From dab4fab577244d8f8f6bc7c0b803e2dcc7310124 Mon Sep 17 00:00:00 2001 From: "renovate[bot]" <29139614+renovate[bot]@users.noreply.github.com> Date: Tue, 27 Oct 2026 04:05:36 +0000 Subject: [PATCH 1/2] Update github-actions --- .github/workflows/ci.yml | 2 +- .github/workflows/hosted-preview.yml | 2 +- .github/workflows/security-audit.yaml | 4 ++-- .github/workflows/workflow-audit.yaml | 2 +- 4 files changed, 5 insertions(+), 5 deletions(-) diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index 0236333d5..8dca870a5 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -402,7 +402,7 @@ jobs: # Windows and macOS runners bill at a multiple of Linux, so the dependency # compile is cached rather than paid on every PR. - name: Rust cache - uses: swatinem/rust-cache@6323deb102c322ba6fcbdcafc7e3dddab59af2b6 # v2.9.2 + uses: swatinem/rust-cache@d1527c8f67ef9af357290475d4af4b0fab8f12e0 # v2.9.3 with: workspaces: standalone/src-tauri diff --git a/.github/workflows/hosted-preview.yml b/.github/workflows/hosted-preview.yml index 0c31777fc..a90dbfc93 100644 --- a/.github/workflows/hosted-preview.yml +++ b/.github/workflows/hosted-preview.yml @@ -140,7 +140,7 @@ jobs: NEON_API_KEY: ${{ secrets.NEON_API_KEY }} - name: Create or reuse PR database branch id: database - uses: neondatabase/create-branch-action@fb620d43d4c565abaf088b848a4e28e5c4ea4d9c # 6.3.1 + uses: neondatabase/create-branch-action@72ed4f69a12b6be9c16aebfad893f6a21e9aba8b # v6.4.0 with: project_id: ${{ vars.NEON_PROJECT_ID }} parent_branch: ${{ vars.NEON_PREVIEW_PARENT_BRANCH }} diff --git a/.github/workflows/security-audit.yaml b/.github/workflows/security-audit.yaml index bb4ea71db..ac6bf43fa 100644 --- a/.github/workflows/security-audit.yaml +++ b/.github/workflows/security-audit.yaml @@ -207,7 +207,7 @@ jobs: - name: Audit against the security specs if: steps.plan.outputs.skip != 'true' - uses: anthropics/claude-code-action@db77d4d3c98f3f6380e7cd45ffba2342a3dbde3c # v1.0.254 + uses: anthropics/claude-code-action@8041f1d17e0e7d2f2cfe35002962e9f26237c0bb # v1.0.263 env: # `claude-code-action` resets `GH_TOKEN` to its own internal # workflow token, so setting `GH_TOKEN` at this scope is @@ -739,7 +739,7 @@ jobs: # The audit job's agent step, less `ci-and-secrets`: the same pinned # action, prompts, tools, and model split. - name: Audit the seeded checkout - uses: anthropics/claude-code-action@db77d4d3c98f3f6380e7cd45ffba2342a3dbde3c # v1.0.254 + uses: anthropics/claude-code-action@8041f1d17e0e7d2f2cfe35002962e9f26237c0bb # v1.0.263 env: BASH_DEFAULT_TIMEOUT_MS: "600000" with: diff --git a/.github/workflows/workflow-audit.yaml b/.github/workflows/workflow-audit.yaml index 0f21aa6e1..30748d381 100644 --- a/.github/workflows/workflow-audit.yaml +++ b/.github/workflows/workflow-audit.yaml @@ -77,7 +77,7 @@ jobs: run: git fetch origin '+refs/heads/*:refs/remotes/origin/*' - name: Install uv - uses: astral-sh/setup-uv@1c37ad07a6a961277cf70c0d37d6f313000f5884 # v10.3.0 + uses: astral-sh/setup-uv@07a047e608db84b3d8c06cd9a7c7dcc9c355c18e # v10.3.2 - name: Audit workflow file changes env: From 0681434e5c383386d754c7ecb4bba1ab5d24e811 Mon Sep 17 00:00:00 2001 From: dormouse-bot <287024035+dormouse-bot@users.noreply.github.com> Date: Tue, 27 Oct 2026 04:08:54 +0000 Subject: [PATCH 2/2] fix: keep neondatabase/create-branch-action at 6.3.1 Its v6.4.0 tag is a stray tag on a commit 12 commits behind 6.3.1, so Renovate's bump was a downgrade (node24 -> node20). Exclude v6.4.0 so Renovate stops proposing it. --- .github/renovate.json | 6 ++++++ .github/workflows/hosted-preview.yml | 2 +- 2 files changed, 7 insertions(+), 1 deletion(-) diff --git a/.github/renovate.json b/.github/renovate.json index 1c628606c..1ce9e1f6a 100644 --- a/.github/renovate.json +++ b/.github/renovate.json @@ -178,6 +178,12 @@ "minimumReleaseAge": null, "schedule": ["at any time"] }, + { + "description": "neondatabase/create-branch-action dropped the `v` prefix at 6.3.1, and its stray `v6.4.0` tag is on a commit 12 commits behind 6.3.1 with no release, so semver ranks a downgrade as the newest version", + "matchManagers": ["github-actions"], + "matchPackageNames": ["neondatabase/create-branch-action"], + "allowedVersions": "!/^v6\\.4\\.0$/" + }, { "description": "canopy pins the pristine @xterm/addon-webgl AND @xterm/xterm to the exact commit the SDF fork's sdf branch is based on (the addon's beta counter is offset from core's; canopy/README.md records the current correspondence). They are the UpstreamVsFork regression baseline and move in lockstep with the hand-cut @diffplug/xterm-addon-webgl-sdf tarball, which Renovate cannot see, so bumping either one is a manual edit made when the fork rebases — never a Renovate bump (see canopy/README.md and docs/specs/webgl-text.md). File-scoped: lib and standalone still track upstream betas via the xterm group above. Must stay last; later rules win", "matchManagers": ["npm"], diff --git a/.github/workflows/hosted-preview.yml b/.github/workflows/hosted-preview.yml index a90dbfc93..0c31777fc 100644 --- a/.github/workflows/hosted-preview.yml +++ b/.github/workflows/hosted-preview.yml @@ -140,7 +140,7 @@ jobs: NEON_API_KEY: ${{ secrets.NEON_API_KEY }} - name: Create or reuse PR database branch id: database - uses: neondatabase/create-branch-action@72ed4f69a12b6be9c16aebfad893f6a21e9aba8b # v6.4.0 + uses: neondatabase/create-branch-action@fb620d43d4c565abaf088b848a4e28e5c4ea4d9c # 6.3.1 with: project_id: ${{ vars.NEON_PROJECT_ID }} parent_branch: ${{ vars.NEON_PREVIEW_PARENT_BRANCH }}