Repository navigation
build(deps): apply pending Dependabot updates - #72397
Conversation
Combine eight npm, Go, and Python dependency updates and pin the new python-dateutil tzdata dependency with its wheel hash. Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
|
✅ Design Decision Gate 🏗️ completed the design decision gate check. See the comment below for the result and any generated ADR draft. Design Decision Gate 🏗️Outcome: The agent completed and reported no action. A no-op output alone does not verify that all required work was completed or that publication was possible. Agent messages are omitted from this comment. The category uses structured run status, not interpretation of agent prose.
|
|
✅ Ponytail Reviewer completed successfully! Ponytail ReviewerOutcome: The agent completed and reported no action. A no-op output alone does not verify that all required work was completed or that publication was possible. Agent messages are omitted from this comment. The category uses structured run status, not interpretation of agent prose.
|
|
🧠 Matt Pocock Skills Reviewer has completed the skills-based review. ✅
|
|
✅ PR Code Quality Reviewer completed the code quality review.
|
|
✅ Test Quality Sentinel completed test quality analysis. Test Quality SentinelOutcome: The agent completed and reported no action. A no-op output alone does not verify that all required work was completed or that publication was possible. Agent messages are omitted from this comment. The category uses structured run status, not interpretation of agent prose.
|
There was a problem hiding this comment.
🔵 Needs a closer look
Blocked npm and Python dependency installations leave JavaScript typechecking/tests and AgentRx runtime compatibility unverified, including compatibility with the python-dateutil major upgrade.
No open issues 🎉
1 file not reviewed
actions/setup/js/package-lock.json: Generated file
What changed in this PR
Consolidates eight pending Dependabot updates across gh-aw’s Go CLI dependencies, JavaScript tooling, and Python workflow environments.
Changes:
- Updates Copilot SDK to 1.0.26 and Vite to 8.3.5, with corresponding lockfile dependencies.
- Updates go-gh to v2.17.0 and go-timezone-local to v0.0.9.
- Updates hashed Python dependency pins and adds
tzdata==2026.5for python-dateutil 3.0.0.
Reported Go validation passed. The PR remains a draft pending successful npm installation and Python runtime compatibility validation.
| File | Description |
|---|---|
go.sum |
Updates checksums for go-gh and its timezone dependency. |
go.mod |
Updates Go dependency versions. |
actions/setup/js/package.json |
Updates Copilot SDK and Vite requirements. |
actions/setup/js/package-lock.json |
Records updated JavaScript packages, platform bindings, and integrity hashes. |
.github/workflows/requirements-geo-optimizer.txt |
Updates the hashed soupsieve pin. |
.github/workflows/requirements-agentrx.txt |
Updates Python pins and hashes, including the new tzdata dependency. |
Review effort: Max
|
🎉 This pull request is included in a new release. Release: |
Consolidate the eight pending Dependabot updates so npm, Go, and workflow Python dependencies can be reviewed together.
Changes
@github/copilot-sdkto 1.0.26 and Vite to 8.3.5, including their lockfile dependencies.github.com/cli/go-gh/v2to v2.17.0 and its timezone dependency to v0.0.9.tzdata==2026.5with a verified wheel SHA-256 hash because python-dateutil 3.0.0 now requires it and the AgentRx environment uses a fully pinned sync.Incorporates #72385, #72386, #72387, #72388, #72389, #72390, #72391, and #72392. The original PRs have not been merged or closed.
Validation
Passed:
go mod downloadandgo mod verifymake buildgo test ./pkg/githubapi ./pkg/repoutil ./pkg/parser -count=1go test ./pkg/workflow -run '(?i)agentrx' -count=1git diff --check, npm manifest/lock version consistency, and Python pin/hash syntax checksmake test-unitcompleted but skipped impacted tests because no Go source files changed; the explicit package tests above ran separately.Blocked:
npm cifails because both the configured npm feed and the approved 1ES feed return 404 for the Vite 8.3.5 tarball. JavaScript typechecking and tests could not run.make agent-report-progressstops because pinned Prettier is unavailable after the failed npm install.This PR is intentionally a draft pending complete dependency installation and validation.