Skip to content

Resolve PR #990 merge conflicts and fix js-yaml empty-document regression - #1066

Merged
decyjphr merged 70 commits into
yadhav/fix-recent-issuesfrom
decyjphr-resolve-pr-990-conflicts
Aug 19, 2026
Merged

Resolve PR #990 merge conflicts and fix js-yaml empty-document regression#1066
decyjphr merged 70 commits into
yadhav/fix-recent-issuesfrom
decyjphr-resolve-pr-990-conflicts

Conversation

@decyjphr

@decyjphr decyjphr commented Aug 19, 2026

Copy link
Copy Markdown
Collaborator

Why

PR #990 (yadhav/fix-recent-issues into main-enterprise) had fallen behind its base and was in a CONFLICTING state. This branch merges the latest main-enterprise into the PR head, resolves all conflicts, and corrects one regression the base introduced, so the PR can merge cleanly.

What changed

Non-obvious detail worth a careful look

The GHSA-52cp-r559-cp3m security fix (#1064) is preserved despite the js-yaml downgrade. That advisory was resolved through the jest ^29.7.0 and lockfile-lint ^4.14.1 dev-dependency upgrades (the transitive js-yaml), both of which remain intact. The direct js-yaml 5.x bump was a separate, unrelated dependabot major that the PR author had deliberately avoided.

Validation

  • Unit tests: pass (347 passed, 14 skipped, 0 failed).
  • Smoke test: all safe-settings assertions pass (181 passed). The 11 failures are all non-safe-settings environment issues (harness drift-injection steps needing admin:org token scope, plus the known Phase 17 app_installations limitation).
  • Integration tests are pre-existing/environmental (probot v14 is ESM-only, jest loads it as CJS); they fail identically on pristine main-enterprise and are not gated in CI.

This is a merge commit (two parents), so it fast-forwards yadhav/fix-recent-issues and updates PR #990 with a conflict-free head.

decyjphr and others added 30 commits October 14, 2025 10:00
@decyjphr
Handle multiple config changes in a PR or Push event and process them…
594f3c7 
… as a batch (#888)

* handle multiple changes as a batch

* Update index.js

Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>

* Update index.js

Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>

* depup files in a push

* Update index.js

Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>

* moved the dedup logic

* Update index.js

Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>

---------

Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>
@dependabot
build(deps): bump undici from 7.7.0 to 7.16.0 (#881)
8ce7b72 
Bumps [undici](https://github.com/nodejs/undici) from 7.7.0 to 7.16.0.
- [Release notes](https://github.com/nodejs/undici/releases)
- [Commits](nodejs/undici@v7.7.0...v7.16.0)

---
updated-dependencies:
- dependency-name: undici
  dependency-version: 7.16.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
@dependabot @decyjphr
build(deps): bump node-cron from 3.0.3 to 4.2.1 (#865)
e4a6ce4 
Bumps [node-cron](https://github.com/merencia/node-cron) from 3.0.3 to 4.2.1.
- [Release notes](https://github.com/merencia/node-cron/releases)
- [Commits](node-cron/node-cron@v3.0.3...v4.2.1)

---
updated-dependencies:
- dependency-name: node-cron
  dependency-version: 4.2.1
  dependency-type: direct:production
  update-type: version-update:semver-major
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: Yadhav Jayaraman <57544838+decyjphr@users.noreply.github.com>
@dependabot @decyjphr
build(deps): bump @apidevtools/json-schema-ref-parser (#882)
c07a33f 
Bumps [@apidevtools/json-schema-ref-parser](https://github.com/APIDevTools/json-schema-ref-parser) from 12.0.2 to 14.2.1.
- [Release notes](https://github.com/APIDevTools/json-schema-ref-parser/releases)
- [Commits](APIDevTools/json-schema-ref-parser@v12.0.2...v14.2.1)

---
updated-dependencies:
- dependency-name: "@apidevtools/json-schema-ref-parser"
  dependency-version: 14.2.1
  dependency-type: direct:production
  update-type: version-update:semver-major
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: Yadhav Jayaraman <57544838+decyjphr@users.noreply.github.com>
@dependabot @decyjphr
build(deps): bump minimatch from 10.0.1 to 10.0.3 (#883)
9592e84 
Bumps [minimatch](https://github.com/isaacs/minimatch) from 10.0.1 to 10.0.3.
- [Changelog](https://github.com/isaacs/minimatch/blob/main/changelog.md)
- [Commits](isaacs/minimatch@v10.0.1...v10.0.3)

---
updated-dependencies:
- dependency-name: minimatch
  dependency-version: 10.0.3
  dependency-type: direct:production
  update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: Yadhav Jayaraman <57544838+decyjphr@users.noreply.github.com>
@dependabot @decyjphr
build(deps-dev): bump eslint-plugin-import from 2.31.0 to 2.32.0 (#884)
fdb6d37 
Bumps [eslint-plugin-import](https://github.com/import-js/eslint-plugin-import) from 2.31.0 to 2.32.0.
- [Release notes](https://github.com/import-js/eslint-plugin-import/releases)
- [Changelog](https://github.com/import-js/eslint-plugin-import/blob/main/CHANGELOG.md)
- [Commits](import-js/eslint-plugin-import@v2.31.0...v2.32.0)

---
updated-dependencies:
- dependency-name: eslint-plugin-import
  dependency-version: 2.32.0
  dependency-type: direct:development
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: Yadhav Jayaraman <57544838+decyjphr@users.noreply.github.com>
@dependabot @decyjphr
ci(deps): bump docker/login-action from 3.5.0 to 3.6.0 (#885)
7362d01 
Bumps [docker/login-action](https://github.com/docker/login-action) from 3.5.0 to 3.6.0.
- [Release notes](https://github.com/docker/login-action/releases)
- [Commits](docker/login-action@184bdaa...5e57cd1)

---
updated-dependencies:
- dependency-name: docker/login-action
  dependency-version: 3.6.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: Yadhav Jayaraman <57544838+decyjphr@users.noreply.github.com>
@dependabot @decyjphr
ci(deps): bump actions/setup-node from 4 to 6 (#890)
19f0949 
Bumps [actions/setup-node](https://github.com/actions/setup-node) from 4 to 6.
- [Release notes](https://github.com/actions/setup-node/releases)
- [Commits](actions/setup-node@v4...v6)

---
updated-dependencies:
- dependency-name: actions/setup-node
  dependency-version: '6'
  dependency-type: direct:production
  update-type: version-update:semver-major
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: Yadhav Jayaraman <57544838+decyjphr@users.noreply.github.com>
@dependabot @decyjphr
build(deps): bump js-yaml in the npm_and_yarn group across 1 directory (
ac8e1c6 
#894)

Bumps the npm_and_yarn group with 1 update in the / directory: [js-yaml](https://github.com/nodeca/js-yaml).


Updates `js-yaml` from 4.1.0 to 4.1.1
- [Changelog](https://github.com/nodeca/js-yaml/blob/master/CHANGELOG.md)
- [Commits](nodeca/js-yaml@4.1.0...4.1.1)

---
updated-dependencies:
- dependency-name: js-yaml
  dependency-version: 4.1.1
  dependency-type: direct:production
  dependency-group: npm_and_yarn
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: Yadhav Jayaraman <57544838+decyjphr@users.noreply.github.com>
@dependabot @decyjphr
ci(deps): bump docker/metadata-action from 5.8.0 to 5.10.0 (#897)
6c12139 
Bumps [docker/metadata-action](https://github.com/docker/metadata-action) from 5.8.0 to 5.10.0.
- [Release notes](https://github.com/docker/metadata-action/releases)
- [Commits](docker/metadata-action@c1e5197...c299e40)

---
updated-dependencies:
- dependency-name: docker/metadata-action
  dependency-version: 5.10.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: Yadhav Jayaraman <57544838+decyjphr@users.noreply.github.com>
@dependabot
ci(deps): bump actions/checkout from 4 to 6 (#898)
a516d99 
Bumps [actions/checkout](https://github.com/actions/checkout) from 4 to 6.
- [Release notes](https://github.com/actions/checkout/releases)
- [Changelog](https://github.com/actions/checkout/blob/main/CHANGELOG.md)
- [Commits](actions/checkout@v4...v6)

---
updated-dependencies:
- dependency-name: actions/checkout
  dependency-version: '6'
  dependency-type: direct:production
  update-type: version-update:semver-major
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
@dependabot @decyjphr
ci(deps): bump docker/setup-qemu-action from 3.6.0 to 3.7.0 (#899)
c0de63b 
Bumps [docker/setup-qemu-action](https://github.com/docker/setup-qemu-action) from 3.6.0 to 3.7.0.
- [Release notes](https://github.com/docker/setup-qemu-action/releases)
- [Commits](docker/setup-qemu-action@2910929...c7c5346)

---
updated-dependencies:
- dependency-name: docker/setup-qemu-action
  dependency-version: 3.7.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: Yadhav Jayaraman <57544838+decyjphr@users.noreply.github.com>
@dependabot
build(deps): bump the npm_and_yarn group across 1 directory with 2 up…
b86aa10 
…dates (#904)

Bumps the npm_and_yarn group with 2 updates in the / directory: [jws](https://github.com/brianloveswords/node-jws) and [validator](https://github.com/validatorjs/validator.js).


Updates `jws` from 3.2.2 to 3.2.3
- [Release notes](https://github.com/brianloveswords/node-jws/releases)
- [Changelog](https://github.com/auth0/node-jws/blob/master/CHANGELOG.md)
- [Commits](auth0/node-jws@v3.2.2...v3.2.3)

Updates `validator` from 13.11.0 to 13.15.26
- [Release notes](https://github.com/validatorjs/validator.js/releases)
- [Changelog](https://github.com/validatorjs/validator.js/blob/master/CHANGELOG.md)
- [Commits](validatorjs/validator.js@13.11.0...13.15.26)

---
updated-dependencies:
- dependency-name: jws
  dependency-version: 3.2.3
  dependency-type: indirect
  dependency-group: npm_and_yarn
- dependency-name: validator
  dependency-version: 13.15.26
  dependency-type: indirect
  dependency-group: npm_and_yarn
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
@dependabot
build(deps): bump qs in the npm_and_yarn group across 1 directory (#912)
a567e4e 
Bumps the npm_and_yarn group with 1 update in the / directory: [qs](https://github.com/ljharb/qs).


Updates `qs` from 6.13.0 to 6.14.1
- [Changelog](https://github.com/ljharb/qs/blob/main/CHANGELOG.md)
- [Commits](ljharb/qs@v6.13.0...v6.14.1)

---
updated-dependencies:
- dependency-name: qs
  dependency-version: 6.14.1
  dependency-type: indirect
  dependency-group: npm_and_yarn
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
@dependabot
build(deps): bump qs in the npm_and_yarn group across 1 directory (#913)
447021f 
Bumps the npm_and_yarn group with 1 update in the / directory: [qs](https://github.com/ljharb/qs).


Updates `qs` from 6.13.0 to 6.14.1
- [Changelog](https://github.com/ljharb/qs/blob/main/CHANGELOG.md)
- [Commits](ljharb/qs@v6.13.0...v6.14.1)

---
updated-dependencies:
- dependency-name: qs
  dependency-version: 6.14.1
  dependency-type: indirect
  dependency-group: npm_and_yarn
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
@dependabot
build(deps): bump octokit from 5.0.3 to 5.0.5 (#905)
802217e 
Bumps [octokit](https://github.com/octokit/octokit.js) from 5.0.3 to 5.0.5.
- [Release notes](https://github.com/octokit/octokit.js/releases)
- [Commits](octokit/octokit.js@v5.0.3...v5.0.5)

---
updated-dependencies:
- dependency-name: octokit
  dependency-version: 5.0.5
  dependency-type: direct:production
  update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
@dependabot @decyjphr
build(deps-dev): bump smee-client from 4.3.1 to 5.0.0 (#906)
5eec970 
Bumps [smee-client](https://github.com/probot/smee-client) from 4.3.1 to 5.0.0.
- [Release notes](https://github.com/probot/smee-client/releases)
- [Commits](probot/smee-client@v4.3.1...v5.0.0)

---
updated-dependencies:
- dependency-name: smee-client
  dependency-version: 5.0.0
  dependency-type: direct:development
  update-type: version-update:semver-major
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: Yadhav Jayaraman <57544838+decyjphr@users.noreply.github.com>
@dependabot @decyjphr
build(deps-dev): bump @eslint/eslintrc from 3.3.1 to 3.3.3 (#908)
0bc802d 
Bumps [@eslint/eslintrc](https://github.com/eslint/eslintrc) from 3.3.1 to 3.3.3.
- [Release notes](https://github.com/eslint/eslintrc/releases)
- [Changelog](https://github.com/eslint/eslintrc/blob/main/CHANGELOG.md)
- [Commits](eslint/eslintrc@v3.3.1...eslintrc-v3.3.3)

---
updated-dependencies:
- dependency-name: "@eslint/eslintrc"
  dependency-version: 3.3.3
  dependency-type: direct:development
  update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: Yadhav Jayaraman <57544838+decyjphr@users.noreply.github.com>
@dependabot @decyjphr
ci(deps): bump docker/setup-buildx-action from 3.11.1 to 3.12.0 (#909)
423468d 
Bumps [docker/setup-buildx-action](https://github.com/docker/setup-buildx-action) from 3.11.1 to 3.12.0.
- [Release notes](https://github.com/docker/setup-buildx-action/releases)
- [Commits](docker/setup-buildx-action@e468171...8d2750c)

---
updated-dependencies:
- dependency-name: docker/setup-buildx-action
  dependency-version: 3.12.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: Yadhav Jayaraman <57544838+decyjphr@users.noreply.github.com>
@dependabot @decyjphr
build(deps): bump undici in the npm_and_yarn group across 1 directory (…
95ee4ac 
…#921)

Bumps the npm_and_yarn group with 1 update in the / directory: [undici](https://github.com/nodejs/undici).


Updates `undici` from 7.16.0 to 7.18.2
- [Release notes](https://github.com/nodejs/undici/releases)
- [Commits](nodejs/undici@v7.16.0...v7.18.2)

---
updated-dependencies:
- dependency-name: undici
  dependency-version: 7.18.2
  dependency-type: direct:production
  dependency-group: npm_and_yarn
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: Yadhav Jayaraman <57544838+decyjphr@users.noreply.github.com>
@dependabot @decyjphr
ci(deps): bump docker/login-action from 3.6.0 to 3.7.0 (#924)
dcc00e7 
Bumps [docker/login-action](https://github.com/docker/login-action) from 3.6.0 to 3.7.0.
- [Release notes](https://github.com/docker/login-action/releases)
- [Commits](docker/login-action@5e57cd1...c94ce9f)

---
updated-dependencies:
- dependency-name: docker/login-action
  dependency-version: 3.7.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: Yadhav Jayaraman <57544838+decyjphr@users.noreply.github.com>
@dependabot
build(deps): bump the npm_and_yarn group across 1 directory with 2 up…
b2a6c96 
…dates (#927)

Bumps the npm_and_yarn group with 2 updates in the / directory: [lodash](https://github.com/lodash/lodash) and @isaacs/brace-expansion.


Updates `lodash` from 4.17.21 to 4.17.23
- [Release notes](https://github.com/lodash/lodash/releases)
- [Commits](lodash/lodash@4.17.21...4.17.23)

Updates `@isaacs/brace-expansion` from 5.0.0 to 5.0.1

---
updated-dependencies:
- dependency-name: lodash
  dependency-version: 4.17.23
  dependency-type: direct:production
  dependency-group: npm_and_yarn
- dependency-name: "@isaacs/brace-expansion"
  dependency-version: 5.0.1
  dependency-type: indirect
  dependency-group: npm_and_yarn
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
@decyjphr
[WIP] Upgrade project to support Node.js 22 and 24 (#939)
f22d6a7 
* Initial plan

* Upgrade Node.js to 22 and 24 (last 2 LTS versions)

Co-authored-by: decyjphr <57544838+decyjphr@users.noreply.github.com>

---------

Co-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com>
Co-authored-by: decyjphr <57544838+decyjphr@users.noreply.github.com>
@decyjphr
Fix Dependabot CI: correct actor check from dependabot to `dependab…
1262444 
…ot[bot]` (#940)

* Initial plan

* Initial plan for fixing CI workflow test

Co-authored-by: decyjphr <57544838+decyjphr@users.noreply.github.com>

* Fix Dependabot actor check in node-ci.yml workflow

The `if` condition used `'dependabot'` but Dependabot's actual GitHub
actor username is `'dependabot[bot]'`. This caused the test job to run
for Dependabot PRs when it should be skipped, resulting in npm install
failures due to ESLint 10 peer dependency conflicts.

Co-authored-by: decyjphr <57544838+decyjphr@users.noreply.github.com>

---------

Co-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com>
Co-authored-by: decyjphr <57544838+decyjphr@users.noreply.github.com>
@decyjphr
Refactor advanced CodeQL workflow steps (#941)
eef9762
@tylerohlsen @decyjphr
Added support for proxy servers in all execution environments (#917)
ba3df39 
* Added support for proxy servers in all execution environments

* Update index.js

Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>

---------

Co-authored-by: Yadhav Jayaraman <57544838+decyjphr@users.noreply.github.com>
Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>
@dependabot @decyjphr
build(deps): bump probot from 13.4.4 to 14.2.4 (#907)
829bc8b 
* build(deps): bump probot from 13.4.4 to 14.2.4

Bumps [probot](https://github.com/probot/probot) from 13.4.4 to 14.2.4.
- [Release notes](https://github.com/probot/probot/releases)
- [Commits](probot/probot@v13.4.4...v14.2.4)

---
updated-dependencies:
- dependency-name: probot
  dependency-version: 14.2.4
  dependency-type: direct:production
  update-type: version-update:semver-major
...

Signed-off-by: dependabot[bot] <support@github.com>

* Fix test suite failures caused by ESM-only `@octokit/core` and `probot` dependencies (#938)

* Initial plan

* Initial plan for fixing failing test suites

Co-authored-by: decyjphr <57544838+decyjphr@users.noreply.github.com>

* Fix failing test suites caused by ESM-only dependencies

Co-authored-by: decyjphr <57544838+decyjphr@users.noreply.github.com>

---------

Co-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com>
Co-authored-by: decyjphr <57544838+decyjphr@users.noreply.github.com>

* Update minimatch dependency version to 10.2.1

* Fix devcontainer configuration and update dependencies (#942)

* fix devcontainer

* Update .devcontainer/Dockerfile

Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>

* Update .devcontainer/Dockerfile

Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>

* Update .devcontainer/devcontainer.json

Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>

---------

Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>

---------

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: Yadhav Jayaraman <57544838+decyjphr@users.noreply.github.com>
Co-authored-by: Copilot <198982749+Copilot@users.noreply.github.com>
Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>
@John15321
fix: prevent race conditions by creating new objects for repository c…
11f29c9 
…onfigurations (#943)

* fix: prevent race conditions by creating new objects for repository configurations

Signed-off-by: Jan Bronicki <janbronicki@microsoft.com>

* Update lib/plugins/repository.js

Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>

---------

Signed-off-by: Jan Bronicki <janbronicki@microsoft.com>
Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>
@tylerohlsen @decyjphr
Change helm defaults to be more newcomer friendly (#919)
2f2229d 
* Updated container port to match the port exposed by the application inside the container

* Added examples for common environment variables

* Changed validators to be examples in comments to avoid needing to override

* Changed min replica count to 1 for more cost effective defaults

* Updated min replica default in docs

* Updated service port default in docs

* Updated validator defaults in docs

* Updated restricted repos include default in docs

* Update helm/safe-settings/values.yaml

Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>

* Update helm/safe-settings/values.yaml

Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>

* Updated README to match the new default value

Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>

---------

Co-authored-by: Yadhav Jayaraman <57544838+decyjphr@users.noreply.github.com>
Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>
@decyjphr
fix: add HOST=0.0.0.0 env to Dockerfile for probot v14 compatibility (#…
34ce7a1 
…948)

Agent-Logs-Url: https://github.com/github/safe-settings/sessions/6a4f5799-ea1f-4900-a659-b492dbdf5cfc

Co-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com>
Co-authored-by: decyjphr <57544838+decyjphr@users.noreply.github.com>
Copilot AI and others added 28 commits March 31, 2026 08:29
@decyjphr
Use npm ci instead of npm install in CI workflow (#958)
d326ac8 
* Initial plan

* Replace npm install with npm ci in node-ci.yml workflow

Agent-Logs-Url: https://github.com/github/safe-settings/sessions/4460185b-428a-48f4-a8b9-471226ccbf58

Co-authored-by: decyjphr <57544838+decyjphr@users.noreply.github.com>

---------

Co-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com>
Co-authored-by: decyjphr <57544838+decyjphr@users.noreply.github.com>
@decyjphr
Replace npm install with npm ci in workflow (#960)
4578aea 
* Replace npm install with npm ci in workflow

* Replace npm install with npm ci in workflow
@madkoo
Bug/issue 465 (#970)
edc9d29 
* fix: apply org-level settings before loading repository configurations

* fix: enhance descriptions and add new properties for security features in settings.json

* fix: update description for deprecated squash-merge commit title property in settings.json

* Update api endpoint version

* Add JSON schemas for safe-settings configuration at repo, org, and suborg levels

- Introduced `repos.json` schema for repository-level safe-settings overrides.
- Updated `settings.json` schema to include additional properties for org-level configurations.
- Created `suborgs.json` schema for suborg-level safe-settings configuration.
- Enhanced the build script to dereference all schemas and handle errors during the process.

* chores: fix branches tests

* fix(build-schema): enhance schema dereferencing with GitHub API spec

* Update docs/github-settings/5. branch-protection.md

Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>

* Update index.js

Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>

* fix(schema): simplify description for force_create property

---------

Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>
@madkoo @decyjphr
Bug/issue 842 (#928)
b9afee8 
* fix: apply org-level settings before loading repository configurations

* fix: enhance descriptions and add new properties for security features in settings.json

* fix: update description for deprecated squash-merge commit title property in settings.json

* test: update branch protection tests to handle null restrictions and enforce_admins

* fix: normalize branch protection restrictions and preserve existing settings

* fix: update GitHub API calls to use the correct namespace for branch protection methods

---------

Co-authored-by: Yadhav Jayaraman <57544838+decyjphr@users.noreply.github.com>
Fix custom_properties diffing when config uses property_name (#978)
3d61f1f 
* Initial plan

* Handle alternate custom property name shapes in normalize

* Add explicit object guard in custom property normalization

* Support property_name in custom_properties config entries

* Polish custom properties test descriptions

---------

Co-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com>
@klutchell @claude
fix(variables): add noop mode support (#926)
0774803 
* feat(variables): add noop mode support

- Add noop mode support to Variables plugin add/remove/update methods
- Return NopCommand instead of making API calls when nop=true
- Add comprehensive tests for noop mode behavior

Signed-off-by: Kyle Harding <kyle@balena.io>

* refactor(variables): align with Diffable contract pattern

Refactor Variables plugin to match the single-item Diffable contract
used by labels, milestones, and other plugins. The previous update()
reimplemented sync() logic internally; now each method handles one item
and lets Diffable.sync() orchestrate iteration.

- Simplify update() from 90-line array-diffing to single-item PATCH
- Simplify changed() from JSON.stringify comparison to value check
- Remove getChanged(), lodash dependency, .then(res=>res) no-ops
- Match labels.js nop return pattern: Promise.resolve([NopCommand])
- Fix inconsistent toUpperCase() between add/remove/update
- Let errors propagate to Diffable.sync() instead of swallowing
- Normalize find() to strip API metadata fields (created_at, etc.)

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
Signed-off-by: Kyle Harding <kyle@balena.io>

---------

Signed-off-by: Kyle Harding <kyle@balena.io>
Co-authored-by: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
@decyjphr
fix: update lodash to ^4.18.1 to fix code injection vulnerability (#992)
db9d78c 
Resolve Dependabot alert #116 - lodash vulnerable to Code Injection
via `_.template` imports key names. Updated from ^4.17.21 to ^4.18.1.

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
@dependabot
build(deps): bump uuid in the npm_and_yarn group across 1 directory
e6ac2a6 
Bumps the npm_and_yarn group with 1 update in the / directory: [uuid](https://github.com/uuidjs/uuid).


Updates `uuid` from 8.3.2 to 14.0.0
- [Release notes](https://github.com/uuidjs/uuid/releases)
- [Changelog](https://github.com/uuidjs/uuid/blob/main/CHANGELOG.md)
- [Commits](uuidjs/uuid@v8.3.2...v14.0.0)

---
updated-dependencies:
- dependency-name: uuid
  dependency-version: 14.0.0
  dependency-type: indirect
...

Signed-off-by: dependabot[bot] <support@github.com>
@madkoo @decyjphr
Bug/archived repo (#991)
a680b0b 
* fix: apply org-level settings before loading repository configurations

* fix: enhance descriptions and add new properties for security features in settings.json

* fix: update description for deprecated squash-merge commit title property in settings.json

* fix issue with archived repos

---------

Co-authored-by: Yadhav Jayaraman <57544838+decyjphr@users.noreply.github.com>
@decyjphr
Merge branch 'main-enterprise' into dependabot/npm_and_yarn/npm_and_y…
7f96326 
…arn-e9ce4f7be9
@decyjphr
Merge pull request #987 from github/dependabot/npm_and_yarn/npm_and_y…
254bad3 
…arn-e9ce4f7be9

Merging dependabot dependency bump: jest-junit ^16.0.0 → ^17.0.0. All checks passed.
@dependabot
build(deps): bump the npm_and_yarn group across 1 directory with 3 up…
44667a6 
…dates

Bumps the npm_and_yarn group with 3 updates in the / directory: [js-yaml](https://github.com/nodeca/js-yaml), [qs](https://github.com/ljharb/qs) and [shell-quote](https://github.com/ljharb/shell-quote).


Updates `js-yaml` from 4.1.1 to 4.2.0
- [Changelog](https://github.com/nodeca/js-yaml/blob/master/CHANGELOG.md)
- [Commits](https://github.com/nodeca/js-yaml/commits)

Updates `qs` from 6.15.0 to 6.15.2
- [Changelog](https://github.com/ljharb/qs/blob/main/CHANGELOG.md)
- [Commits](ljharb/qs@v6.15.0...v6.15.2)

Updates `shell-quote` from 1.8.3 to 1.8.4
- [Changelog](https://github.com/ljharb/shell-quote/blob/main/CHANGELOG.md)
- [Commits](ljharb/shell-quote@v1.8.3...v1.8.4)

---
updated-dependencies:
- dependency-name: js-yaml
  dependency-version: 4.2.0
  dependency-type: direct:production
  dependency-group: npm_and_yarn
- dependency-name: qs
  dependency-version: 6.15.2
  dependency-type: indirect
  dependency-group: npm_and_yarn
- dependency-name: shell-quote
  dependency-version: 1.8.4
  dependency-type: indirect
  dependency-group: npm_and_yarn
...

Signed-off-by: dependabot[bot] <support@github.com>
Initial plan
4ce85a2
feat: add priorityClassName support to Helm chart
f69fffa
@decyjphr
Merge pull request #1004 from github/copilot/allow-priorityclassname-…
4dac294 
…in-helm-chart

feat(helm): add priorityClassName support
@neatcoder
Add include/exclude repo filters to team settings
53a1c75 
Team entries are filtered by the same Diffable include/exclude logic that
collaborators use, but unlike collaborators those keys were never part of the
TeamSettings schema or documented, so editors and linters can't validate them.

Mirror the CollaboratorSettings allOf pattern to declare include and exclude on
TeamSettings, document both in the teams guide with examples, add a sample, and
cover the filter path with unit tests. No runtime changes.
@decyjphr
Merge branch 'main-enterprise' into dependabot/npm_and_yarn/npm_and_y…
83c7a95 
…arn-dc71bf58a9
@decyjphr
Merge pull request #1001 from github-community-projects/dependabot/np…
baac44d 
…m_and_yarn/npm_and_yarn-dc71bf58a9

build(deps): bump the npm_and_yarn group across 1 directory with 3 updates
@decyjphr
Merge branch 'main-enterprise' into neatcoder/team-include-exclude
7877772
@decyjphr
Merge pull request #1009 from neatcoder/neatcoder/team-include-exclude
abcf581 
fix: Add the missing include/exclude repo filters to team settings schema
@dependabot
build(deps-dev): bump flatted from 3.3.4 to 3.4.4 (#1055)
f2016a9 
Bumps [flatted](https://github.com/WebReflection/flatted) from 3.3.4 to 3.4.4.
- [Commits](WebReflection/flatted@v3.3.4...v3.4.4)

---
updated-dependencies:
- dependency-name: flatted
  dependency-version: 3.4.4
  dependency-type: indirect
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
@dependabot
build(deps): bump undici in the npm_and_yarn group across 1 directory (…
5f4313d 
…#1058)

Bumps the npm_and_yarn group with 1 update in the / directory: [undici](https://github.com/nodejs/undici).


Updates `undici` from 7.24.5 to 7.29.0
- [Release notes](https://github.com/nodejs/undici/releases)
- [Commits](nodejs/undici@v7.24.5...v7.29.0)

---
updated-dependencies:
- dependency-name: undici
  dependency-version: 7.29.0
  dependency-type: direct:production
  dependency-group: npm_and_yarn
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
@dependabot @decyjphr
build(deps-dev): bump shell-quote from 1.8.4 to 1.10.0 (#1057)
2b38818 
Bumps [shell-quote](https://github.com/ljharb/shell-quote) from 1.8.4 to 1.10.0.
- [Changelog](https://github.com/ljharb/shell-quote/blob/main/CHANGELOG.md)
- [Commits](ljharb/shell-quote@v1.8.4...v1.10.0)

---
updated-dependencies:
- dependency-name: shell-quote
  dependency-version: 1.10.0
  dependency-type: indirect
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: Yadhav Jayaraman <57544838+decyjphr@users.noreply.github.com>
@dependabot @decyjphr
build(deps): bump js-yaml in the npm_and_yarn group across 1 directory (
4fef67d 
#1059)

Bumps the npm_and_yarn group with 1 update in the / directory: [js-yaml](https://github.com/nodeca/js-yaml).


Updates `js-yaml` from 4.2.0 to 4.3.1
- [Changelog](https://github.com/nodeca/js-yaml/blob/4.3.1/CHANGELOG.md)
- [Commits](nodeca/js-yaml@4.2.0...4.3.1)

---
updated-dependencies:
- dependency-name: js-yaml
  dependency-version: 4.3.1
  dependency-type: direct:production
  dependency-group: npm_and_yarn
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: Yadhav Jayaraman <57544838+decyjphr@users.noreply.github.com>
@dependabot @decyjphr
build(deps-dev): bump brace-expansion (#1060)
4940918 
Bumps the npm_and_yarn group with 1 update in the / directory: [brace-expansion](https://github.com/juliangruber/brace-expansion).


Updates `brace-expansion` from 1.1.13 to 1.1.18
- [Release notes](https://github.com/juliangruber/brace-expansion/releases)
- [Commits](juliangruber/brace-expansion@v1.1.13...v1.1.18)

---
updated-dependencies:
- dependency-name: brace-expansion
  dependency-version: 1.1.18
  dependency-type: indirect
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: Yadhav Jayaraman <57544838+decyjphr@users.noreply.github.com>
@dependabot
build(deps): bump body-parser (#1061)
585ba6f 
Bumps the npm_and_yarn group with 1 update in the / directory: [body-parser](https://github.com/expressjs/body-parser).


Updates `body-parser` from 2.2.2 to 2.3.0
- [Release notes](https://github.com/expressjs/body-parser/releases)
- [Changelog](https://github.com/expressjs/body-parser/blob/master/HISTORY.md)
- [Commits](expressjs/body-parser@v2.2.2...v2.3.0)

---
updated-dependencies:
- dependency-name: body-parser
  dependency-version: 2.3.0
  dependency-type: indirect
  dependency-group: npm_and_yarn
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
@decyjphr
Fix GHSA-52cp-r559-cp3m: resolve transitive js-yaml via jest and lock…
c73be50 
…file-lint upgrades (#1064)

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
@decyjphr
Merge main-enterprise into yadhav/fix-recent-issues (resolve PR #990 …
d45b873 
…conflicts)

Resolve merge conflicts, favoring the PR branch's refactor which already
incorporates the relevant base changes (#1009 team include/exclude,
#1004 helm priorityClassName, #888 batch config changes, proxy support).

Dependency conflicts: keep js-yaml ^5.2.2 (base security fix GHSA-52cp-r559-cp3m)
and probot ^14.3.2 (newer). package-lock.json regenerated; dereferenced
schemas regenerated via build:schema.

Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
@decyjphr
decyjphr merged commit dc1a2c9 into yadhav/fix-recent-issues Aug 19, 2026
2 checks passed
@decyjphr
decyjphr deleted the decyjphr-resolve-pr-990-conflicts branch August 19, 2026 01:16
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

9 participants

@decyjphr @cyndiadams0521-jpg @tylerohlsen @John15321 @lindluni @madkoo @klutchell @neatcoder