reason and the removal condition written next to it. The regenerated lockfile changes **exactly four** resolved packages and adds or drops none: ``` @astrojs/starlight: 0.41.6 -> 0.41.7 @types/node: + 26.2.0 (24.13.3, 26.1.2 remain as transitives) katex: 0.18.1 -> 0.18.4 tsx: 4.23.5 -> 4.23.12 ``` ## 6. One-line fix: labeling really is non-fatal now `housekeeping.yml`'s header has always claimed: > Labeling failures are non-fatal so a flaky API call can't block the title > mirror. It wasn't true — the `Apply file-path labels` step has never carried `continue-on-error`, in any revision. So when the labeler hit a transient 500 on #481: ``` ##[error]HttpError: No server is currently available to service your request. ``` the job aborted *before* the title mirror it exists to protect, and the check went red. Adding `continue-on-error: true` makes the documented contract real. In scope because it is the direct cause of one of the three red PRs this change set is meant to clear. `PR housekeeping` is not a required check — the `CI` aggregator is — so this was noise rather than a merge blocker, but it's noise that costs a re-run every time GitHub hiccups. ## What this PR's CI does *not* prove Worth stating rather than implying green means everything: - **`actions/labeler` 6.2.0 → 7.0.0 is not exercised here.** `housekeeping.yml` runs on `pull_request_target`, so GitHub loads that workflow file from `main`, not from the PR head. The `PR housekeeping` check on this PR — and on #480 — runs labeler **v6.2.0** regardless. v7.0.0 first executes on the PR *after* this merges. Mitigating: v7.0.0 is an ESM-migration-only release, `.github/labeler.yml` already uses the v5+ `changed-files` schema, and the labeling step is deliberately `continue-on-error` so a bad labeler cannot block a PR. - **`publish-npm.yml`, `publish-dev.yml` and `release.yml` are tag/release triggered**, so their action bumps (and the new pnpm pin in the publish jobs) first run on the next release, not here. - `actions/cache` 5.0.5 → 6.1.0 *is* covered — `ci.yml` runs on `pull_request`, so every cache in `setup-env` exercises v6.1.0 on this PR. ## Verification - `make ci` green locally with Docker up, running on pnpm 11.21.0 — all static checks, unit, integration, E2E and every coverage gate. - `pnpm install --frozen-lockfile` clean against the regenerated lockfile; `tsup` DTS build succeeds. - No action is pinned at two different versions anywhere under `.github/` any more (was: `cache`, `setup-node`, `pnpm/action-setup`). - `actionlint`, `shellcheck`, `biome` and `markdownlint` all pass over the workflow, config and CHANGELOG edits. - `CHANGELOG.md` updated under `[Unreleased]` — a Security entry for the pnpm bump and a Changed entry for the groups + Dependabot config. - Advisory count re-derived from `gh api "/advisories?ecosystem=npm&affects=pnpm" --paginate` with range matching against 11.1.3, not copied from the issue. Note that #480/#481/#482 are superseded rather than closed by me — Dependabot should retire them on its next run once these versions are on `main`. --------- Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com>
github-actions
Bot
added
area/infra
Contributor
Author
|
Looks like these dependencies are no longer updatable, so this is no longer needed. |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Bumps the go-deps group with 4 updates: github.com/nats-io/nats-server/v2, github.com/nats-io/nats.go, github.com/stretchr/testify and github.com/testcontainers/testcontainers-go.
Updates
github.com/nats-io/nats-server/v2from 2.14.4 to 2.14.5Release notes
Sourced from github.com/nats-io/nats-server/v2's releases.
Commits
d3bc045Release v2.14.516bcbd9Update dependenciesed1644aCherry-picks for 2.14.5 (#8458)618e6c9[FIXED] Route missing after reconnect due to gossip URL mismatch28c83a9Cherry-picks for 2.14.5-RC.1 (#8450)47fb6c3[FIXED] Idempotent stream create uses same created timestamp165bce1Make leafnode tcp dialtimeout configurable62b409b[FIXED] SetLoggerV2 deadlock when prev logger errors on closeUpdates
github.com/nats-io/nats.gofrom 1.52.0 to 1.53.1Release notes
Sourced from github.com/nats-io/nats.go's releases.
Commits
db1375fRelease v1.53.1 (#2118)ae0af2c[IMPROVED] Migrate tests to ntf (#2082)0c5d8d7[ADDED]WithPublishAsyncAckHandleroption for JetStream async publish (#2109)15d96ca[FIXED] Data race in resetOrderedConsumer when resets overlap (#2111)f66c8e7[FIXED] Recognize error code 10164 for replicated KV CAS conflicts (#2097) (#...9d92e85iter: don't yield a phantom (nil, nil) after MsgsTimeout's ErrTimeout (#2093)c68c4de[FIXED] micro: endpoint subject prefix over-match (#2105)e663e67Improve example wording (#2104)c1a0716Add docs.nats.io examples to main (#2106)77e280d[FIXED] MsgsTimeout iterator yields spurious (nil, nil) after a timeout (#2099)Updates
github.com/stretchr/testifyfrom 1.11.1 to 1.12.0Release notes
Sourced from github.com/stretchr/testify's releases.
... (truncated)
Commits
001eb79Merge pull request #1905 from Kentzo/patch-1ad40f38Merge pull request #1906 from stretchr/dependabot/github_actions/actions/chec...3bae017build(deps): bump actions/checkout from 6.0.2 to 6.0.3f8c01f3mock: Mock.Return does not exist anymore12f8b56Merge pull request #1563 from stretchr/make-AssertionFunc-types-aliasesa11649eassert: make *AssertionFunc type just aliasesdc20f41Merge pull request #1890 from stretchr/dolmen/codegen-modernize098f8d7_codegen: use strings.Builderd2699be_codegen: modernizea463c8cMerge pull request #1885 from stretchr/dolmen/ci-check-ghactions-hashesUpdates
github.com/testcontainers/testcontainers-gofrom 0.43.0 to 0.44.0Release notes
Sourced from github.com/testcontainers/testcontainers-go's releases.
... (truncated)
Commits
007bd6bchore: use new version (v0.44.0) in modules and examples6fdd2fdfeat: allow overriding the session ID (#3051)0cfd2f9chore(deps): bump slackapi/slack-github-action from 3.0.3 to 4.0.0 (#3788)5dda4cdchore(deps): bump actions/upload-artifact from 7.0.0 to 7.0.1 (#3789)8cfecf9chore(deps): bump docker/setup-docker-action from 5.1.0 to 5.4.0 (#3790)1d054f6fix: escape the container name in the Docker name filter (#3837)2f869d6fix: should print max information by default (#3459)62941e8chore(azurite): tidy module dependencies (#3838)632ee7bsecurity: fix Dependabot alerts for grpc and OTel (#3835)caa68c6chore(deps): bump github.com/Azure/azure-sdk-for-go/sdk/storage/azblob from 1...Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting
@dependabot rebase.Dependabot commands and options
You can trigger Dependabot actions by commenting on this PR:
@dependabot rebasewill rebase this PR@dependabot recreatewill recreate this PR, overwriting any edits that have been made to it@dependabot show <dependency name> ignore conditionswill show all of the ignore conditions of the specified dependency@dependabot ignore <dependency name> major versionwill close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)@dependabot ignore <dependency name> minor versionwill close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)@dependabot ignore <dependency name>will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)@dependabot unignore <dependency name>will remove all of the ignore conditions of the specified dependency@dependabot unignore <dependency name> <ignore condition>will remove the ignore condition of the specified dependency and ignore conditions