chore(deps): bump fast-uri from 3.1.4 to 3.1.5 - #9300
Merged
Conversation
dependabot
Bot
added
dependencies
javascript
dependabot
Bot
added
dependencies
javascript
Deploying with
|
| Status | Name | Latest Commit | Updated (UTC) |
|---|---|---|---|
| ✅ Deployment successful! View logs |
metagraphed-ui | 1af9abb | Aug 04 2026, 03:49 PM |
Deploying with
|
| Status | Name | Latest Commit | Updated (UTC) |
|---|---|---|---|
| ✅ Deployment successful! View logs |
metagraphed-data-api | 1af9abb | Aug 04 2026, 03:46 PM |
Deploying with
|
| Status | Name | Latest Commit | Updated (UTC) |
|---|---|---|---|
| ✅ Deployment successful! View logs |
metagraphed-registry-sync-api | 1af9abb | Aug 04 2026, 03:46 PM |
|
Superagent didn't find any vulnerabilities or security issues in this PR. |
JSONbored
approved these changes
Aug 3, 2026
This was referenced Aug 4, 2026
JSONbored
added a commit
that referenced
this pull request
Aug 4, 2026
* fix(ci): route Dependabot PRs down the tokenless Codecov path Every Dependabot PR fails its test job, and #9300 is just the one that surfaced it: -> Token length: 0 error -- Commit creating failed: {"message":"Token required because branch is protected"} The four Codecov steps picked their path by WHERE THE BRANCH LIVES — head.repo.full_name == github.repository — and a Dependabot branch is same-repo, so it took the token path. But `pull_request` runs triggered by Dependabot get their own secret scope and cannot read secrets.CODECOV_TOKEN. It resolved to the empty string, Codecov rejected the protected branch, and fail_ci_if_error: true failed the job. No dependency bump could ever go green. The condition asked the wrong question. What decides the path is whether the run can READ SECRETS, not whether the branch is local — those coincide for ordinary PRs and for forks, and diverge for exactly one trigger. Dependabot now takes the same tokenless path forks already use, which already supplies the `owner:branch` prefix that makes Codecov treat a branch as unprotected. That prefix is what a Dependabot branch needs too. Granting the token in the repo's Dependabot secret scope is the alternative and is worse: it leaves the workflow broken by default for anyone who clones it, and silently re-breaks if that setting is ever lost. Verified by evaluating all four `if` expressions across every trigger shape -- main push, same-repo PR, Dependabot PR, fork PR -- and asserting exactly one path runs per scenario: scenario tokened tokenless tokened tokenless main push RUN skip RUN skip same-repo PR RUN skip RUN skip DEPENDABOT PR skip RUN skip RUN fork PR skip RUN skip RUN The two renamed steps are quoted, because a colon-space inside an unquoted YAML scalar starts a nested mapping and broke the parse. Closes #9404 * fix(ci): identify the tokenless Codecov steps by what they do, not what they are named The Codecov split rule looked each step up by an exact literal -- "Upload coverage to Codecov (fork PR tokenless)" -- which quietly made the step's TITLE part of the contract. Renaming it to say what it now covers (forks AND Dependabot, which is the point of this PR) failed the validator while changing nothing the rule is about, and a name is prose. It now enumerates the workflow's steps and selects the Codecov ones structurally: whichever upload carries `secrets.CODECOV_TOKEN` is the trusted path, the rest are the untrusted one. The three properties that actually matter are unchanged -- exactly one tokenful coverage upload, no token on the tokenless ones, `fail_ci_if_error: true` there (an upload that swallows its own failure reports nothing and hides that it reported nothing), and the owner:branch prefix Codecov requires from an untrusted uploader. Proven still to catch what it is for, against a deliberately broken workflow: dropping `fail_ci_if_error: true` and dropping the owner:branch prefix each fail it. * fix(ci): write the step indent as {6} instead of six literal spaces no-regex-spaces refused it, and the rule is right: six literal spaces in a regex is a count nobody can verify by eye, in a validator whose whole job is to be precise about workflow structure. {6} says the same thing and can be read. The indent itself is unchanged -- six is where a step sits under jobs.<id>.steps.
Bumps [fast-uri](https://github.com/fastify/fast-uri) from 3.1.4 to 3.1.5. - [Release notes](https://github.com/fastify/fast-uri/releases) - [Commits](fastify/fast-uri@v3.1.4...v3.1.5) --- updated-dependencies: - dependency-name: fast-uri dependency-version: 3.1.5 dependency-type: indirect ... Signed-off-by: dependabot[bot] <support@github.com>
JSONbored
force-pushed
the
dependabot/npm_and_yarn/fast-uri-3.1.5
branch
from
August 4, 2026 15:45
44cdcf0 to
1af9abb
Compare
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Bumps fast-uri from 3.1.4 to 3.1.5.
Release notes
Sourced from fast-uri's releases.
Commits
5e179cbBumped v3.1.52cad02dMerge commit from forkDependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting
@dependabot rebase.Dependabot commands and options
You can trigger Dependabot actions by commenting on this PR:
@dependabot rebasewill rebase this PR@dependabot recreatewill recreate this PR, overwriting any edits that have been made to it@dependabot show <dependency name> ignore conditionswill show all of the ignore conditions of the specified dependency@dependabot ignore this major versionwill close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)@dependabot ignore this minor versionwill close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)@dependabot ignore this dependencywill close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)You can disable automated security fix PRs for this repo from the Security Alerts page.