chore(deps): update dependency probot to v14 - autoclosed by renovate[bot] · Pull Request #115 · probot/metadata

Probot is now an ESM only library
drop Node > 20.17 and Node 21 support
Switch to GitHub's OpenAPI specification for Webhooks (from @octokit/webhooks v13)
Remove legacy REST enpoint method access. Users will now have to use the octokit.rest.* methods
Remove express server from within Probot.
All properties marked as private in Typescript, including Probot#state, are now private class fields.
createNodeMiddleware() is now an async function
@sentry/node needs to be installed separately if needed
ioredis needs to be installed separately if needed
The built-in server now listens on localhost by default instead of 0.0.0.0.

Probot v14 Migration Guide

ESM Only Package

Probot is now exclusively an ESM package. Either migrate to ESM (recommended), or use `require(esm).

Migrating to ESM:

Update package.json:

{
  "type": "module"
}

Replace all CommonJS require() statements with ESM import syntax
Update your TypeScript configuration:

{
  "compilerOptions": {
    "module": "node16",
    "moduleResolution": "node16"
  }
}

For require(esm):

For TypeScript 5.7-5.8: Use "module": "nodenext" and "moduleResolution": "nodenext"
For TypeScript 5.9+: Use "module": "node20" and "moduleResolution": "node20"

Node.js Version Requirements

Minimum supported version: Node.js 20.18+ and 22+
Node.js 21 support has been dropped

Webhook Type Definitions

Replace webhook type imports:

// Before
import { WebhookEvent } from "@&#8203;octokit/webhooks-types";

// After
import { WebhookEvent } from "@&#8203;octokit/openapi-webhooks-types-migration";

REST API Access Pattern

Legacy endpoint methods have been removed:

app.on("issues.opened", async (context) => {
  // Before
  // const issue = await context.octokit.issues.get(context.issue());

  // After
  const issue = await context.octokit.rest.issues.get(context.issue());
});

Express Server Removal

The built-in Express server has been removed. To use Express:

Install Express:

npm install express

Update your Probot setup:

import Express from "express";
import { createNodeMiddleware, createProbot } from "probot";

const express = Express();

const app = (probot) => {
  probot.on("push", async () => {
    probot.log.info("Push event received");
  });
};

const middleware = await createNodeMiddleware(app, {
  webhooksPath: "/api/github/webhooks",
  probot: createProbot({
    env: {
      APP_ID,
      PRIVATE_KEY,
      WEBHOOK_SECRET,
    },
  }),
});

express.use(middleware);
express.use(Express.json());
express.get("/custom-route", (req, res) => {
  res.json({ status: "ok" });
});

express.listen(3000, () => {
  console.log(`Server is running at http://localhost:3000`);
});

HTTP Server no longer listens on `0.0.0.0` by default

The built-in HTTP server will now listen on localhost by default, instead of listening on all available interfaces.
If you wish to change this behaviour, you can use the HOST environment variable, or the --host variable for the probot run command.

env HOST=0.0.0.0 <start script>
probot run --host=0.0.0.0 app.js

Asynchronous Middleware Initialization

createNodeMiddleware() is now asynchronous:

import { createNodeMiddleware } from "probot";
import app from "../app.js";

// Before
// const middleware = createNodeMiddleware(app);

// After
const middleware = await createNodeMiddleware(app);

`v13.4.7`

Compare Source

Bug Fixes

update @octokit/webhooks, remove internal rebindLog() function (#2220) (c4c67c3), closes #2062

`v13.4.6`

Compare Source

Bug Fixes

update @octokit/auth-app and @octokit/core to fix logger binding issues (058878b)

`v13.4.5`

Compare Source

Bug Fixes

deps: update dependency express to v5 (#2090) (f6d4c3e)

`v13.4.4`

Compare Source

Bug Fixes

deps: update Octokit dependencies that have ReDos vulnerability (816f2f7)

`v13.4.3`

Compare Source

Bug Fixes

deps: update dependency @probot/pino to v3 (#2140) (7c3a99d)

`v13.4.2`

Compare Source

Bug Fixes

memoryleak of octokit hook (#2129) (2b48a8e)

`v13.4.1`

Compare Source

Bug Fixes

ensure that the logger is always bound (#2119) (cc85a24), closes #2116

`v13.4.0`

Compare Source

Features

allow custom logger for Octokit instances (#2100) (19954c8)

`v13.3.10`

Compare Source

Bug Fixes

deps: use fork of lru-cache to fix type issues (#2104) (c87926b)

`v13.3.9`

Compare Source

Bug Fixes

deps: bump @probot/pino to v2.5.0 (f26cf46), closes #2102

`v13.3.8`

Compare Source

Bug Fixes

deps: bump express to v4.21.0 (#2085) (4c5310a)

`v13.3.7`

Compare Source

Bug Fixes

types: avoid TS2590 errors in Context (#2073) (23f6eab), closes #1968

`v13.3.6`

Compare Source

Bug Fixes

deps): Revert "fix(deps: update dependency lru-cache to v11" (#2056) (60ff5b6), closes #2049

`v13.3.5`

Compare Source

Bug Fixes

remove eventsource dependency (#2052) (caee841)

`v13.3.4`

Compare Source

Bug Fixes

ci: Use organization-wide PROBOTBOT_NPM_TOKEN (#2054) (cc86a53)

`v13.3.0`

Compare Source

Features

set x-github-delivery header to event.id for all requests sent from context.octokit in event handlers (#2027) (12944d5)

`v13.2.2`

Compare Source

Bug Fixes

deps: update dependencies pino to v9, pino-http to v10 (#2007) (ef7b9df)

`v13.2.1`

Compare Source

Bug Fixes

probot: passes logger to webhooks (#2011) (93007b6)

`v13.2.0`

Compare Source

Features

security: Configure provenance (#1997) (3f20320)

`v13.1.2`

Compare Source

Bug Fixes

deps: update dependency express to v4.19.2 [security] (b1d3ac3)

`v13.1.1`

Compare Source

Bug Fixes

deps: move bottleneck to dependencies (#1992) (52de532)

`v13.1.0`

Compare Source

Features

run: allow passing Octokit and log (#1984) (d195264)

`v13.0.2`

Compare Source

Bug Fixes

deps: update dependency commander to v12 (737835f)

`v13.0.1`

Compare Source

Bug Fixes

deps: update dependency pino-http to v9 (#1953) (5d95b73)

`v13.0.0`

Compare Source

Features

v13 (#1874) (948a1b7), closes #1643
Upgrade Octokit libraries to their latest major version

BREAKING CHANGES

Drop support for NodeJS < 18
replace node-fetch with the Fetch API
default webhookPath is now /api/github/webhooks
probot receive now only supports payloads in JSON format, previously also (unintionally) allowed JS.
Probot now requires that payloads be passed as string to the .verify(), .verifyAndReceive() methods. Passing objects is no longer supported
The middleware no longer accepts parsed payloads. You will have to pass it as a string

Note on Vercel deployments:

Set NODEJS_HELPERS environment variable to 0 in order to prevent Vercel from parsing the response body.
See Disable Helpers for detail.

`v12.4.0`

Compare Source

Features

set x-github-delivery header to event.id for all requests sent from context.octokit in event handlers (#2026) (f1985e5)

`v12.3.4`

Compare Source

Bug Fixes

probot: passes logger to webhooks (#2010) (3dcb058)

`v12.3.3`

Compare Source

Bug Fixes

deps: @octokit/webhooks security update (#1911) (02d81f8)

`v12.3.2`

Compare Source

Bug Fixes

Fix async main function type (#1672) (fc6886d)

Configuration

📅 Schedule: Branch creation - At any time (no schedule defined), Automerge - At any time (no schedule defined).

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

If you want to rebase/retry this PR, check this box

This PR was generated by Mend Renovate. View the repository job log.

renovate bot added the Type: Maintenance label Jul 31, 2025

renovate bot force-pushed the renovate/probot-14.x branch 3 times, most recently from 620f891 to 930f00e Compare August 13, 2025 16:39

renovate bot force-pushed the renovate/probot-14.x branch from 930f00e to fbf522d Compare August 31, 2025 09:45

renovate bot force-pushed the renovate/probot-14.x branch from fbf522d to b04ee1f Compare September 25, 2025 20:52

renovate bot force-pushed the renovate/probot-14.x branch 4 times, most recently from 3dd3bb9 to 0f3c1cc Compare October 11, 2025 05:53

renovate bot force-pushed the renovate/probot-14.x branch from 0f3c1cc to 21668d6 Compare October 14, 2025 05:29

chore(deps): update dependency probot to v14

991c0a3

renovate bot force-pushed the renovate/probot-14.x branch from 21668d6 to 991c0a3 Compare October 15, 2025 16:45

renovate bot changed the title ~~chore(deps): update dependency probot to v14~~ chore(deps): update dependency probot to v14 - autoclosed Oct 20, 2025

renovate bot closed this Oct 20, 2025

renovate bot deleted the renovate/probot-14.x branch October 20, 2025 19:09

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

chore(deps): update dependency probot to v14 - autoclosed#115

chore(deps): update dependency probot to v14 - autoclosed#115
renovate[bot] wants to merge 1 commit intomasterfrom
renovate/probot-14.x

renovate bot commented Jul 31, 2025 •

edited

Loading

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants

Conversation

renovate bot commented Jul 31, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Release Notes

Bug Fixes

Features

Features

Bug Fixes

Bug Fixes

Bug Fixes

Bug Fixes

Bug Fixes

Bug Fixes

BREAKING CHANGES

Probot v14 Migration Guide

ESM Only Package

Node.js Version Requirements

Webhook Type Definitions

REST API Access Pattern

Express Server Removal

HTTP Server no longer listens on 0.0.0.0 by default

Asynchronous Middleware Initialization

Bug Fixes

Bug Fixes

Bug Fixes

Bug Fixes

Bug Fixes

Bug Fixes

Bug Fixes

Features

Bug Fixes

Bug Fixes

Bug Fixes

Bug Fixes

Bug Fixes

Bug Fixes

Bug Fixes

Features

Bug Fixes

Bug Fixes

Features

Bug Fixes

Bug Fixes

Features

Bug Fixes

Bug Fixes

Features

BREAKING CHANGES

Note on Vercel deployments:

Features

Bug Fixes

Bug Fixes

Bug Fixes

Configuration

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants

renovate bot commented Jul 31, 2025 •

edited

Loading

HTTP Server no longer listens on `0.0.0.0` by default