Merge branch 'main' into dx-5487/reusable-dispatch

Author: chainchad

.changeset/nx-security-bump-22-7-9.md

@@ -0,0 +1,5 @@
+---
+"dot-github": patch
+---
+
+Bump nx and @nx/* from 22.5.3 to 22.7.12 for security advisories GHSA-w2vw-w76x-qr89 (OS command injection via git revisions), GHSA-w3vv-58gj-gw77 (daemon/plugin worker socket exposure), GHSA-vp3h-ghgh-jr7g (Zip-Slip in self-hosted remote cache), and GHSA-hrvq-x7jp-36xv (Nx vulnerability in versions <22.7.10). Add overrides for smol-toml, brace-expansion, and axios. Fixes DX-5545, DX-5544, DX-5540, DX-5538, DX-4948, DX-4947

.changeset/security-overrides-wave3.md

@@ -0,0 +1,17 @@
+---
+"dot-github": patch
+---
+
+Bump transitive dependencies via pnpm overrides to remediate Dependabot advisories:
+
+- shell-quote 1.11.0 — GHSA-pqg4-j6r4-53mv, CVE-2026-102422 (quote() command injection)
+- vite 7.3.7 — GHSA-fx2h-pf6j-xcff, GHSA-p9ff-h696-f583, GHSA-v2wj-q39q-566r (server.fs.deny bypasses, dev server WebSocket file read)
+- undici 6.29.0 — GHSA-vxpw-j846-p89q, GHSA-vrm6-8vpv-qv8q, GHSA-v9p9-hfj2-hcw8 (WebSocket DoS)
+- form-data 4.0.6 — GHSA-hmw2-7cc7-3qxx, CVE-2026-12143 (CRLF injection in multipart)
+- @graphql-tools/utils 12.0.1 — GHSA-7mx3-vvmw-hjmv (mergeDeep prototype pollution)
+- @fastify/busboy 3.2.2 — GHSA-x8mw-p69m-v3mx, CVE-2026-19481 (prototype-named multipart header DoS)
+- http-cache-semantics 4.3.0 — GHSA-ch52-4w7c-c8xp, CVE-2026-93748 (cross-user cached response disclosure)
+- source-map-js 1.2.2 — GHSA-68fv-2mgg-jv7q, CVE-2026-93749 (event-loop DoS via section offsets)
+- picomatch 4.0.7 — GHSA-c2c7-rcm5-vvqj (ReDoS via extglob quantifiers)
+
+Fixes DX-5556, DX-4463, DX-4458, DX-3679, DX-3677, DX-4480, DX-3434, DX-3433, DX-5543, DX-5542, DX-5541, DX-5546, DX-3573

actions/ci-grafana-alert-test/dist/index.js

@@ -15,6 +15,7 @@ pre-commit:
       description: "Fix reusable workflows sync"
       glob: "{workflows/*/*,.github/workflows/*}.{yml,yaml}"
       run: pnpm workflows:fix --stage {staged_files}
+      stage_fixed: true
     actionlint:
       description: "Run actionlint"
       glob: "{workflows/*/*,.github/workflows/*}.{yml,yaml}"
@@ -26,5 +27,7 @@ pre-commit:
     build-artifacts:
       description: "Build artifacts for affected projects"
       glob: "*.{js,ts,json}"
+      env:
+        CI: "true"
       run: pnpm build:affected
       stage_fixed: true

apps/go-conditional-tests/dist/index.js

@@ -50,5 +50,6 @@
         "targetName": "lint"
       }
     }
-  ]
+  ],
+  "analytics": true
 }

lefthook.yml

@@ -30,12 +30,12 @@
   "devDependencies": {
     "@changesets/changelog-github": "^0.5.2",
     "@changesets/cli": "^2.31.1",
-    "@nx/devkit": "22.5.3",
-    "@nx/esbuild": "22.5.3",
-    "@nx/eslint": "22.5.3",
-    "@nx/eslint-plugin": "22.5.3",
-    "@nx/js": "22.5.3",
-    "@nx/plugin": "22.5.3",
+    "@nx/devkit": "22.7.12",
+    "@nx/esbuild": "22.7.12",
+    "@nx/eslint": "22.7.12",
+    "@nx/eslint-plugin": "22.7.12",
+    "@nx/js": "22.7.12",
+    "@nx/plugin": "22.7.12",
     "@swc-node/register": "1.11.1",
     "@swc/cli": "0.7.10",
     "@swc/core": "1.15.8",
@@ -48,7 +48,7 @@
     "eslint-config-prettier": "10.1.8",
     "jsdom": "~24.1.3",
     "lefthook": "^1.13.6",
-    "nx": "22.5.3",
+    "nx": "22.7.12",
     "prettier": "^3.9.9",
     "rimraf": "^6.1.3",
     "ts-node": "10.9.2",
@@ -60,7 +60,18 @@
   "repository": "https://github.com/smartcontractkit/.github",
   "pnpm": {
     "overrides": {
-      "form-data": "4.0.4",
+      "axios": "^1.20.0",
+      "brace-expansion": "^5.0.12",
+      "smol-toml": "^1.9.0",
+      "form-data": "4.0.6",
+      "shell-quote": "1.11.0",
+      "vite": "7.3.7",
+      "undici": "6.29.0",
+      "@graphql-tools/utils": "12.0.1",
+      "@fastify/busboy": "3.2.2",
+      "http-cache-semantics": "4.3.0",
+      "source-map-js": "1.2.2",
+      "picomatch@>=4.0.0": "4.0.7",
       "minimatch": "^10.2.4",
       "immutable": "^4.3.8"
     }