Skip to content

chore(deps): update external non-major dependencies - #2515

Merged
0xPlayerOne merged 4 commits into
mainfrom
chore/deps-external-2026-10
Oct 5, 2026
Merged

0xPlayerOne merged 4 commits into
mainfrom
chore/deps-external-2026-10

Conversation

@0xPlayerOne

@0xPlayerOne 0xPlayerOne commented Oct 5, 2026 •

Copy link
Copy Markdown
Member

code-foundry 1.44.3 → 1.44.4, oxfmt 0.71 → 0.72, and the taiki-e/install-action SHA pin for the desktop sccache step. Same content as the renovate draft #2509, rebased onto the current main and with the bun.lock workspaces x-release-please version markers restored — renovate's lockfile rewrite drops them, which desyncs release-please. Supersedes #2509.

Validated locally: oxfmt 0.72 repo-wide format check clean (no reformat churn), pre-commit gate green under code-foundry 1.44.4.

code-foundry 1.44.3 -> 1.44.4, oxfmt 0.71 -> 0.72, and the
taiki-e/install-action pin for the desktop sccache step.

Renovate's lockfile rewrite drops the x-release-please version markers
from the bun.lock workspaces section; they are restored here so
release-please keeps bumping the workspace versions. Supersedes the
stale renovate draft #2509.
@0xPlayerOne 0xPlayerOne changed the title chore: deps-external-2026-10 chore(deps): update external non-major dependencies Oct 5, 2026
@0xPlayerOne
0xPlayerOne marked this pull request as ready for review October 5, 2026 19:11
The install-action SHA is deliberately pinned by scripts/desktop-cache.test.mjs
as a supply-chain control; ride-along SHA bumps are their own reviewed change,
not part of the external dependency group.
@0xPlayerOne
0xPlayerOne marked this pull request as draft October 5, 2026 19:30
@0xPlayerOne
0xPlayerOne marked this pull request as ready for review October 5, 2026 19:31
@0xPlayerOne
0xPlayerOne merged commit c2212d4 into main Oct 5, 2026
98 of 136 checks passed
@0xPlayerOne
0xPlayerOne deleted the chore/deps-external-2026-10 branch October 5, 2026 21:46
0xPlayerOne added a commit that referenced this pull request Oct 5, 2026
…2518)

Pinned action SHAs are audited supply-chain controls enforced by
scripts/desktop-cache.test.mjs, so a digest bump is its own reviewed
change: the ride-along taiki-e/install-action move in #2509 failed the
Unit lane and was dropped from #2515. The null groupName clears the
external group for github-actions digest and pin updates.
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant