chore(deps): update tj-actions/changed-files digest to 24d32ff - #1915
chore(deps): update tj-actions/changed-files digest to 24d32ff#1915renovate[bot] wants to merge 1 commit into
Conversation
|
The latest updates on your projects. Learn more about Vercel for GitHub.
|
|
Bundle Size ReportLast updated: 2026-08-14 11:23:37 UTC
Baseline source: comment-chain |
759f1b0 to
9bd25e6
Compare
|
Closing — this is a downgrade, not an upgrade.
Fixed in #1928 by retagging the pin comment to |
Renovate Ignore NotificationBecause you closed this PR without merging, Renovate will ignore this update. You will not get PRs for the If you accidentally closed this PR, or if you changed your mind: rename this PR to get a fresh replacement PR. |
…downgrade (#1928) Renovate opened seven dependency PRs that must never merge. Six of them (#1917 #1918 #1919 #1920 #1923 #1924) bump pnpm override entries across a major boundary. Those keys are selectors, not package names: "yaml@1" means "consumers resolving to yaml v1 get this patched v1", so raising the value to 2.9.0 forces a v2 API onto v1 consumers. Two are already red in CI ("TypeError: expand is not a function" for brace-expansion@2 -> ^5.0.0, and gray-matter's yaml.safeLoad.bind() for js-yaml ^3.15.0 -> ^5.0.0); the rest are green only because CI never exercises the affected transitive consumers -- the same blind spot that let #1904 ship the minimatch v10 break that #1913 had to revert, and which #1920 now proposes again. Renovate also rewrites floor+cap ranges into bare caps (immutable ">=4.3.9 <5" -> "<6", undici ">=7.28.0 <8" -> "<9"), discarding the security floor that justified the override. Suppress majors on override depTypes. Minor/patch still flow so floors can be raised, and CVE remediation is unaffected because vulnerabilityAlerts already bypasses packageRules. Separately, #1915 proposed a tj-actions/changed-files digest "update" that is really a 7-month downgrade: upstream never moved the floating v47 tag past v47.0.0, so Renovate resolved our newer v47.0.6 pin backwards. Retagging the pin comment to the exact patch restores semver comparison. Audited all nine pinned actions; this was the only one affected. Co-authored-by: Claude Opus 4.6 <noreply@anthropic.com>
1 participant
This PR contains the following updates:
9426d40→24d32ffConfiguration
📅 Schedule: (UTC)
* 0-4,22-23 * * 1-5)* * * * 0,6)🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.
♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.
🔕 Ignore: Close this PR and you won't be reminded about this update again.
This PR was generated by Mend Renovate. View the repository job log.