build(deps): bump actions/github-script from 7 to 9 - #10
Closed
dependabot[bot] wants to merge 1 commit into
Closed
Conversation
Bumps [actions/github-script](https://github.com/actions/github-script) from 7 to 9. - [Release notes](https://github.com/actions/github-script/releases) - [Commits](actions/github-script@v7...v9) --- updated-dependencies: - dependency-name: actions/github-script dependency-version: '9' dependency-type: direct:production update-type: version-update:semver-major ... Signed-off-by: dependabot[bot] <support@github.com>
dependabot
Bot
added
dependencies
dependabot
Bot
added
dependencies
6 tasks
aesslinger
added a commit
that referenced
this pull request
Aug 13, 2026
* build(deps): bump actions/github-script from 7 to 9 (#10) v8's only change was Node.js 24.x runner support. v9's breaking changes (require('@actions/github') no longer works, getOctokit is now an injected parameter) don't apply here — ci.yml's version-suggestion script only uses the injected github.rest.*/github.graphql client, never require() or a redeclared getOctokit. * build(deps): bump async-trait from 0.1.91 to 0.1.92 (#12) Patch release (resolves a clippy double_must_use lint in generated code); async-trait isn't used directly in this crate's own code, only pulled transitively via deadpool-postgres/tokio-postgres. Cargo.toml's existing "0.1" range already covers this — only Cargo.lock needed updating. Build/test/clippy all pass unchanged. * build(deps): bump base64 from 0.22.1 to 0.23.1 (#11) Major bump, but 0.23's changelog only adds new consts/SIMD-accelerated engines and custom padding support -- Engine::encode/decode with general_purpose::STANDARD (our only usage, in extract.rs/binding.rs/blob.rs for BLOB wire format) is untouched. tokio-postgres's own transitive postgres-protocol dependency stays pinned to 0.22.1 independently -- no shared types cross that boundary, so both coexist without conflict. Verified: 85/85 unit tests pass (including BLOB encode/decode coverage in binding_tests.rs/blob_tests.rs), clippy/fmt clean, and the full live_db.rs suite against a real PostgreSQL instance (7/7). * build(deps): bump infer from 0.16.0 to 0.22.0 (#14) Six minor versions, but our only usage (infer::get(data).map(|k| k.mime_type()) in handlers/blob.rs's encode_blob_full) is infer's core stable API -- the version range only adds new format detectors (DWG, qcow2, par2, improved LZ4/zstd/audio/PDF/mkv detection) and internal cleanup, no signature changes. Verified: 85/85 unit tests pass (including blob_tests.rs's direct coverage of encode_blob_full's mime-sniffing path), clippy/fmt clean. * build(deps): bump rustls-platform-verifier from 0.6.2 to 0.7.0 (#13) Explicitly documented upstream as semver-incompatible only due to the jni 0.21->0.22 bump, which affects Android targets exclusively -- this plugin only ships linux/darwin/windows binaries (release.yml), no Android. Remaining changes are Windows-specific certificate-chain fixes. Our only call site, BuilderVerifierExt::with_platform_verifier() in client.rs, is unchanged. Verified: 85/85 unit tests pass, clippy/fmt clean, compiles without any call-site changes needed. Not verified: a live TLS handshake end-to-end -- the local test Postgres container has ssl=off, and reconfiguring it would disrupt the shared dev environment. The with_platform_verifier() builder call itself is exercised by every build; no behavior change is documented for non-Android platforms. * build(deps): bump tokio-postgres-rustls from 0.13.0 to 0.14.0 (#15) Internal fixes only (correct x509 channel-binding parsing, deferred TLS hostname validation, drops the ring/const-oid deps in favor of sha2). Our only call site, MakeRustlsConnect::new(tls_config) in client.rs, is unchanged. Verified against a disposable, self-signed-cert Postgres container (not the shared dev container) built specifically for this: verify-ca mode connects successfully with a proper SAN cert pinned via ssl_ca, and require mode correctly rejects an untrusted cert -- both behaviors confirmed identical against a from-scratch build of the pre-dependabot baseline commit, ruling out any regression from this bump specifically. Also ran the full live_db.rs suite (7/7) against the primary non-TLS pooled-connection path. 85/85 unit tests, clippy/fmt clean.
Author
|
Looks like actions/github-script is up-to-date now, so this is no longer needed. |
dependabot
Bot
deleted the
dependabot/github_actions/actions/github-script-9
branch
August 13, 2026 13:23
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Bumps actions/github-script from 7 to 9.
Release notes
Sourced from actions/github-script's releases.
... (truncated)
Commits
3a2844bMerge pull request #700 from actions/salmanmkc/expose-getoctokit + prepare re...ca10bbdfix: use@octokit/core/types import for v7 compatibility86e48e2merge: incorporate main branch changesc108472chore: rebuild dist for v9 upgrade and getOctokit factoryafff112Merge pull request #712 from actions/salmanmkc/deployment-false + fix user-ag...ff8117eci: fix user-agent test to handle orchestration ID81c6b78ci: use deployment: false to suppress deployment noise from integration tests3953cafdocs: update README examples from@v8to@v9, add getOctokit docs and v9 brea...c17d55bci: add getOctokit integration test joba047196test: add getOctokit integration tests via callAsyncFunctionDependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting
@dependabot rebase.Dependabot commands and options
You can trigger Dependabot actions by commenting on this PR:
@dependabot rebasewill rebase this PR@dependabot recreatewill recreate this PR, overwriting any edits that have been made to it@dependabot show <dependency name> ignore conditionswill show all of the ignore conditions of the specified dependency@dependabot ignore this major versionwill close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)@dependabot ignore this minor versionwill close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)@dependabot ignore this dependencywill close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)