Conversation
Bumps [benchmark-action/github-action-benchmark](https://github.com/benchmark-action/github-action-benchmark) from 1.22.1 to 1.22.2. - [Release notes](https://github.com/benchmark-action/github-action-benchmark/releases) - [Changelog](https://github.com/benchmark-action/github-action-benchmark/blob/master/CHANGELOG.md) - [Commits](benchmark-action/github-action-benchmark@52576c9...4322e57) --- updated-dependencies: - dependency-name: benchmark-action/github-action-benchmark dependency-version: 1.22.2 dependency-type: direct:production update-type: version-update:semver-patch ... Signed-off-by: dependabot[bot] <support@github.com>
dependabot
Bot
added
dependencies
dependabot
Bot
added
dependencies
potiuk
left a comment
potiuk
left a comment
There was a problem hiding this comment.
The red verify is a false positive in our own tooling, not a problem with this bump.
Vendored npm registry check reported 1 modified: node_modules/node-fetch/node_modules/whatwg-url/lib/url-state-machine.js. The cause is line endings. whatwg-url@5.0.0 is a 2016-era package whose published tarball ships that file with CRLF; git normalises line endings on commit, so the committed blob holds the LF form and can never byte-match the tarball:
| line endings | CR count | bytes | git blob | |
|---|---|---|---|---|
| registry tarball | CRLF | 1297 | 33573 | c25dbc2c4862... |
| committed in the action | LF | 0 | 32276 | 27d977a25f90... |
33573 - 32276 = 1297, exactly the CR count, and diff --strip-trailing-cr reports the two files identical. Folding the tarball's CRLF to LF hashes to 27d977a25f9011fc31ed28c17ba11f729b85edea, which is the committed blob.
Checks made before concluding that:
- Content inspection of the vendored file found nothing malicious - no eval, Function(), child_process, spawn/exec, net/dns, http(s) URLs, process.env access, base64 blobs or hex escapes. The one URL is a spec link in a comment. No appended payload, longest line 120 chars.
- The file is byte-identical at the already-approved v1.22.1 (same blob, same 32276 bytes), so the bump introduces nothing.
- The other 26 vendored packages matched their integrity-verified tarballs byte-for-byte.
Fix for the checker is in #1297, with a regression test built from this exact case and a precision guard so a real content edit still fails. Until that lands, this bump would keep failing on every future version.
LGTM.
1 participant
Bumps benchmark-action/github-action-benchmark from 1.22.1 to 1.22.2.
Release notes
Sourced from benchmark-action/github-action-benchmark's releases.
Changelog
Sourced from benchmark-action/github-action-benchmark's changelog.
... (truncated)
Commits
4322e57release v1.22.2Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting
@dependabot rebase.Dependabot commands and options
You can trigger Dependabot actions by commenting on this PR:
@dependabot rebasewill rebase this PR@dependabot recreatewill recreate this PR, overwriting any edits that have been made to it@dependabot show <dependency name> ignore conditionswill show all of the ignore conditions of the specified dependency@dependabot ignore this major versionwill close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)@dependabot ignore this minor versionwill close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)@dependabot ignore this dependencywill close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)