Skip to content

build(deps): bump proxy-from-env from 1.1.0 to 2.0.0 - #934

Merged
decyjphr merged 1 commit into
main-enterprisefrom
dependabot/npm_and_yarn/proxy-from-env-2.0.0
Mar 30, 2026
Merged

build(deps): bump proxy-from-env from 1.1.0 to 2.0.0#934
decyjphr merged 1 commit into
main-enterprisefrom
dependabot/npm_and_yarn/proxy-from-env-2.0.0

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Mar 1, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

Bumps proxy-from-env from 1.1.0 to 2.0.0.

Release notes

Sourced from proxy-from-env's releases.

v2.0.0

What's Changed

  • Remove url.parse usage to avoid DEP0169 DeprecationWarning (#30).

  • Use WHATWG URL constructor to parse strings instead of url.parse. This may cause getProxyForUrl to return an empty string instead of a proxy URL when the input is an invalid URL.

  • Switch from CJS to ESM. When import syntax is used, the minimum compatible Node.js version is v12.17.0. When require is used, the minimum compatible Node.js version is v20.19.0, because that version introduced require(esm) support.

  • Drop detection of npm_config_-prefixed environment variables, which was introduced in 1.1.0. Now the behavior is back to version 1.0.0. This should not affect users in practice, because the npn ecosystem dropped support for these environment variables many years ago (#13).

Full Changelog: Rob--W/proxy-from-env@v1.1.0...v2.0.0

Commits
  • f4d1be8 2.0.0
  • 83cb866 Update README
  • e32b37e Replace url.parse with WHATWG URL API
  • 00ac7ff Drop support for npm_config_* prefixes
  • abefaff Add sideEffects:false to package.json for easier tree shaking
  • 3549220 test: simplify testProxyUrl
  • 2f8948f CI: Run tests with all supported Node.js versions
  • 582fa7f Add test for difference between url.parse and WHATWG URL
  • 7c0264e Migrate from CommonJS to ESM
  • 520d25a Upgrade to eslint 9 with flat config
  • Additional commits viewable in compare view

Dependabot compatibility score

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
  • @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
  • @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
  • @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

@dependabot dependabot Bot added dependencies Pull requests that update a dependency file javascript Pull requests that update Javascript code labels Mar 1, 2026
@dependabot
dependabot Bot force-pushed the dependabot/npm_and_yarn/proxy-from-env-2.0.0 branch 3 times, most recently from f942bd7 to e4f2497 Compare March 3, 2026 13:42
@dependabot
dependabot Bot force-pushed the dependabot/npm_and_yarn/proxy-from-env-2.0.0 branch 2 times, most recently from 4009f96 to d023ced Compare March 23, 2026 17:39
@dependabot
build(deps): bump proxy-from-env from 1.1.0 to 2.0.0
ee58b3a 
Bumps [proxy-from-env](https://github.com/Rob--W/proxy-from-env) from 1.1.0 to 2.0.0.
- [Release notes](https://github.com/Rob--W/proxy-from-env/releases)
- [Commits](Rob--W/proxy-from-env@v1.1.0...v2.0.0)

---
updated-dependencies:
- dependency-name: proxy-from-env
  dependency-version: 2.0.0
  dependency-type: direct:production
  update-type: version-update:semver-major
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot
dependabot Bot force-pushed the dependabot/npm_and_yarn/proxy-from-env-2.0.0 branch from d023ced to ee58b3a Compare March 29, 2026 00:47
@decyjphr decyjphr closed this Mar 30, 2026
@dependabot @github

dependabot Bot commented on behalf of github Mar 30, 2026

Copy link
Copy Markdown
Contributor Author

OK, I won't notify you again about this release, but will get in touch when a new version is available. If you'd rather skip all updates until the next major or minor version, let me know by commenting @dependabot ignore this major version or @dependabot ignore this minor version. You can also ignore all major, minor, or patch releases for a dependency by adding an ignore condition with the desired update_types to your config file.

If you change your mind, just re-open this PR and I'll resolve any conflicts on it.

@decyjphr decyjphr reopened this Mar 30, 2026
@decyjphr
decyjphr merged commit 620a1ee into main-enterprise Mar 30, 2026
8 checks passed
@decyjphr
decyjphr deleted the dependabot/npm_and_yarn/proxy-from-env-2.0.0 branch March 30, 2026 23:04
decyjphr added a commit that referenced this pull request Aug 11, 2026
@decyjphr
@dependabot @tylerohlsen @John15321 @lindluni @madkoo @klutchell @claude
Upgrade to probot 14.3.2 and migrate octokit calls to .rest.* (#1049)
fbd7862 
* Handle multiple config changes in a PR or Push event and process them as a batch (#888)

* handle multiple changes as a batch

* Update index.js

Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>

* Update index.js

Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>

* depup files in a push

* Update index.js

Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>

* moved the dedup logic

* Update index.js

Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>

---------

Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>

* build(deps): bump undici from 7.7.0 to 7.16.0 (#881)

Bumps [undici](https://github.com/nodejs/undici) from 7.7.0 to 7.16.0.
- [Release notes](https://github.com/nodejs/undici/releases)
- [Commits](nodejs/undici@v7.7.0...v7.16.0)

---
updated-dependencies:
- dependency-name: undici
  dependency-version: 7.16.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>

* build(deps): bump node-cron from 3.0.3 to 4.2.1 (#865)

Bumps [node-cron](https://github.com/merencia/node-cron) from 3.0.3 to 4.2.1.
- [Release notes](https://github.com/merencia/node-cron/releases)
- [Commits](node-cron/node-cron@v3.0.3...v4.2.1)

---
updated-dependencies:
- dependency-name: node-cron
  dependency-version: 4.2.1
  dependency-type: direct:production
  update-type: version-update:semver-major
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: Yadhav Jayaraman <57544838+decyjphr@users.noreply.github.com>

* build(deps): bump @apidevtools/json-schema-ref-parser (#882)

Bumps [@apidevtools/json-schema-ref-parser](https://github.com/APIDevTools/json-schema-ref-parser) from 12.0.2 to 14.2.1.
- [Release notes](https://github.com/APIDevTools/json-schema-ref-parser/releases)
- [Commits](APIDevTools/json-schema-ref-parser@v12.0.2...v14.2.1)

---
updated-dependencies:
- dependency-name: "@apidevtools/json-schema-ref-parser"
  dependency-version: 14.2.1
  dependency-type: direct:production
  update-type: version-update:semver-major
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: Yadhav Jayaraman <57544838+decyjphr@users.noreply.github.com>

* build(deps): bump minimatch from 10.0.1 to 10.0.3 (#883)

Bumps [minimatch](https://github.com/isaacs/minimatch) from 10.0.1 to 10.0.3.
- [Changelog](https://github.com/isaacs/minimatch/blob/main/changelog.md)
- [Commits](isaacs/minimatch@v10.0.1...v10.0.3)

---
updated-dependencies:
- dependency-name: minimatch
  dependency-version: 10.0.3
  dependency-type: direct:production
  update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: Yadhav Jayaraman <57544838+decyjphr@users.noreply.github.com>

* build(deps-dev): bump eslint-plugin-import from 2.31.0 to 2.32.0 (#884)

Bumps [eslint-plugin-import](https://github.com/import-js/eslint-plugin-import) from 2.31.0 to 2.32.0.
- [Release notes](https://github.com/import-js/eslint-plugin-import/releases)
- [Changelog](https://github.com/import-js/eslint-plugin-import/blob/main/CHANGELOG.md)
- [Commits](import-js/eslint-plugin-import@v2.31.0...v2.32.0)

---
updated-dependencies:
- dependency-name: eslint-plugin-import
  dependency-version: 2.32.0
  dependency-type: direct:development
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: Yadhav Jayaraman <57544838+decyjphr@users.noreply.github.com>

* ci(deps): bump docker/login-action from 3.5.0 to 3.6.0 (#885)

Bumps [docker/login-action](https://github.com/docker/login-action) from 3.5.0 to 3.6.0.
- [Release notes](https://github.com/docker/login-action/releases)
- [Commits](docker/login-action@184bdaa...5e57cd1)

---
updated-dependencies:
- dependency-name: docker/login-action
  dependency-version: 3.6.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: Yadhav Jayaraman <57544838+decyjphr@users.noreply.github.com>

* ci(deps): bump actions/setup-node from 4 to 6 (#890)

Bumps [actions/setup-node](https://github.com/actions/setup-node) from 4 to 6.
- [Release notes](https://github.com/actions/setup-node/releases)
- [Commits](actions/setup-node@v4...v6)

---
updated-dependencies:
- dependency-name: actions/setup-node
  dependency-version: '6'
  dependency-type: direct:production
  update-type: version-update:semver-major
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: Yadhav Jayaraman <57544838+decyjphr@users.noreply.github.com>

* build(deps): bump js-yaml in the npm_and_yarn group across 1 directory (#894)

Bumps the npm_and_yarn group with 1 update in the / directory: [js-yaml](https://github.com/nodeca/js-yaml).


Updates `js-yaml` from 4.1.0 to 4.1.1
- [Changelog](https://github.com/nodeca/js-yaml/blob/master/CHANGELOG.md)
- [Commits](nodeca/js-yaml@4.1.0...4.1.1)

---
updated-dependencies:
- dependency-name: js-yaml
  dependency-version: 4.1.1
  dependency-type: direct:production
  dependency-group: npm_and_yarn
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: Yadhav Jayaraman <57544838+decyjphr@users.noreply.github.com>

* ci(deps): bump docker/metadata-action from 5.8.0 to 5.10.0 (#897)

Bumps [docker/metadata-action](https://github.com/docker/metadata-action) from 5.8.0 to 5.10.0.
- [Release notes](https://github.com/docker/metadata-action/releases)
- [Commits](docker/metadata-action@c1e5197...c299e40)

---
updated-dependencies:
- dependency-name: docker/metadata-action
  dependency-version: 5.10.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: Yadhav Jayaraman <57544838+decyjphr@users.noreply.github.com>

* ci(deps): bump actions/checkout from 4 to 6 (#898)

Bumps [actions/checkout](https://github.com/actions/checkout) from 4 to 6.
- [Release notes](https://github.com/actions/checkout/releases)
- [Changelog](https://github.com/actions/checkout/blob/main/CHANGELOG.md)
- [Commits](actions/checkout@v4...v6)

---
updated-dependencies:
- dependency-name: actions/checkout
  dependency-version: '6'
  dependency-type: direct:production
  update-type: version-update:semver-major
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>

* ci(deps): bump docker/setup-qemu-action from 3.6.0 to 3.7.0 (#899)

Bumps [docker/setup-qemu-action](https://github.com/docker/setup-qemu-action) from 3.6.0 to 3.7.0.
- [Release notes](https://github.com/docker/setup-qemu-action/releases)
- [Commits](docker/setup-qemu-action@2910929...c7c5346)

---
updated-dependencies:
- dependency-name: docker/setup-qemu-action
  dependency-version: 3.7.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: Yadhav Jayaraman <57544838+decyjphr@users.noreply.github.com>

* build(deps): bump the npm_and_yarn group across 1 directory with 2 updates (#904)

Bumps the npm_and_yarn group with 2 updates in the / directory: [jws](https://github.com/brianloveswords/node-jws) and [validator](https://github.com/validatorjs/validator.js).


Updates `jws` from 3.2.2 to 3.2.3
- [Release notes](https://github.com/brianloveswords/node-jws/releases)
- [Changelog](https://github.com/auth0/node-jws/blob/master/CHANGELOG.md)
- [Commits](auth0/node-jws@v3.2.2...v3.2.3)

Updates `validator` from 13.11.0 to 13.15.26
- [Release notes](https://github.com/validatorjs/validator.js/releases)
- [Changelog](https://github.com/validatorjs/validator.js/blob/master/CHANGELOG.md)
- [Commits](validatorjs/validator.js@13.11.0...13.15.26)

---
updated-dependencies:
- dependency-name: jws
  dependency-version: 3.2.3
  dependency-type: indirect
  dependency-group: npm_and_yarn
- dependency-name: validator
  dependency-version: 13.15.26
  dependency-type: indirect
  dependency-group: npm_and_yarn
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>

* build(deps): bump qs in the npm_and_yarn group across 1 directory (#912)

Bumps the npm_and_yarn group with 1 update in the / directory: [qs](https://github.com/ljharb/qs).


Updates `qs` from 6.13.0 to 6.14.1
- [Changelog](https://github.com/ljharb/qs/blob/main/CHANGELOG.md)
- [Commits](ljharb/qs@v6.13.0...v6.14.1)

---
updated-dependencies:
- dependency-name: qs
  dependency-version: 6.14.1
  dependency-type: indirect
  dependency-group: npm_and_yarn
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>

* build(deps): bump qs in the npm_and_yarn group across 1 directory (#913)

Bumps the npm_and_yarn group with 1 update in the / directory: [qs](https://github.com/ljharb/qs).


Updates `qs` from 6.13.0 to 6.14.1
- [Changelog](https://github.com/ljharb/qs/blob/main/CHANGELOG.md)
- [Commits](ljharb/qs@v6.13.0...v6.14.1)

---
updated-dependencies:
- dependency-name: qs
  dependency-version: 6.14.1
  dependency-type: indirect
  dependency-group: npm_and_yarn
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>

* build(deps): bump octokit from 5.0.3 to 5.0.5 (#905)

Bumps [octokit](https://github.com/octokit/octokit.js) from 5.0.3 to 5.0.5.
- [Release notes](https://github.com/octokit/octokit.js/releases)
- [Commits](octokit/octokit.js@v5.0.3...v5.0.5)

---
updated-dependencies:
- dependency-name: octokit
  dependency-version: 5.0.5
  dependency-type: direct:production
  update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>

* build(deps-dev): bump smee-client from 4.3.1 to 5.0.0 (#906)

Bumps [smee-client](https://github.com/probot/smee-client) from 4.3.1 to 5.0.0.
- [Release notes](https://github.com/probot/smee-client/releases)
- [Commits](probot/smee-client@v4.3.1...v5.0.0)

---
updated-dependencies:
- dependency-name: smee-client
  dependency-version: 5.0.0
  dependency-type: direct:development
  update-type: version-update:semver-major
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: Yadhav Jayaraman <57544838+decyjphr@users.noreply.github.com>

* build(deps-dev): bump @eslint/eslintrc from 3.3.1 to 3.3.3 (#908)

Bumps [@eslint/eslintrc](https://github.com/eslint/eslintrc) from 3.3.1 to 3.3.3.
- [Release notes](https://github.com/eslint/eslintrc/releases)
- [Changelog](https://github.com/eslint/eslintrc/blob/main/CHANGELOG.md)
- [Commits](eslint/eslintrc@v3.3.1...eslintrc-v3.3.3)

---
updated-dependencies:
- dependency-name: "@eslint/eslintrc"
  dependency-version: 3.3.3
  dependency-type: direct:development
  update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: Yadhav Jayaraman <57544838+decyjphr@users.noreply.github.com>

* ci(deps): bump docker/setup-buildx-action from 3.11.1 to 3.12.0 (#909)

Bumps [docker/setup-buildx-action](https://github.com/docker/setup-buildx-action) from 3.11.1 to 3.12.0.
- [Release notes](https://github.com/docker/setup-buildx-action/releases)
- [Commits](docker/setup-buildx-action@e468171...8d2750c)

---
updated-dependencies:
- dependency-name: docker/setup-buildx-action
  dependency-version: 3.12.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: Yadhav Jayaraman <57544838+decyjphr@users.noreply.github.com>

* build(deps): bump undici in the npm_and_yarn group across 1 directory (#921)

Bumps the npm_and_yarn group with 1 update in the / directory: [undici](https://github.com/nodejs/undici).


Updates `undici` from 7.16.0 to 7.18.2
- [Release notes](https://github.com/nodejs/undici/releases)
- [Commits](nodejs/undici@v7.16.0...v7.18.2)

---
updated-dependencies:
- dependency-name: undici
  dependency-version: 7.18.2
  dependency-type: direct:production
  dependency-group: npm_and_yarn
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: Yadhav Jayaraman <57544838+decyjphr@users.noreply.github.com>

* ci(deps): bump docker/login-action from 3.6.0 to 3.7.0 (#924)

Bumps [docker/login-action](https://github.com/docker/login-action) from 3.6.0 to 3.7.0.
- [Release notes](https://github.com/docker/login-action/releases)
- [Commits](docker/login-action@5e57cd1...c94ce9f)

---
updated-dependencies:
- dependency-name: docker/login-action
  dependency-version: 3.7.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: Yadhav Jayaraman <57544838+decyjphr@users.noreply.github.com>

* build(deps): bump the npm_and_yarn group across 1 directory with 2 updates (#927)

Bumps the npm_and_yarn group with 2 updates in the / directory: [lodash](https://github.com/lodash/lodash) and @isaacs/brace-expansion.


Updates `lodash` from 4.17.21 to 4.17.23
- [Release notes](https://github.com/lodash/lodash/releases)
- [Commits](lodash/lodash@4.17.21...4.17.23)

Updates `@isaacs/brace-expansion` from 5.0.0 to 5.0.1

---
updated-dependencies:
- dependency-name: lodash
  dependency-version: 4.17.23
  dependency-type: direct:production
  dependency-group: npm_and_yarn
- dependency-name: "@isaacs/brace-expansion"
  dependency-version: 5.0.1
  dependency-type: indirect
  dependency-group: npm_and_yarn
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>

* [WIP] Upgrade project to support Node.js 22 and 24 (#939)

* Initial plan

* Upgrade Node.js to 22 and 24 (last 2 LTS versions)

Co-authored-by: decyjphr <57544838+decyjphr@users.noreply.github.com>

---------

Co-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com>
Co-authored-by: decyjphr <57544838+decyjphr@users.noreply.github.com>

* Fix Dependabot CI: correct actor check from `dependabot` to `dependabot[bot]` (#940)

* Initial plan

* Initial plan for fixing CI workflow test

Co-authored-by: decyjphr <57544838+decyjphr@users.noreply.github.com>

* Fix Dependabot actor check in node-ci.yml workflow

The `if` condition used `'dependabot'` but Dependabot's actual GitHub
actor username is `'dependabot[bot]'`. This caused the test job to run
for Dependabot PRs when it should be skipped, resulting in npm install
failures due to ESLint 10 peer dependency conflicts.

Co-authored-by: decyjphr <57544838+decyjphr@users.noreply.github.com>

---------

Co-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com>
Co-authored-by: decyjphr <57544838+decyjphr@users.noreply.github.com>

* Refactor advanced CodeQL workflow steps (#941)

* Added support for proxy servers in all execution environments (#917)

* Added support for proxy servers in all execution environments

* Update index.js

Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>

---------

Co-authored-by: Yadhav Jayaraman <57544838+decyjphr@users.noreply.github.com>
Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>

* build(deps): bump probot from 13.4.4 to 14.2.4 (#907)

* build(deps): bump probot from 13.4.4 to 14.2.4

Bumps [probot](https://github.com/probot/probot) from 13.4.4 to 14.2.4.
- [Release notes](https://github.com/probot/probot/releases)
- [Commits](probot/probot@v13.4.4...v14.2.4)

---
updated-dependencies:
- dependency-name: probot
  dependency-version: 14.2.4
  dependency-type: direct:production
  update-type: version-update:semver-major
...

Signed-off-by: dependabot[bot] <support@github.com>

* Fix test suite failures caused by ESM-only `@octokit/core` and `probot` dependencies (#938)

* Initial plan

* Initial plan for fixing failing test suites

Co-authored-by: decyjphr <57544838+decyjphr@users.noreply.github.com>

* Fix failing test suites caused by ESM-only dependencies

Co-authored-by: decyjphr <57544838+decyjphr@users.noreply.github.com>

---------

Co-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com>
Co-authored-by: decyjphr <57544838+decyjphr@users.noreply.github.com>

* Update minimatch dependency version to 10.2.1

* Fix devcontainer configuration and update dependencies (#942)

* fix devcontainer

* Update .devcontainer/Dockerfile

Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>

* Update .devcontainer/Dockerfile

Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>

* Update .devcontainer/devcontainer.json

Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>

---------

Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>

---------

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: Yadhav Jayaraman <57544838+decyjphr@users.noreply.github.com>
Co-authored-by: Copilot <198982749+Copilot@users.noreply.github.com>
Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>

* fix: prevent race conditions by creating new objects for repository configurations (#943)

* fix: prevent race conditions by creating new objects for repository configurations

Signed-off-by: Jan Bronicki <janbronicki@microsoft.com>

* Update lib/plugins/repository.js

Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>

---------

Signed-off-by: Jan Bronicki <janbronicki@microsoft.com>
Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>

* Change helm defaults to be more newcomer friendly (#919)

* Updated container port to match the port exposed by the application inside the container

* Added examples for common environment variables

* Changed validators to be examples in comments to avoid needing to override

* Changed min replica count to 1 for more cost effective defaults

* Updated min replica default in docs

* Updated service port default in docs

* Updated validator defaults in docs

* Updated restricted repos include default in docs

* Update helm/safe-settings/values.yaml

Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>

* Update helm/safe-settings/values.yaml

Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>

* Updated README to match the new default value

Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>

---------

Co-authored-by: Yadhav Jayaraman <57544838+decyjphr@users.noreply.github.com>
Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>

* fix: add HOST=0.0.0.0 env to Dockerfile for probot v14 compatibility (#948)

Agent-Logs-Url: https://github.com/github/safe-settings/sessions/6a4f5799-ea1f-4900-a659-b492dbdf5cfc

Co-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com>
Co-authored-by: decyjphr <57544838+decyjphr@users.noreply.github.com>

* fix: migrate all octokit API calls to .rest namespace for probot v14 compatibility (#949)

* fix: override NODE_ENV=development in functional test and add retry logic

Co-authored-by: decyjphr <57544838+decyjphr@users.noreply.github.com>
Agent-Logs-Url: https://github.com/github/safe-settings/sessions/97b10121-f26e-44c0-86e6-3ede047fe176

* fix: add --fail to curl and || true to docker logs in functional test

Co-authored-by: decyjphr <57544838+decyjphr@users.noreply.github.com>
Agent-Logs-Url: https://github.com/github/safe-settings/sessions/97b10121-f26e-44c0-86e6-3ede047fe176

* fix: migrate all octokit API calls to .rest namespace for probot v14 compatibility and revert Dockerfile ENV HOST

Co-authored-by: decyjphr <57544838+decyjphr@users.noreply.github.com>
Agent-Logs-Url: https://github.com/github/safe-settings/sessions/179c9d77-8ca0-4098-9017-8a255df170f9

* Update lib/plugins/repository.js

Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>

* fix: address review feedback - NopCommand repo arg, milestones mock, teams test error propagation

Co-authored-by: decyjphr <57544838+decyjphr@users.noreply.github.com>
Agent-Logs-Url: https://github.com/github/safe-settings/sessions/d9420b15-2cca-40a3-a30b-869df73487f1

---------

Co-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com>
Co-authored-by: decyjphr <57544838+decyjphr@users.noreply.github.com>
Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>

* Add HOST environment variable to Dockerfile (#950)

* docs: add troubleshooting section for Docker build and runtime issues (#951)

* build(deps): bump undici in the npm_and_yarn group across 1 directory (#947)

Bumps the npm_and_yarn group with 1 update in the / directory: [undici](https://github.com/nodejs/undici).


Updates `undici` from 7.22.0 to 7.24.1
- [Release notes](https://github.com/nodejs/undici/releases)
- [Commits](nodejs/undici@v7.22.0...v7.24.1)

---
updated-dependencies:
- dependency-name: undici
  dependency-version: 7.24.1
  dependency-type: direct:production
  dependency-group: npm_and_yarn
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: Yadhav Jayaraman <57544838+decyjphr@users.noreply.github.com>

* build(deps-dev): bump brace-expansion

Bumps the npm_and_yarn group with 1 update in the / directory: [brace-expansion](https://github.com/juliangruber/brace-expansion).


Updates `brace-expansion` from 1.1.12 to 1.1.13
- [Release notes](https://github.com/juliangruber/brace-expansion/releases)
- [Commits](juliangruber/brace-expansion@v1.1.12...v1.1.13)

---
updated-dependencies:
- dependency-name: brace-expansion
  dependency-version: 1.1.13
  dependency-type: indirect
  dependency-group: npm_and_yarn
...

Signed-off-by: dependabot[bot] <support@github.com>

* build(deps): bump proxy-from-env from 1.1.0 to 2.0.0 (#934)

Bumps [proxy-from-env](https://github.com/Rob--W/proxy-from-env) from 1.1.0 to 2.0.0.
- [Release notes](https://github.com/Rob--W/proxy-from-env/releases)
- [Commits](Rob--W/proxy-from-env@v1.1.0...v2.0.0)

---
updated-dependencies:
- dependency-name: proxy-from-env
  dependency-version: 2.0.0
  dependency-type: direct:production
  update-type: version-update:semver-major
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>

* ci(deps): bump docker/build-push-action from 6.18.0 to 6.19.2 (#935)

Bumps [docker/build-push-action](https://github.com/docker/build-push-action) from 6.18.0 to 6.19.2.
- [Release notes](https://github.com/docker/build-push-action/releases)
- [Commits](docker/build-push-action@2634353...10e90e3)

---
updated-dependencies:
- dependency-name: docker/build-push-action
  dependency-version: 6.19.2
  dependency-type: direct:production
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: Yadhav Jayaraman <57544838+decyjphr@users.noreply.github.com>

* build(deps): bump path-to-regexp (#953)

Bumps the npm_and_yarn group with 1 update in the / directory: [path-to-regexp](https://github.com/pillarjs/path-to-regexp).


Updates `path-to-regexp` from 8.3.0 to 8.4.0
- [Release notes](https://github.com/pillarjs/path-to-regexp/releases)
- [Changelog](https://github.com/pillarjs/path-to-regexp/blob/master/History.md)
- [Commits](pillarjs/path-to-regexp@v8.3.0...v8.4.0)

---
updated-dependencies:
- dependency-name: path-to-regexp
  dependency-version: 8.4.0
  dependency-type: indirect
  dependency-group: npm_and_yarn
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>

* build(deps): bump the npm_and_yarn group across 1 directory with 2 updates (#954)

Bumps the npm_and_yarn group with 2 updates in the / directory: [path-to-regexp](https://github.com/pillarjs/path-to-regexp) and [yaml](https://github.com/eemeli/yaml).


Updates `path-to-regexp` from 8.3.0 to 8.4.0
- [Release notes](https://github.com/pillarjs/path-to-regexp/releases)
- [Changelog](https://github.com/pillarjs/path-to-regexp/blob/master/History.md)
- [Commits](pillarjs/path-to-regexp@v8.3.0...v8.4.0)

Updates `yaml` from 2.8.2 to 2.8.3
- [Release notes](https://github.com/eemeli/yaml/releases)
- [Commits](eemeli/yaml@v2.8.2...v2.8.3)

---
updated-dependencies:
- dependency-name: path-to-regexp
  dependency-version: 8.4.0
  dependency-type: indirect
  dependency-group: npm_and_yarn
- dependency-name: yaml
  dependency-version: 2.8.3
  dependency-type: indirect
  dependency-group: npm_and_yarn
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: Yadhav Jayaraman <57544838+decyjphr@users.noreply.github.com>

* Remove non-deterministic `npm install -g npm` from devcontainer Dockerfile (#956)

* Initial plan

* Fix alert #129: Remove non-deterministic npm install from devcontainer Dockerfile

Agent-Logs-Url: https://github.com/github/safe-settings/sessions/0af97764-5b14-4195-ad8a-6b8adf723453

Co-authored-by: decyjphr <57544838+decyjphr@users.noreply.github.com>

* Fix typo in devcontainer Dockerfile comment (Intall -> Install)

Agent-Logs-Url: https://github.com/github/safe-settings/sessions/0af97764-5b14-4195-ad8a-6b8adf723453

Co-authored-by: decyjphr <57544838+decyjphr@users.noreply.github.com>

---------

Co-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com>
Co-authored-by: decyjphr <57544838+decyjphr@users.noreply.github.com>

* Pin Dockerfile base image to SHA256 digest (#957)

* Initial plan

* Pin Docker base image to SHA256 digest to fix alert #128

Agent-Logs-Url: https://github.com/github/safe-settings/sessions/afcb39cb-64ea-43c7-8b49-200dd166ad5f

Co-authored-by: decyjphr <57544838+decyjphr@users.noreply.github.com>

---------

Co-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com>
Co-authored-by: decyjphr <57544838+decyjphr@users.noreply.github.com>

* Use `npm ci` instead of `npm install` in CI workflow (#958)

* Initial plan

* Replace npm install with npm ci in node-ci.yml workflow

Agent-Logs-Url: https://github.com/github/safe-settings/sessions/4460185b-428a-48f4-a8b9-471226ccbf58

Co-authored-by: decyjphr <57544838+decyjphr@users.noreply.github.com>

---------

Co-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com>
Co-authored-by: decyjphr <57544838+decyjphr@users.noreply.github.com>

* Replace npm install with npm ci in workflow (#960)

* Replace npm install with npm ci in workflow

* Replace npm install with npm ci in workflow

* Bug/issue 465 (#970)

* fix: apply org-level settings before loading repository configurations

* fix: enhance descriptions and add new properties for security features in settings.json

* fix: update description for deprecated squash-merge commit title property in settings.json

* Update api endpoint version

* Add JSON schemas for safe-settings configuration at repo, org, and suborg levels

- Introduced `repos.json` schema for repository-level safe-settings overrides.
- Updated `settings.json` schema to include additional properties for org-level configurations.
- Created `suborgs.json` schema for suborg-level safe-settings configuration.
- Enhanced the build script to dereference all schemas and handle errors during the process.

* chores: fix branches tests

* fix(build-schema): enhance schema dereferencing with GitHub API spec

* Update docs/github-settings/5. branch-protection.md

Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>

* Update index.js

Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>

* fix(schema): simplify description for force_create property

---------

Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>

* Bug/issue 842 (#928)

* fix: apply org-level settings before loading repository configurations

* fix: enhance descriptions and add new properties for security features in settings.json

* fix: update description for deprecated squash-merge commit title property in settings.json

* test: update branch protection tests to handle null restrictions and enforce_admins

* fix: normalize branch protection restrictions and preserve existing settings

* fix: update GitHub API calls to use the correct namespace for branch protection methods

---------

Co-authored-by: Yadhav Jayaraman <57544838+decyjphr@users.noreply.github.com>

* Fix custom_properties diffing when config uses `property_name` (#978)

* Initial plan

* Handle alternate custom property name shapes in normalize

* Add explicit object guard in custom property normalization

* Support property_name in custom_properties config entries

* Polish custom properties test descriptions

---------

Co-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com>

* fix(variables): add noop mode support (#926)

* feat(variables): add noop mode support

- Add noop mode support to Variables plugin add/remove/update methods
- Return NopCommand instead of making API calls when nop=true
- Add comprehensive tests for noop mode behavior

Signed-off-by: Kyle Harding <kyle@balena.io>

* refactor(variables): align with Diffable contract pattern

Refactor Variables plugin to match the single-item Diffable contract
used by labels, milestones, and other plugins. The previous update()
reimplemented sync() logic internally; now each method handles one item
and lets Diffable.sync() orchestrate iteration.

- Simplify update() from 90-line array-diffing to single-item PATCH
- Simplify changed() from JSON.stringify comparison to value check
- Remove getChanged(), lodash dependency, .then(res=>res) no-ops
- Match labels.js nop return pattern: Promise.resolve([NopCommand])
- Fix inconsistent toUpperCase() between add/remove/update
- Let errors propagate to Diffable.sync() instead of swallowing
- Normalize find() to strip API metadata fields (created_at, etc.)

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
Signed-off-by: Kyle Harding <kyle@balena.io>

---------

Signed-off-by: Kyle Harding <kyle@balena.io>
Co-authored-by: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

* fix: update lodash to ^4.18.1 to fix code injection vulnerability (#992)

Resolve Dependabot alert #116 - lodash vulnerable to Code Injection
via `_.template` imports key names. Updated from ^4.17.21 to ^4.18.1.

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

---------

Signed-off-by: dependabot[bot] <support@github.com>
Signed-off-by: Jan Bronicki <janbronicki@microsoft.com>
Signed-off-by: Kyle Harding <kyle@balena.io>
Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: Copilot <198982749+Copilot@users.noreply.github.com>
Co-authored-by: Tyler Ohlsen <tylerohlsen@hotmail.com>
Co-authored-by: Jan Bronicki <janbronicki@microsoft.com>
Co-authored-by: Brett Logan <lindluni@github.com>
Co-authored-by: Madis Kõosaar <madis.koosaar@solidify.dev>
Co-authored-by: Kyle Harding <kyle@balena.io>
Co-authored-by: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Copilot-Session: dfabae4c-7df4-49eb-bffa-82f104ac8316
decyjphr added a commit that referenced this pull request Aug 19, 2026
@decyjphr
@dependabot @tylerohlsen @John15321 @lindluni @madkoo @klutchell @claude @neatcoder
Resolve PR #990 merge conflicts and fix js-yaml empty-document regres…
dc1a2c9 
…sion (#1066)

* Handle multiple config changes in a PR or Push event and process them as a batch (#888)

* handle multiple changes as a batch

* Update index.js

Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>

* Update index.js

Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>

* depup files in a push

* Update index.js

Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>

* moved the dedup logic

* Update index.js

Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>

---------

Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>

* build(deps): bump undici from 7.7.0 to 7.16.0 (#881)

Bumps [undici](https://github.com/nodejs/undici) from 7.7.0 to 7.16.0.
- [Release notes](https://github.com/nodejs/undici/releases)
- [Commits](nodejs/undici@v7.7.0...v7.16.0)

---
updated-dependencies:
- dependency-name: undici
  dependency-version: 7.16.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>

* build(deps): bump node-cron from 3.0.3 to 4.2.1 (#865)

Bumps [node-cron](https://github.com/merencia/node-cron) from 3.0.3 to 4.2.1.
- [Release notes](https://github.com/merencia/node-cron/releases)
- [Commits](node-cron/node-cron@v3.0.3...v4.2.1)

---
updated-dependencies:
- dependency-name: node-cron
  dependency-version: 4.2.1
  dependency-type: direct:production
  update-type: version-update:semver-major
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: Yadhav Jayaraman <57544838+decyjphr@users.noreply.github.com>

* build(deps): bump @apidevtools/json-schema-ref-parser (#882)

Bumps [@apidevtools/json-schema-ref-parser](https://github.com/APIDevTools/json-schema-ref-parser) from 12.0.2 to 14.2.1.
- [Release notes](https://github.com/APIDevTools/json-schema-ref-parser/releases)
- [Commits](APIDevTools/json-schema-ref-parser@v12.0.2...v14.2.1)

---
updated-dependencies:
- dependency-name: "@apidevtools/json-schema-ref-parser"
  dependency-version: 14.2.1
  dependency-type: direct:production
  update-type: version-update:semver-major
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: Yadhav Jayaraman <57544838+decyjphr@users.noreply.github.com>

* build(deps): bump minimatch from 10.0.1 to 10.0.3 (#883)

Bumps [minimatch](https://github.com/isaacs/minimatch) from 10.0.1 to 10.0.3.
- [Changelog](https://github.com/isaacs/minimatch/blob/main/changelog.md)
- [Commits](isaacs/minimatch@v10.0.1...v10.0.3)

---
updated-dependencies:
- dependency-name: minimatch
  dependency-version: 10.0.3
  dependency-type: direct:production
  update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: Yadhav Jayaraman <57544838+decyjphr@users.noreply.github.com>

* build(deps-dev): bump eslint-plugin-import from 2.31.0 to 2.32.0 (#884)

Bumps [eslint-plugin-import](https://github.com/import-js/eslint-plugin-import) from 2.31.0 to 2.32.0.
- [Release notes](https://github.com/import-js/eslint-plugin-import/releases)
- [Changelog](https://github.com/import-js/eslint-plugin-import/blob/main/CHANGELOG.md)
- [Commits](import-js/eslint-plugin-import@v2.31.0...v2.32.0)

---
updated-dependencies:
- dependency-name: eslint-plugin-import
  dependency-version: 2.32.0
  dependency-type: direct:development
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: Yadhav Jayaraman <57544838+decyjphr@users.noreply.github.com>

* ci(deps): bump docker/login-action from 3.5.0 to 3.6.0 (#885)

Bumps [docker/login-action](https://github.com/docker/login-action) from 3.5.0 to 3.6.0.
- [Release notes](https://github.com/docker/login-action/releases)
- [Commits](docker/login-action@184bdaa...5e57cd1)

---
updated-dependencies:
- dependency-name: docker/login-action
  dependency-version: 3.6.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: Yadhav Jayaraman <57544838+decyjphr@users.noreply.github.com>

* ci(deps): bump actions/setup-node from 4 to 6 (#890)

Bumps [actions/setup-node](https://github.com/actions/setup-node) from 4 to 6.
- [Release notes](https://github.com/actions/setup-node/releases)
- [Commits](actions/setup-node@v4...v6)

---
updated-dependencies:
- dependency-name: actions/setup-node
  dependency-version: '6'
  dependency-type: direct:production
  update-type: version-update:semver-major
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: Yadhav Jayaraman <57544838+decyjphr@users.noreply.github.com>

* build(deps): bump js-yaml in the npm_and_yarn group across 1 directory (#894)

Bumps the npm_and_yarn group with 1 update in the / directory: [js-yaml](https://github.com/nodeca/js-yaml).


Updates `js-yaml` from 4.1.0 to 4.1.1
- [Changelog](https://github.com/nodeca/js-yaml/blob/master/CHANGELOG.md)
- [Commits](nodeca/js-yaml@4.1.0...4.1.1)

---
updated-dependencies:
- dependency-name: js-yaml
  dependency-version: 4.1.1
  dependency-type: direct:production
  dependency-group: npm_and_yarn
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: Yadhav Jayaraman <57544838+decyjphr@users.noreply.github.com>

* ci(deps): bump docker/metadata-action from 5.8.0 to 5.10.0 (#897)

Bumps [docker/metadata-action](https://github.com/docker/metadata-action) from 5.8.0 to 5.10.0.
- [Release notes](https://github.com/docker/metadata-action/releases)
- [Commits](docker/metadata-action@c1e5197...c299e40)

---
updated-dependencies:
- dependency-name: docker/metadata-action
  dependency-version: 5.10.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: Yadhav Jayaraman <57544838+decyjphr@users.noreply.github.com>

* ci(deps): bump actions/checkout from 4 to 6 (#898)

Bumps [actions/checkout](https://github.com/actions/checkout) from 4 to 6.
- [Release notes](https://github.com/actions/checkout/releases)
- [Changelog](https://github.com/actions/checkout/blob/main/CHANGELOG.md)
- [Commits](actions/checkout@v4...v6)

---
updated-dependencies:
- dependency-name: actions/checkout
  dependency-version: '6'
  dependency-type: direct:production
  update-type: version-update:semver-major
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>

* ci(deps): bump docker/setup-qemu-action from 3.6.0 to 3.7.0 (#899)

Bumps [docker/setup-qemu-action](https://github.com/docker/setup-qemu-action) from 3.6.0 to 3.7.0.
- [Release notes](https://github.com/docker/setup-qemu-action/releases)
- [Commits](docker/setup-qemu-action@2910929...c7c5346)

---
updated-dependencies:
- dependency-name: docker/setup-qemu-action
  dependency-version: 3.7.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: Yadhav Jayaraman <57544838+decyjphr@users.noreply.github.com>

* build(deps): bump the npm_and_yarn group across 1 directory with 2 updates (#904)

Bumps the npm_and_yarn group with 2 updates in the / directory: [jws](https://github.com/brianloveswords/node-jws) and [validator](https://github.com/validatorjs/validator.js).


Updates `jws` from 3.2.2 to 3.2.3
- [Release notes](https://github.com/brianloveswords/node-jws/releases)
- [Changelog](https://github.com/auth0/node-jws/blob/master/CHANGELOG.md)
- [Commits](auth0/node-jws@v3.2.2...v3.2.3)

Updates `validator` from 13.11.0 to 13.15.26
- [Release notes](https://github.com/validatorjs/validator.js/releases)
- [Changelog](https://github.com/validatorjs/validator.js/blob/master/CHANGELOG.md)
- [Commits](validatorjs/validator.js@13.11.0...13.15.26)

---
updated-dependencies:
- dependency-name: jws
  dependency-version: 3.2.3
  dependency-type: indirect
  dependency-group: npm_and_yarn
- dependency-name: validator
  dependency-version: 13.15.26
  dependency-type: indirect
  dependency-group: npm_and_yarn
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>

* build(deps): bump qs in the npm_and_yarn group across 1 directory (#912)

Bumps the npm_and_yarn group with 1 update in the / directory: [qs](https://github.com/ljharb/qs).


Updates `qs` from 6.13.0 to 6.14.1
- [Changelog](https://github.com/ljharb/qs/blob/main/CHANGELOG.md)
- [Commits](ljharb/qs@v6.13.0...v6.14.1)

---
updated-dependencies:
- dependency-name: qs
  dependency-version: 6.14.1
  dependency-type: indirect
  dependency-group: npm_and_yarn
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>

* build(deps): bump qs in the npm_and_yarn group across 1 directory (#913)

Bumps the npm_and_yarn group with 1 update in the / directory: [qs](https://github.com/ljharb/qs).


Updates `qs` from 6.13.0 to 6.14.1
- [Changelog](https://github.com/ljharb/qs/blob/main/CHANGELOG.md)
- [Commits](ljharb/qs@v6.13.0...v6.14.1)

---
updated-dependencies:
- dependency-name: qs
  dependency-version: 6.14.1
  dependency-type: indirect
  dependency-group: npm_and_yarn
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>

* build(deps): bump octokit from 5.0.3 to 5.0.5 (#905)

Bumps [octokit](https://github.com/octokit/octokit.js) from 5.0.3 to 5.0.5.
- [Release notes](https://github.com/octokit/octokit.js/releases)
- [Commits](octokit/octokit.js@v5.0.3...v5.0.5)

---
updated-dependencies:
- dependency-name: octokit
  dependency-version: 5.0.5
  dependency-type: direct:production
  update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>

* build(deps-dev): bump smee-client from 4.3.1 to 5.0.0 (#906)

Bumps [smee-client](https://github.com/probot/smee-client) from 4.3.1 to 5.0.0.
- [Release notes](https://github.com/probot/smee-client/releases)
- [Commits](probot/smee-client@v4.3.1...v5.0.0)

---
updated-dependencies:
- dependency-name: smee-client
  dependency-version: 5.0.0
  dependency-type: direct:development
  update-type: version-update:semver-major
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: Yadhav Jayaraman <57544838+decyjphr@users.noreply.github.com>

* build(deps-dev): bump @eslint/eslintrc from 3.3.1 to 3.3.3 (#908)

Bumps [@eslint/eslintrc](https://github.com/eslint/eslintrc) from 3.3.1 to 3.3.3.
- [Release notes](https://github.com/eslint/eslintrc/releases)
- [Changelog](https://github.com/eslint/eslintrc/blob/main/CHANGELOG.md)
- [Commits](eslint/eslintrc@v3.3.1...eslintrc-v3.3.3)

---
updated-dependencies:
- dependency-name: "@eslint/eslintrc"
  dependency-version: 3.3.3
  dependency-type: direct:development
  update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: Yadhav Jayaraman <57544838+decyjphr@users.noreply.github.com>

* ci(deps): bump docker/setup-buildx-action from 3.11.1 to 3.12.0 (#909)

Bumps [docker/setup-buildx-action](https://github.com/docker/setup-buildx-action) from 3.11.1 to 3.12.0.
- [Release notes](https://github.com/docker/setup-buildx-action/releases)
- [Commits](docker/setup-buildx-action@e468171...8d2750c)

---
updated-dependencies:
- dependency-name: docker/setup-buildx-action
  dependency-version: 3.12.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: Yadhav Jayaraman <57544838+decyjphr@users.noreply.github.com>

* build(deps): bump undici in the npm_and_yarn group across 1 directory (#921)

Bumps the npm_and_yarn group with 1 update in the / directory: [undici](https://github.com/nodejs/undici).


Updates `undici` from 7.16.0 to 7.18.2
- [Release notes](https://github.com/nodejs/undici/releases)
- [Commits](nodejs/undici@v7.16.0...v7.18.2)

---
updated-dependencies:
- dependency-name: undici
  dependency-version: 7.18.2
  dependency-type: direct:production
  dependency-group: npm_and_yarn
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: Yadhav Jayaraman <57544838+decyjphr@users.noreply.github.com>

* ci(deps): bump docker/login-action from 3.6.0 to 3.7.0 (#924)

Bumps [docker/login-action](https://github.com/docker/login-action) from 3.6.0 to 3.7.0.
- [Release notes](https://github.com/docker/login-action/releases)
- [Commits](docker/login-action@5e57cd1...c94ce9f)

---
updated-dependencies:
- dependency-name: docker/login-action
  dependency-version: 3.7.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: Yadhav Jayaraman <57544838+decyjphr@users.noreply.github.com>

* build(deps): bump the npm_and_yarn group across 1 directory with 2 updates (#927)

Bumps the npm_and_yarn group with 2 updates in the / directory: [lodash](https://github.com/lodash/lodash) and @isaacs/brace-expansion.


Updates `lodash` from 4.17.21 to 4.17.23
- [Release notes](https://github.com/lodash/lodash/releases)
- [Commits](lodash/lodash@4.17.21...4.17.23)

Updates `@isaacs/brace-expansion` from 5.0.0 to 5.0.1

---
updated-dependencies:
- dependency-name: lodash
  dependency-version: 4.17.23
  dependency-type: direct:production
  dependency-group: npm_and_yarn
- dependency-name: "@isaacs/brace-expansion"
  dependency-version: 5.0.1
  dependency-type: indirect
  dependency-group: npm_and_yarn
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>

* [WIP] Upgrade project to support Node.js 22 and 24 (#939)

* Initial plan

* Upgrade Node.js to 22 and 24 (last 2 LTS versions)

Co-authored-by: decyjphr <57544838+decyjphr@users.noreply.github.com>

---------

Co-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com>
Co-authored-by: decyjphr <57544838+decyjphr@users.noreply.github.com>

* Fix Dependabot CI: correct actor check from `dependabot` to `dependabot[bot]` (#940)

* Initial plan

* Initial plan for fixing CI workflow test

Co-authored-by: decyjphr <57544838+decyjphr@users.noreply.github.com>

* Fix Dependabot actor check in node-ci.yml workflow

The `if` condition used `'dependabot'` but Dependabot's actual GitHub
actor username is `'dependabot[bot]'`. This caused the test job to run
for Dependabot PRs when it should be skipped, resulting in npm install
failures due to ESLint 10 peer dependency conflicts.

Co-authored-by: decyjphr <57544838+decyjphr@users.noreply.github.com>

---------

Co-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com>
Co-authored-by: decyjphr <57544838+decyjphr@users.noreply.github.com>

* Refactor advanced CodeQL workflow steps (#941)

* Added support for proxy servers in all execution environments (#917)

* Added support for proxy servers in all execution environments

* Update index.js

Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>

---------

Co-authored-by: Yadhav Jayaraman <57544838+decyjphr@users.noreply.github.com>
Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>

* build(deps): bump probot from 13.4.4 to 14.2.4 (#907)

* build(deps): bump probot from 13.4.4 to 14.2.4

Bumps [probot](https://github.com/probot/probot) from 13.4.4 to 14.2.4.
- [Release notes](https://github.com/probot/probot/releases)
- [Commits](probot/probot@v13.4.4...v14.2.4)

---
updated-dependencies:
- dependency-name: probot
  dependency-version: 14.2.4
  dependency-type: direct:production
  update-type: version-update:semver-major
...

Signed-off-by: dependabot[bot] <support@github.com>

* Fix test suite failures caused by ESM-only `@octokit/core` and `probot` dependencies (#938)

* Initial plan

* Initial plan for fixing failing test suites

Co-authored-by: decyjphr <57544838+decyjphr@users.noreply.github.com>

* Fix failing test suites caused by ESM-only dependencies

Co-authored-by: decyjphr <57544838+decyjphr@users.noreply.github.com>

---------

Co-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com>
Co-authored-by: decyjphr <57544838+decyjphr@users.noreply.github.com>

* Update minimatch dependency version to 10.2.1

* Fix devcontainer configuration and update dependencies (#942)

* fix devcontainer

* Update .devcontainer/Dockerfile

Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>

* Update .devcontainer/Dockerfile

Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>

* Update .devcontainer/devcontainer.json

Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>

---------

Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>

---------

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: Yadhav Jayaraman <57544838+decyjphr@users.noreply.github.com>
Co-authored-by: Copilot <198982749+Copilot@users.noreply.github.com>
Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>

* fix: prevent race conditions by creating new objects for repository configurations (#943)

* fix: prevent race conditions by creating new objects for repository configurations

Signed-off-by: Jan Bronicki <janbronicki@microsoft.com>

* Update lib/plugins/repository.js

Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>

---------

Signed-off-by: Jan Bronicki <janbronicki@microsoft.com>
Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>

* Change helm defaults to be more newcomer friendly (#919)

* Updated container port to match the port exposed by the application inside the container

* Added examples for common environment variables

* Changed validators to be examples in comments to avoid needing to override

* Changed min replica count to 1 for more cost effective defaults

* Updated min replica default in docs

* Updated service port default in docs

* Updated validator defaults in docs

* Updated restricted repos include default in docs

* Update helm/safe-settings/values.yaml

Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>

* Update helm/safe-settings/values.yaml

Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>

* Updated README to match the new default value

Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>

---------

Co-authored-by: Yadhav Jayaraman <57544838+decyjphr@users.noreply.github.com>
Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>

* fix: add HOST=0.0.0.0 env to Dockerfile for probot v14 compatibility (#948)

Agent-Logs-Url: https://github.com/github/safe-settings/sessions/6a4f5799-ea1f-4900-a659-b492dbdf5cfc

Co-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com>
Co-authored-by: decyjphr <57544838+decyjphr@users.noreply.github.com>

* fix: migrate all octokit API calls to .rest namespace for probot v14 compatibility (#949)

* fix: override NODE_ENV=development in functional test and add retry logic

Co-authored-by: decyjphr <57544838+decyjphr@users.noreply.github.com>
Agent-Logs-Url: https://github.com/github/safe-settings/sessions/97b10121-f26e-44c0-86e6-3ede047fe176

* fix: add --fail to curl and || true to docker logs in functional test

Co-authored-by: decyjphr <57544838+decyjphr@users.noreply.github.com>
Agent-Logs-Url: https://github.com/github/safe-settings/sessions/97b10121-f26e-44c0-86e6-3ede047fe176

* fix: migrate all octokit API calls to .rest namespace for probot v14 compatibility and revert Dockerfile ENV HOST

Co-authored-by: decyjphr <57544838+decyjphr@users.noreply.github.com>
Agent-Logs-Url: https://github.com/github/safe-settings/sessions/179c9d77-8ca0-4098-9017-8a255df170f9

* Update lib/plugins/repository.js

Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>

* fix: address review feedback - NopCommand repo arg, milestones mock, teams test error propagation

Co-authored-by: decyjphr <57544838+decyjphr@users.noreply.github.com>
Agent-Logs-Url: https://github.com/github/safe-settings/sessions/d9420b15-2cca-40a3-a30b-869df73487f1

---------

Co-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com>
Co-authored-by: decyjphr <57544838+decyjphr@users.noreply.github.com>
Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>

* Add HOST environment variable to Dockerfile (#950)

* docs: add troubleshooting section for Docker build and runtime issues (#951)

* build(deps): bump undici in the npm_and_yarn group across 1 directory (#947)

Bumps the npm_and_yarn group with 1 update in the / directory: [undici](https://github.com/nodejs/undici).


Updates `undici` from 7.22.0 to 7.24.1
- [Release notes](https://github.com/nodejs/undici/releases)
- [Commits](nodejs/undici@v7.22.0...v7.24.1)

---
updated-dependencies:
- dependency-name: undici
  dependency-version: 7.24.1
  dependency-type: direct:production
  dependency-group: npm_and_yarn
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: Yadhav Jayaraman <57544838+decyjphr@users.noreply.github.com>

* build(deps-dev): bump brace-expansion

Bumps the npm_and_yarn group with 1 update in the / directory: [brace-expansion](https://github.com/juliangruber/brace-expansion).


Updates `brace-expansion` from 1.1.12 to 1.1.13
- [Release notes](https://github.com/juliangruber/brace-expansion/releases)
- [Commits](juliangruber/brace-expansion@v1.1.12...v1.1.13)

---
updated-dependencies:
- dependency-name: brace-expansion
  dependency-version: 1.1.13
  dependency-type: indirect
  dependency-group: npm_and_yarn
...

Signed-off-by: dependabot[bot] <support@github.com>

* build(deps): bump proxy-from-env from 1.1.0 to 2.0.0 (#934)

Bumps [proxy-from-env](https://github.com/Rob--W/proxy-from-env) from 1.1.0 to 2.0.0.
- [Release notes](https://github.com/Rob--W/proxy-from-env/releases)
- [Commits](Rob--W/proxy-from-env@v1.1.0...v2.0.0)

---
updated-dependencies:
- dependency-name: proxy-from-env
  dependency-version: 2.0.0
  dependency-type: direct:production
  update-type: version-update:semver-major
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>

* ci(deps): bump docker/build-push-action from 6.18.0 to 6.19.2 (#935)

Bumps [docker/build-push-action](https://github.com/docker/build-push-action) from 6.18.0 to 6.19.2.
- [Release notes](https://github.com/docker/build-push-action/releases)
- [Commits](docker/build-push-action@2634353...10e90e3)

---
updated-dependencies:
- dependency-name: docker/build-push-action
  dependency-version: 6.19.2
  dependency-type: direct:production
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: Yadhav Jayaraman <57544838+decyjphr@users.noreply.github.com>

* build(deps): bump path-to-regexp (#953)

Bumps the npm_and_yarn group with 1 update in the / directory: [path-to-regexp](https://github.com/pillarjs/path-to-regexp).


Updates `path-to-regexp` from 8.3.0 to 8.4.0
- [Release notes](https://github.com/pillarjs/path-to-regexp/releases)
- [Changelog](https://github.com/pillarjs/path-to-regexp/blob/master/History.md)
- [Commits](pillarjs/path-to-regexp@v8.3.0...v8.4.0)

---
updated-dependencies:
- dependency-name: path-to-regexp
  dependency-version: 8.4.0
  dependency-type: indirect
  dependency-group: npm_and_yarn
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>

* build(deps): bump the npm_and_yarn group across 1 directory with 2 updates (#954)

Bumps the npm_and_yarn group with 2 updates in the / directory: [path-to-regexp](https://github.com/pillarjs/path-to-regexp) and [yaml](https://github.com/eemeli/yaml).


Updates `path-to-regexp` from 8.3.0 to 8.4.0
- [Release notes](https://github.com/pillarjs/path-to-regexp/releases)
- [Changelog](https://github.com/pillarjs/path-to-regexp/blob/master/History.md)
- [Commits](pillarjs/path-to-regexp@v8.3.0...v8.4.0)

Updates `yaml` from 2.8.2 to 2.8.3
- [Release notes](https://github.com/eemeli/yaml/releases)
- [Commits](eemeli/yaml@v2.8.2...v2.8.3)

---
updated-dependencies:
- dependency-name: path-to-regexp
  dependency-version: 8.4.0
  dependency-type: indirect
  dependency-group: npm_and_yarn
- dependency-name: yaml
  dependency-version: 2.8.3
  dependency-type: indirect
  dependency-group: npm_and_yarn
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: Yadhav Jayaraman <57544838+decyjphr@users.noreply.github.com>

* Remove non-deterministic `npm install -g npm` from devcontainer Dockerfile (#956)

* Initial plan

* Fix alert #129: Remove non-deterministic npm install from devcontainer Dockerfile

Agent-Logs-Url: https://github.com/github/safe-settings/sessions/0af97764-5b14-4195-ad8a-6b8adf723453

Co-authored-by: decyjphr <57544838+decyjphr@users.noreply.github.com>

* Fix typo in devcontainer Dockerfile comment (Intall -> Install)

Agent-Logs-Url: https://github.com/github/safe-settings/sessions/0af97764-5b14-4195-ad8a-6b8adf723453

Co-authored-by: decyjphr <57544838+decyjphr@users.noreply.github.com>

---------

Co-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com>
Co-authored-by: decyjphr <57544838+decyjphr@users.noreply.github.com>

* Pin Dockerfile base image to SHA256 digest (#957)

* Initial plan

* Pin Docker base image to SHA256 digest to fix alert #128

Agent-Logs-Url: https://github.com/github/safe-settings/sessions/afcb39cb-64ea-43c7-8b49-200dd166ad5f

Co-authored-by: decyjphr <57544838+decyjphr@users.noreply.github.com>

---------

Co-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com>
Co-authored-by: decyjphr <57544838+decyjphr@users.noreply.github.com>

* Use `npm ci` instead of `npm install` in CI workflow (#958)

* Initial plan

* Replace npm install with npm ci in node-ci.yml workflow

Agent-Logs-Url: https://github.com/github/safe-settings/sessions/4460185b-428a-48f4-a8b9-471226ccbf58

Co-authored-by: decyjphr <57544838+decyjphr@users.noreply.github.com>

---------

Co-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com>
Co-authored-by: decyjphr <57544838+decyjphr@users.noreply.github.com>

* Replace npm install with npm ci in workflow (#960)

* Replace npm install with npm ci in workflow

* Replace npm install with npm ci in workflow

* Bug/issue 465 (#970)

* fix: apply org-level settings before loading repository configurations

* fix: enhance descriptions and add new properties for security features in settings.json

* fix: update description for deprecated squash-merge commit title property in settings.json

* Update api endpoint version

* Add JSON schemas for safe-settings configuration at repo, org, and suborg levels

- Introduced `repos.json` schema for repository-level safe-settings overrides.
- Updated `settings.json` schema to include additional properties for org-level configurations.
- Created `suborgs.json` schema for suborg-level safe-settings configuration.
- Enhanced the build script to dereference all schemas and handle errors during the process.

* chores: fix branches tests

* fix(build-schema): enhance schema dereferencing with GitHub API spec

* Update docs/github-settings/5. branch-protection.md

Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>

* Update index.js

Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>

* fix(schema): simplify description for force_create property

---------

Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>

* Bug/issue 842 (#928)

* fix: apply org-level settings before loading repository configurations

* fix: enhance descriptions and add new properties for security features in settings.json

* fix: update description for deprecated squash-merge commit title property in settings.json

* test: update branch protection tests to handle null restrictions and enforce_admins

* fix: normalize branch protection restrictions and preserve existing settings

* fix: update GitHub API calls to use the correct namespace for branch protection methods

---------

Co-authored-by: Yadhav Jayaraman <57544838+decyjphr@users.noreply.github.com>

* Fix custom_properties diffing when config uses `property_name` (#978)

* Initial plan

* Handle alternate custom property name shapes in normalize

* Add explicit object guard in custom property normalization

* Support property_name in custom_properties config entries

* Polish custom properties test descriptions

---------

Co-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com>

* fix(variables): add noop mode support (#926)

* feat(variables): add noop mode support

- Add noop mode support to Variables plugin add/remove/update methods
- Return NopCommand instead of making API calls when nop=true
- Add comprehensive tests for noop mode behavior

Signed-off-by: Kyle Harding <kyle@balena.io>

* refactor(variables): align with Diffable contract pattern

Refactor Variables plugin to match the single-item Diffable contract
used by labels, milestones, and other plugins. The previous update()
reimplemented sync() logic internally; now each method handles one item
and lets Diffable.sync() orchestrate iteration.

- Simplify update() from 90-line array-diffing to single-item PATCH
- Simplify changed() from JSON.stringify comparison to value check
- Remove getChanged(), lodash dependency, .then(res=>res) no-ops
- Match labels.js nop return pattern: Promise.resolve([NopCommand])
- Fix inconsistent toUpperCase() between add/remove/update
- Let errors propagate to Diffable.sync() instead of swallowing
- Normalize find() to strip API metadata fields (created_at, etc.)

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
Signed-off-by: Kyle Harding <kyle@balena.io>

---------

Signed-off-by: Kyle Harding <kyle@balena.io>
Co-authored-by: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

* fix: update lodash to ^4.18.1 to fix code injection vulnerability (#992)

Resolve Dependabot alert #116 - lodash vulnerable to Code Injection
via `_.template` imports key names. Updated from ^4.17.21 to ^4.18.1.

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

* build(deps): bump uuid in the npm_and_yarn group across 1 directory

Bumps the npm_and_yarn group with 1 update in the / directory: [uuid](https://github.com/uuidjs/uuid).


Updates `uuid` from 8.3.2 to 14.0.0
- [Release notes](https://github.com/uuidjs/uuid/releases)
- [Changelog](https://github.com/uuidjs/uuid/blob/main/CHANGELOG.md)
- [Commits](uuidjs/uuid@v8.3.2...v14.0.0)

---
updated-dependencies:
- dependency-name: uuid
  dependency-version: 14.0.0
  dependency-type: indirect
...

Signed-off-by: dependabot[bot] <support@github.com>

* Bug/archived repo (#991)

* fix: apply org-level settings before loading repository configurations

* fix: enhance descriptions and add new properties for security features in settings.json

* fix: update description for deprecated squash-merge commit title property in settings.json

* fix issue with archived repos

---------

Co-authored-by: Yadhav Jayaraman <57544838+decyjphr@users.noreply.github.com>

* build(deps): bump the npm_and_yarn group across 1 directory with 3 updates

Bumps the npm_and_yarn group with 3 updates in the / directory: [js-yaml](https://github.com/nodeca/js-yaml), [qs](https://github.com/ljharb/qs) and [shell-quote](https://github.com/ljharb/shell-quote).


Updates `js-yaml` from 4.1.1 to 4.2.0
- [Changelog](https://github.com/nodeca/js-yaml/blob/master/CHANGELOG.md)
- [Commits](https://github.com/nodeca/js-yaml/commits)

Updates `qs` from 6.15.0 to 6.15.2
- [Changelog](https://github.com/ljharb/qs/blob/main/CHANGELOG.md)
- [Commits](ljharb/qs@v6.15.0...v6.15.2)

Updates `shell-quote` from 1.8.3 to 1.8.4
- [Changelog](https://github.com/ljharb/shell-quote/blob/main/CHANGELOG.md)
- [Commits](ljharb/shell-quote@v1.8.3...v1.8.4)

---
updated-dependencies:
- dependency-name: js-yaml
  dependency-version: 4.2.0
  dependency-type: direct:production
  dependency-group: npm_and_yarn
- dependency-name: qs
  dependency-version: 6.15.2
  dependency-type: indirect
  dependency-group: npm_and_yarn
- dependency-name: shell-quote
  dependency-version: 1.8.4
  dependency-type: indirect
  dependency-group: npm_and_yarn
...

Signed-off-by: dependabot[bot] <support@github.com>

* Initial plan

* feat: add priorityClassName support to Helm chart

* Add include/exclude repo filters to team settings

Team entries are filtered by the same Diffable include/exclude logic that
collaborators use, but unlike collaborators those keys were never part of the
TeamSettings schema or documented, so editors and linters can't validate them.

Mirror the CollaboratorSettings allOf pattern to declare include and exclude on
TeamSettings, document both in the teams guide with examples, add a sample, and
cover the filter path with unit tests. No runtime changes.

* build(deps-dev): bump flatted from 3.3.4 to 3.4.4 (#1055)

Bumps [flatted](https://github.com/WebReflection/flatted) from 3.3.4 to 3.4.4.
- [Commits](WebReflection/flatted@v3.3.4...v3.4.4)

---
updated-dependencies:
- dependency-name: flatted
  dependency-version: 3.4.4
  dependency-type: indirect
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>

* build(deps): bump undici in the npm_and_yarn group across 1 directory (#1058)

Bumps the npm_and_yarn group with 1 update in the / directory: [undici](https://github.com/nodejs/undici).


Updates `undici` from 7.24.5 to 7.29.0
- [Release notes](https://github.com/nodejs/undici/releases)
- [Commits](nodejs/undici@v7.24.5...v7.29.0)

---
updated-dependencies:
- dependency-name: undici
  dependency-version: 7.29.0
  dependency-type: direct:production
  dependency-group: npm_and_yarn
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>

* build(deps-dev): bump shell-quote from 1.8.4 to 1.10.0 (#1057)

Bumps [shell-quote](https://github.com/ljharb/shell-quote) from 1.8.4 to 1.10.0.
- [Changelog](https://github.com/ljharb/shell-quote/blob/main/CHANGELOG.md)
- [Commits](ljharb/shell-quote@v1.8.4...v1.10.0)

---
updated-dependencies:
- dependency-name: shell-quote
  dependency-version: 1.10.0
  dependency-type: indirect
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: Yadhav Jayaraman <57544838+decyjphr@users.noreply.github.com>

* build(deps): bump js-yaml in the npm_and_yarn group across 1 directory (#1059)

Bumps the npm_and_yarn group with 1 update in the / directory: [js-yaml](https://github.com/nodeca/js-yaml).


Updates `js-yaml` from 4.2.0 to 4.3.1
- [Changelog](https://github.com/nodeca/js-yaml/blob/4.3.1/CHANGELOG.md)
- [Commits](nodeca/js-yaml@4.2.0...4.3.1)

---
updated-dependencies:
- dependency-name: js-yaml
  dependency-version: 4.3.1
  dependency-type: direct:production
  dependency-group: npm_and_yarn
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: Yadhav Jayaraman <57544838+decyjphr@users.noreply.github.com>

* build(deps-dev): bump brace-expansion (#1060)

Bumps the npm_and_yarn group with 1 update in the / directory: [brace-expansion](https://github.com/juliangruber/brace-expansion).


Updates `brace-expansion` from 1.1.13 to 1.1.18
- [Release notes](https://github.com/juliangruber/brace-expansion/releases)
- [Commits](juliangruber/brace-expansion@v1.1.13...v1.1.18)

---
updated-dependencies:
- dependency-name: brace-expansion
  dependency-version: 1.1.18
  dependency-type: indirect
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: Yadhav Jayaraman <57544838+decyjphr@users.noreply.github.com>

* build(deps): bump body-parser (#1061)

Bumps the npm_and_yarn group with 1 update in the / directory: [body-parser](https://github.com/expressjs/body-parser).


Updates `body-parser` from 2.2.2 to 2.3.0
- [Release notes](https://github.com/expressjs/body-parser/releases)
- [Changelog](https://github.com/expressjs/body-parser/blob/master/HISTORY.md)
- [Commits](expressjs/body-parser@v2.2.2...v2.3.0)

---
updated-dependencies:
- dependency-name: body-parser
  dependency-version: 2.3.0
  dependency-type: indirect
  dependency-group: npm_and_yarn
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>

* Fix GHSA-52cp-r559-cp3m: resolve transitive js-yaml via jest and lockfile-lint upgrades (#1064)

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

---------

Signed-off-by: dependabot[bot] <support@github.com>
Signed-off-by: Jan Bronicki <janbronicki@microsoft.com>
Signed-off-by: Kyle Harding <kyle@balena.io>
Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: Copilot <198982749+Copilot@users.noreply.github.com>
Co-authored-by: Tyler Ohlsen <tylerohlsen@hotmail.com>
Co-authored-by: Jan Bronicki <janbronicki@microsoft.com>
Co-authored-by: Brett Logan <lindluni@github.com>
Co-authored-by: Madis Kõosaar <madis.koosaar@solidify.dev>
Co-authored-by: Kyle Harding <kyle@balena.io>
Co-authored-by: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Co-authored-by: neatcoder <28711376+neatcoder@users.noreply.github.com>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

dependencies Pull requests that update a dependency file javascript Pull requests that update Javascript code

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

1 participant

@decyjphr