fix: resolve CI failures for security audit, PR title validation, and dependabot noise#470
Open
fix: resolve CI failures for security audit, PR title validation, and dependabot noise#470
Conversation
… dependabot noise - Update npm overrides: minimatch 10.2.1→10.2.4, add fast-xml-parser 5.3.9 - Add --omit=dev to security:audit (aws-cdk-lib bundles vulnerable minimatch as a bundledDependency that overrides cannot fix; it's a devDep, not shipped) - Add statuses:write permission to pr-title.yml (fixes "Resource not accessible by integration" error on all human PRs) - Group dependabot PRs: @aws-sdk/*, @smithy/*, @aws-cdk/*, github-actions into single PRs; reduce open-pull-requests-limit 20→10
tejaskash
requested a deployment
to
e2e-testing
GitHub Actions
Waiting
Auto-approves and enables auto-merge (squash) for dependabot PRs that are patch or minor version bumps. Major version bumps still require manual review. Note: requires "Allow auto-merge" to be enabled in repo settings.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
minimatch→10.2.4, addfast-xml-parser→5.3.9) and add--omit=devto skip auditingaws-cdk-lib's bundled minimatch (a devDep not shipped to users;aws-cdk-lib@2.240.0— the latest — bundlesminimatch@10.2.2which npm overrides cannot fix since it's a bundledDependency)permissions: statuses: writetopr-title.yml— currently all human PRs fail with "Resource not accessible by integration"@aws-sdk/*,@smithy/*,@aws-cdk/*, and GitHub Actions into single PRs; reduceopen-pull-requests-limitfrom 20 to 10. Currently 13 of 20 open PRs are individual dependabot bumpsChecks fixed
Note on stale dependabot PRs
The 10 existing dependabot PRs with build failures (
npm ci: Missing yaml@2.8.2 from lock file) are stale — dependabot generates lockfiles that are out of sync with npm overrides. After this merges, dependabot will close the individual PRs and open new grouped ones. You may want to bulk-close the stale ones.Test plan
npm run security:auditpasses locally (0 vulnerabilities)npm run typecheckpasses