Skip to content

build(deps): consolidate upgrades and concise documentation - #64

Merged
justinthelaw merged 4 commits into
mainfrom
codex/upgrades-2026-10-12
Oct 12, 2026
Merged

build(deps): consolidate upgrades and concise documentation#64
justinthelaw merged 4 commits into
mainfrom
codex/upgrades-2026-10-12

Conversation

@justinthelaw

@justinthelaw justinthelaw commented Oct 12, 2026 •
edited
Loading

Copy link
Copy Markdown
Owner

Summary

  • Consolidate build(deps): bump actions/setup-node from 7.0.0 to 7.1.0 in the github-actions group #63 with its original Dependabot commit and all four setup-node 7.1.0 pins.
  • Upgrade Prettier 3.9.9 → 3.9.10 and lint Python 3.14 → stable 3.15.
  • Shorten maintained Markdown, preserving public outputs, examples, safety rules and release gates.
  • Keep Node 22 development support and Node 24 action execution. Generated action bundle is unchanged.

Validation

  • npm ci --ignore-scripts && npm test && npm run format:check && npm run check-dist
  • pre-commit run --all-files --hook-stage pre-push
  • Representative runner smoke tests remain accurate
  • README and docs reviewed; no action behavior changes

Local validation: Node 22.23.3 and 24.21.0 each pass 306 tests, with three Windows-native tests skipped locally. Typecheck, formatting, reproducible bundle, relative Markdown links and git diff --check pass. All nine hooks pass in fresh Python 3.15.0 / pre-commit 4.6.2 environments with Go 1.27.2. npm 12.2.0 isolated locked install passes.

The committed runtime dependency graph has zero npm audit advisories. The upstream Markdown hook retains three disclosed advisories: braces (high; no fixed release), smol-toml (moderate; exact parent pin), KaTeX (low; parent range excludes patched major). The optional npm 12.2.0 verifier also retains 12 upstream advisories in five bundled packages; it is not a project dependency. See explicit deferrals below. Pinned third-party Actions also retain verified affected smol-toml, Undici, brace-expansion and fast-xml-parser code. Latest supported action parents are already selected; the action ledger below records precise deferrals. Successful lint is not a security clearance.

No browser UI exists, so browser smoke is inapplicable. Local unit/contract tests use bounded fixtures; actual action execution is exercised by the seven-class hosted-runner PR smoke tests. Current-head verification is complete for 6d89727eb70135cb69a13c02dfffea8c631722c8: all 12 checks pass, including seven platform smoke classes. Test run, lint, CodeQL. Codex review completed with no major issues; both previous threads are resolved. Ready for human review, unmerged. Manual seven-class default-max plus 18-label sweep remains a separate authorized-release gate, not dispatched by this PR.

Source PR map

Source Preserved head Incorporation
#63 (@dependabot) 770388eb39b86ee02104c8549935988ae7aa10b5 Exact ancestor; four setup-node references preserved. Closed by justinthelaw at 2026-10-12 15:46 UTC; source head rechecked unchanged. This is now the sole open PR.

Checklist

  • Scope is focused and reviewable
  • Destructive behavior impact reviewed: no production code changes
  • Platform and architecture applicability reviewed against existing runner contract
  • Group/skip overlap behavior preserved
  • Security impact considered and upstream deferrals disclosed
Complete dependency ledger, evidence and deferrals (2026-10-12)

Dependency review - 2026-10-12

Upgrade setup-node, Prettier, and the lint runtime to stable Python 3.15.
Shorten maintained Markdown while preserving safety contracts and examples.
Release/registry evidence checked 2026-10-12; this review supersedes prior deferrals.

npm ledger

Native npm resolution preserves the complete committed graph; no leaf overrides.

Dependency Before Considered target Final Outcome and evidence
@actions/core 3.0.1 3.0.1 3.0.1 Already current: Latest stable. Registry
@actions/exec 3.0.0 3.0.0 3.0.0 Already current: Latest stable. Registry
@actions/http-client 4.0.1 4.0.1 4.0.1 Already current: Latest stable. Registry
@actions/io 3.0.2 3.0.2 3.0.2 Already current: Latest stable. Registry
@types/node 22.20.5 22.20.5; 24.19.2 / 26.6.5 22.20.5 Already current: Latest Node 22 declarations; newer majors require a separately reviewed development-floor change. Registry
@typescript/typescript-aix-ppc64 7.0.2 7.0.2 7.0.2 Already current: Exact native TypeScript family; optional per platform. Registry
@typescript/typescript-darwin-arm64 7.0.2 7.0.2 7.0.2 Already current: Exact native TypeScript family; optional per platform. Registry
@typescript/typescript-darwin-x64 7.0.2 7.0.2 7.0.2 Already current: Exact native TypeScript family; optional per platform. Registry
@typescript/typescript-freebsd-arm64 7.0.2 7.0.2 7.0.2 Already current: Exact native TypeScript family; optional per platform. Registry
@typescript/typescript-freebsd-x64 7.0.2 7.0.2 7.0.2 Already current: Exact native TypeScript family; optional per platform. Registry
@typescript/typescript-linux-arm 7.0.2 7.0.2 7.0.2 Already current: Exact native TypeScript family; optional per platform. Registry
@typescript/typescript-linux-arm64 7.0.2 7.0.2 7.0.2 Already current: Exact native TypeScript family; optional per platform. Registry
@typescript/typescript-linux-loong64 7.0.2 7.0.2 7.0.2 Already current: Exact native TypeScript family; optional per platform. Registry
@typescript/typescript-linux-mips64el 7.0.2 7.0.2 7.0.2 Already current: Exact native TypeScript family; optional per platform. Registry
@typescript/typescript-linux-ppc64 7.0.2 7.0.2 7.0.2 Already current: Exact native TypeScript family; optional per platform. Registry
@typescript/typescript-linux-riscv64 7.0.2 7.0.2 7.0.2 Already current: Exact native TypeScript family; optional per platform. Registry
@typescript/typescript-linux-s390x 7.0.2 7.0.2 7.0.2 Already current: Exact native TypeScript family; optional per platform. Registry
@typescript/typescript-linux-x64 7.0.2 7.0.2 7.0.2 Already current: Exact native TypeScript family; optional per platform. Registry
@typescript/typescript-netbsd-arm64 7.0.2 7.0.2 7.0.2 Already current: Exact native TypeScript family; optional per platform. Registry
@typescript/typescript-netbsd-x64 7.0.2 7.0.2 7.0.2 Already current: Exact native TypeScript family; optional per platform. Registry
@typescript/typescript-openbsd-arm64 7.0.2 7.0.2 7.0.2 Already current: Exact native TypeScript family; optional per platform. Registry
@typescript/typescript-openbsd-x64 7.0.2 7.0.2 7.0.2 Already current: Exact native TypeScript family; optional per platform. Registry
@typescript/typescript-sunos-x64 7.0.2 7.0.2 7.0.2 Already current: Exact native TypeScript family; optional per platform. Registry
@typescript/typescript-win32-arm64 7.0.2 7.0.2 7.0.2 Already current: Exact native TypeScript family; optional per platform. Registry
@typescript/typescript-win32-x64 7.0.2 7.0.2 7.0.2 Already current: Exact native TypeScript family; optional per platform. Registry
@vercel/ncc 0.45.0 0.45.0 0.45.0 Already current: Latest stable. Registry
prettier 3.9.9 3.9.10 3.9.10 Upgraded: Latest stable. Registry
tunnel 0.0.6 0.0.6 0.0.6 Already current: Latest stable. Registry
typescript 7.0.2 7.0.2 7.0.2 Already current: Latest stable. Registry
undici 6.29.0 8.11.2 6.29.0 Deferred: Latest 6.x allowed by @actions/http-client 4.0.1 (^6.23.0); defer 8.11.2 until parent supports it. Registry
undici-types 6.21.0 8.11.2 6.21.0 Deferred: Node 22 declarations require~6.21.0; defer newer families until development-floor change. Registry

Tool and runtime ledger

Dependency Before Considered target Final Outcome and evidence
actions/setup-node 7.0.0 7.1.0 7.1.0 Upgraded: preserves #63; SHA 949feb2413d6458794dcd2491c4babbbce0c15c1. Release
actions/checkout 7.0.1 7.0.1 7.0.1 Already current. Release
actions/setup-python 7.0.0 7.0.0 7.0.0 Already current. Release
Python lint runtime 3.14 3.15.0 3.15 Upgraded: stable Oct 9; fresh 3.15.0 hook validation below. Release
pre-commit 4.6.2 4.6.2 4.6.2 Already current. PyPI
pre-commit-hooks 6.0.0 6.0.0 6.0.0 Already current. Release
texthooks 0.7.1 0.7.1 0.7.1 Already current; maintained smartquote hook. PyPI
markdownlint-cli2 0.23.3 0.23.3 0.23.3 Already current. Registry
yamllint 1.38.0 1.38.0 1.38.0 Already current. Release
actionlint 1.7.12 1.7.12 1.7.12 Already current. Release
Node development >=22 / 22 selector 22.23.3; 24.21.0 LTS; 26.11.1 Current >=22 / 22 Already current:22.23.3 is latest 22 patch; retain documented supported floor. Releases
Node action runtime node24 24.21.0 LTS; 26.11.1 Current node24 Already current: GitHub supplies embedded patch; no action-metadata patch selector. Node 26 LTS starts Oct 28. Schedule
Go hook compiler system/default 1.27.2 1.27.2 verifier Already current: official stable checksum verified; no project pin. Release
npm unpinned 12.2.0 unpinned; 12.2.0 verifier Deferred mandatory pin: npm 12 requires 22.22.2+/24.15.0+; excludes earlier supported >=22 patches. Isolated install passes. Engines

Python hook tooling

Fresh environments preserve upstream requirements. These are verifier resolutions,
not new project pins.

Dependency Before Considered target Final Outcome and evidence
PyYAML resolver-managed 6.0.3 6.0.3 Already current: Native Python 3.15 resolution; no leaf pins. PyPI
cfgv resolver-managed 3.5.0 3.5.0 Already current: Native Python 3.15 resolution; no leaf pins. PyPI
distlib resolver-managed 0.4.3 0.4.3 Already current: Native Python 3.15 resolution; no leaf pins. PyPI
filelock resolver-managed 4.1.1 4.1.1 Already current: Native Python 3.15 resolution; no leaf pins. PyPI
identify resolver-managed 2.6.20 2.6.20 Already current: Native Python 3.15 resolution; no leaf pins. PyPI
nodeenv resolver-managed 1.11.0 1.11.0 Already current: Native Python 3.15 resolution; no leaf pins. PyPI
packaging resolver-managed 26.3 26.3 Already current: Native Python 3.15 resolution; no leaf pins. PyPI
pathspec resolver-managed 1.1.1 1.1.1 Already current: Native Python 3.15 resolution; no leaf pins. PyPI
pip resolver-managed 26.2.1 26.2.1 Already current: Native Python 3.15 resolution; no leaf pins. PyPI
platformdirs resolver-managed 4.13.0 4.13.0 Already current: Native Python 3.15 resolution; no leaf pins. PyPI
pre_commit resolver-managed 4.6.2 4.6.2 Already current: Native Python 3.15 resolution; no leaf pins. PyPI
pre_commit_hooks resolver-managed 6.0.0 6.0.0 Already current: Native Python 3.15 resolution; no leaf pins. PyPI
python-discovery resolver-managed 1.6.2 1.6.2 Already current: Native Python 3.15 resolution; no leaf pins. PyPI
ruamel.yaml resolver-managed 0.19.1 0.19.1 Already current: Native Python 3.15 resolution; no leaf pins. PyPI
texthooks resolver-managed 0.7.1 0.7.1 Already current: Native Python 3.15 resolution; no leaf pins. PyPI
virtualenv resolver-managed 21.14.7 21.14.7 Already current: Native Python 3.15 resolution; no leaf pins. PyPI
yamllint resolver-managed 1.38.0 1.38.0 Already current: Native Python 3.15 resolution; no leaf pins. PyPI

Markdown hook graph

Fresh native hook installation; dependencies belong to upstream markdownlint-cli2.
Older nested versions remain within upstream ranges; update the supported parent
rather than overriding its private graph. Revisit when that parent advances.

Dependency Before Considered target Final Outcome and evidence
@nodelib/fs.scandir 2.1.5 4.0.1 2.1.5 Deferred: Parent-owned graph; retry with supported parent update, no leaf override. Registry
@nodelib/fs.stat 2.0.5 4.0.0 2.0.5 Deferred: Parent-owned graph; retry with supported parent update, no leaf override. Registry
@nodelib/fs.walk 1.2.8 3.0.1 1.2.8 Deferred: Parent-owned graph; retry with supported parent update, no leaf override. Registry
@sindresorhus/merge-streams 4.0.0 4.0.0 4.0.0 Already current: Current resolver result. Registry
@types/debug 4.1.13 4.1.13 4.1.13 Already current: Current resolver result. Registry
@types/katex 0.16.8 0.16.8 0.16.8 Already current: Current resolver result. Registry
@types/ms 2.1.0 2.1.0 2.1.0 Already current: Current resolver result. Registry
@types/unist 2.0.11 3.0.3 2.0.11 Deferred: Parent-owned graph; retry with supported parent update, no leaf override. Registry
ansi-regex 6.4.0 6.4.0 6.4.0 Already current: Current resolver result. Registry
argparse 3.0.2 3.0.2 2.0.1, 3.0.2 Deferred: Parent-owned graph; retry with supported parent update, no leaf override. Registry
braces 3.0.3 3.0.3 3.0.3 Already current: Current resolver result. Registry
character-entities 2.0.2 2.0.2 2.0.2 Already current: Current resolver result. Registry
character-entities-legacy 3.0.0 3.0.0 3.0.0 Already current: Current resolver result. Registry
character-reference-invalid 2.0.1 2.0.1 2.0.1 Already current: Current resolver result. Registry
commander 8.3.0 15.0.0 8.3.0 Deferred: Parent-owned graph; retry with supported parent update, no leaf override. Registry
debug 4.4.3 4.4.3 4.4.3 Already current: Current resolver result. Registry
decode-named-character-reference 1.3.0 1.3.0 1.3.0 Already current: Current resolver result. Registry
dequal 2.0.3 2.0.3 2.0.3 Already current: Current resolver result. Registry
devlop 1.1.0 1.1.0 1.1.0 Already current: Current resolver result. Registry
entities 8.1.0 8.1.0 8.1.0 Already current: Current resolver result. Registry
fast-glob 3.3.3 3.3.3 3.3.3 Already current: Current resolver result. Registry
fastq 1.20.3 1.20.3 1.20.3 Already current: Current resolver result. Registry
fill-range 7.1.1 7.1.1 7.1.1 Already current: Current resolver result. Registry
get-east-asian-width 1.7.0 1.7.0 1.7.0 Already current: Current resolver result. Registry
glob-parent 5.1.2 6.0.2 5.1.2 Deferred: Parent-owned graph; retry with supported parent update, no leaf override. Registry
globby 16.2.4 16.2.4 16.2.4 Already current: Current resolver result. Registry
ignore 7.0.12 7.0.12 7.0.12 Already current: Current resolver result. Registry
is-alphabetical 2.0.1 2.0.1 2.0.1 Already current: Current resolver result. Registry
is-alphanumerical 2.0.1 2.0.1 2.0.1 Already current: Current resolver result. Registry
is-decimal 2.0.1 2.0.1 2.0.1 Already current: Current resolver result. Registry
is-extglob 2.1.1 2.1.1 2.1.1 Already current: Current resolver result. Registry
is-glob 4.0.3 4.0.3 4.0.3 Already current: Current resolver result. Registry
is-hexadecimal 2.0.1 2.0.1 2.0.1 Already current: Current resolver result. Registry
is-number 7.0.0 7.0.0 7.0.0 Already current: Current resolver result. Registry
is-path-inside 4.0.0 4.0.0 4.0.0 Already current: Current resolver result. Registry
js-yaml 5.4.1 5.4.3 5.4.1 Deferred: Parent-owned graph; retry with supported parent update, no leaf override. Registry
jsonc-parser 3.3.1 3.3.1 3.3.1 Already current: Current resolver result. Registry
jsonpointer 5.0.1 5.0.1 5.0.1 Already current: Current resolver result. Registry
katex 0.16.47 0.19.0 0.16.47 Deferred: Parent-owned graph; retry with supported parent update, no leaf override. Registry
linkify-it 6.1.0 6.1.0 6.1.0 Already current: Current resolver result. Registry
markdown-it 15.0.1 15.0.2 15.0.1 Deferred: Parent-owned graph; retry with supported parent update, no leaf override. Registry
markdownlint 0.41.1 0.41.1 0.41.1 Already current: Current resolver result. Registry
markdownlint-cli2 resolver-managed 0.23.3 0.23.3 Already current: Current resolver result. Registry
markdownlint-cli2-formatter-default 0.0.6 0.0.6 0.0.6 Already current: Current resolver result. Registry
mdurl 2.1.0 2.1.0 2.1.0 Already current: Current resolver result. Registry
merge2 1.4.1 1.4.1 1.4.1 Already current: Current resolver result. Registry
micromark 4.0.2 4.0.3 4.0.2 Deferred: Parent-owned graph; retry with supported parent update, no leaf override. Registry
micromark-core-commonmark 2.0.3 2.0.4 2.0.3 Deferred: Parent-owned graph; retry with supported parent update, no leaf override. Registry
micromark-extension-directive 4.0.0 4.0.0 4.0.0 Already current: Current resolver result. Registry
micromark-extension-gfm-autolink-literal 2.1.0 2.1.0 2.1.0 Already current: Current resolver result. Registry
micromark-extension-gfm-footnote 2.1.0 2.1.0 2.1.0 Already current: Current resolver result. Registry
micromark-extension-gfm-table 2.1.1 2.1.2 2.1.1 Deferred: Parent-owned graph; retry with supported parent update, no leaf override. Registry
micromark-extension-math 3.1.0 3.1.0 3.1.0 Already current: Current resolver result. Registry
micromark-factory-destination 2.0.1 2.0.1 2.0.1 Already current: Current resolver result. Registry
micromark-factory-label 2.0.1 2.0.1 2.0.1 Already current: Current resolver result. Registry
micromark-factory-space 2.1.0 2.1.0 2.1.0 Already current: Current resolver result. Registry
micromark-factory-title 2.0.1 2.0.1 2.0.1 Already current: Current resolver result. Registry
micromark-factory-whitespace 2.0.1 2.0.1 2.0.1 Already current: Current resolver result. Registry
micromark-util-character 2.1.1 2.1.1 2.1.1 Already current: Current resolver result. Registry
micromark-util-chunked 2.0.1 2.0.1 2.0.1 Already current: Current resolver result. Registry
micromark-util-classify-character 2.0.1 2.0.1 2.0.1 Already current: Current resolver result. Registry
micromark-util-combine-extensions 2.0.1 2.0.1 2.0.1 Already current: Current resolver result. Registry
micromark-util-decode-numeric-character-reference 2.0.2 2.0.2 2.0.2 Already current: Current resolver result. Registry
micromark-util-encode 2.0.1 2.0.1 2.0.1 Already current: Current resolver result. Registry
micromark-util-html-tag-name 2.0.1 2.0.1 2.0.1 Already current: Current resolver result. Registry
micromark-util-normalize-identifier 2.0.1 2.0.1 2.0.1 Already current: Current resolver result. Registry
micromark-util-resolve-all 2.0.1 2.0.1 2.0.1 Already current: Current resolver result. Registry
micromark-util-sanitize-uri 2.0.1 2.0.1 2.0.1 Already current: Current resolver result. Registry
micromark-util-subtokenize 2.1.0 2.1.0 2.1.0 Already current: Current resolver result. Registry
micromark-util-symbol 2.0.1 2.0.1 2.0.1 Already current: Current resolver result. Registry
micromark-util-types 2.0.2 2.0.3 2.0.2 Deferred: Parent-owned graph; retry with supported parent update, no leaf override. Registry
micromatch 4.0.8 4.0.8 4.0.8 Already current: Current resolver result. Registry
ms 2.1.3 2.1.3 2.1.3 Already current: Current resolver result. Registry
parse-entities 4.0.2 4.0.2 4.0.2 Already current: Current resolver result. Registry
picomatch 2.3.2 4.0.7 2.3.2 Deferred: Parent-owned graph; retry with supported parent update, no leaf override. Registry
punycode.js 2.3.1 2.3.1 2.3.1 Already current: Current resolver result. Registry
queue-microtask 1.2.3 1.2.3 1.2.3 Already current: Current resolver result. Registry
reusify 1.1.0 1.1.0 1.1.0 Already current: Current resolver result. Registry
run-parallel 1.2.0 1.2.0 1.2.0 Already current: Current resolver result. Registry
slash 5.1.0 5.1.0 5.1.0 Already current: Current resolver result. Registry
smol-toml 1.8.0 1.9.1 1.8.0 Deferred: Parent-owned graph; retry with supported parent update, no leaf override. Registry
string-width 8.2.1 8.3.0 8.2.1 Deferred: Parent-owned graph; retry with supported parent update, no leaf override. Registry
strip-ansi 7.2.0 7.2.0 7.2.0 Already current: Current resolver result. Registry
to-regex-range 5.0.1 5.0.1 5.0.1 Already current: Current resolver result. Registry
uc.micro 3.0.0 3.0.0 3.0.0 Already current: Current resolver result. Registry
unicorn-magic 0.4.1 0.4.1 0.4.1 Already current: Current resolver result. Registry
markdownlint-rule-helpers resolver-managed 0.31.0 0.31.0 Already current: native hook resolution. Registry

Actionlint module graph

The latest supported parent pins this graph; no forced leaf overrides.
Retry retained older modules when upstream actionlint updates its
go.mod.

Dependency Before Considered target Final Outcome and evidence
github.com/bmatcuk/doublestar/v4 v4.10.0 v4.10.3 v4.10.0 Deferred: Parent module pin; update actionlint when upstream advances. Release
github.com/fatih/color v1.19.0 v1.19.0 v1.19.0 Already current: Latest stable. Release
github.com/google/go-cmp v0.7.0 v0.7.0 v0.7.0 Already current: Latest stable. Release
github.com/mattn/go-colorable v0.1.14 v0.1.16 v0.1.14 Deferred: Parent module pin; update actionlint when upstream advances. Release
github.com/mattn/go-runewidth v0.0.21 v0.0.31 v0.0.21 Deferred: Parent module pin; update actionlint when upstream advances. Release
github.com/mattn/go-shellwords v1.0.12 v1.0.16 v1.0.12 Deferred: Parent module pin; update actionlint when upstream advances. Release
github.com/robfig/cron/v3 v3.0.1 v3.0.1 v3.0.1 Already current: Latest stable. Release
github.com/yuin/goldmark v1.7.17 v1.8.6 v1.7.17 Deferred: Parent module pin; update actionlint when upstream advances. Release
go.yaml.in/yaml/v4 v4.0.0-rc.3 v4.0.0-rc.6 v4.0.0-rc.3 Deferred: Upstream parent retains prerelease; do not introduce another prerelease. Release
golang.org/x/net v0.52.0 v0.61.0 v0.52.0 Deferred: Parent module pin; update actionlint when upstream advances. Release
golang.org/x/sync v0.20.0 v0.24.0 v0.20.0 Deferred: Parent module pin; update actionlint when upstream advances. Release
golang.org/x/sys v0.42.0 v0.49.0 v0.42.0 Deferred: Parent module pin; update actionlint when upstream advances. Release
github.com/clipperhouse/uax29/v2 v2.7.0 v2.7.0 v2.7.0 Already current: Latest stable. Release
github.com/mattn/go-isatty v0.0.20 v0.0.24 v0.0.20 Deferred: Parent module pin; update actionlint when upstream advances. Release

Retained boundaries

  • Upgrade deferred: undici 8.11.2 breaks the toolkit's supported ^6.23.0 dependency contract; retain 6.29.0. Latest parent 4.0.1 is already installed; retry when its range advances. No forced override. Parent
  • Upgrade deferred: Node 24/26 declarations expose APIs absent from the documented Node 22 floor; retain 22.20.5 and its undici-types 6.21.0 family. Retry with an approved support-policy migration. Policy
  • Upgrade deferred: Node 26 remains Current until 2026-10-28; retain supported Node 24 action runtime. Retry when LTS and Actions metadata support align. Schedule
  • Python 3.15's old prerelease deferral is removed. uv 0.12.23 resolved rc3 and lacked final; current uv 0.13.0 supplied verified 3.15.0. Final validation does not use rc3.

Pinned action runtime graphs

The complete action ledger covers 127 declared runtime
package entries across setup-node, checkout and setup-python, with before/final
versions, current registry targets, and shipped-module verification. Latest
parent releases still carry smol-toml, Undici, brace-expansion and XML-parser
advisories. These CI-action risks are separate from this repository's clean npm
graph and the hook/verifier advisories below.

Tooling security deferrals

The committed action graph reports zero npm advisories. The upstream Markdown
hook graph has three advisories; it is development/CI tooling, not bundled runtime.

Dependency Before Considered target Final Outcome and evidence
braces 3.0.3 patched release unavailable 3.0.3 Deferred: latest stable is affected; the latest supported hook still depends on it. Retry when upstream publishes a patch or supported graph replacement. High-severity advisory
smol-toml 1.8.0 1.9.1 1.8.0 Deferred: latest markdownlint-cli2 pins 1.8.0 exactly. No maintained parent upgrade exists; retry its dependency refresh rather than patch private hook installs. Moderate advisory
katex 0.16.47 0.18.2 fix; 0.19.0 latest 0.16.47 Deferred: latest micromark-extension-math 3.1.0 requires ^0.16.0; patched versions exceed its contract. Retry a supported parent migration. Low-severity advisory

Untrusted deep brace patterns/TOML can deny service; KaTeX requires pre-existing
prototype pollution. No exploitability claim is made. These remain disclosed
upstream risks; successful lint does not make them patched. Hook replacement
would change lint coverage and still needs a maintained compatible graph.

Optional npm verifier bundle

The unpinned npm 12.2.0 verifier also retains upstream advisories; these copies
are not part of the action lockfile or dist. Its supported parent is already
latest. Project overrides cannot repair bundled npm dependencies; retry after
the upstream bundle refresh.

Dependency Before Considered target Final Outcome and evidence
brace-expansion (npm bundle) 5.0.9 5.0.12 5.0.9 Deferred: npm 12.2.0 bundles this copy; retry the upstream bundle refresh. Advisory
ip-address (npm bundle) 10.5.0 10.7.4 10.5.0 Deferred: npm 12.2.0 bundles this copy; retry the upstream bundle refresh. Advisory
undici (npm bundle) 6.28.0 8.11.2 6.28.0 Deferred: npm 12.2.0 bundles this copy; retry the upstream bundle refresh. Advisory
http-cache-semantics (npm bundle) 4.2.0 4.3.0 4.2.0 Deferred: npm 12.2.0 bundles this copy; retry the upstream bundle refresh. Advisory
postcss-selector-parser (npm bundle) 7.1.4 7.1.6 7.1.4 Deferred: npm 12.2.0 bundles this copy; retry the upstream bundle refresh. Advisory

Source map and validation

  • Sole source PR #63, head 770388e, is preserved unchanged in ancestry with Dependabot attribution. All four setup-node references are incorporated.
  • Baseline main 6f13d39: 305 tests pass. Final candidate: 306 pass, three Windows-native skips on both Node 22.23.3 and 24.21.0. The review regression first failed on an unscoped README swap example, then passed after adding its privileged-Linux-only comment. Locked install, typecheck, format and check-dist pass; dist is byte-identical.
  • npm 12.2.0 isolated locked install passes. Relative Markdown links and anchors pass. No runtime source changes; destructive cleanup was not executed locally.
  • Fresh Python 3.15.0 / pre-commit 4.6.2 environments pass all nine pre-push hooks. Go 1.27.2 compiles actionlint. npm 11.9 rejected the new local-git permission flag; npm 11.19 and 12.2.0 installs pass. The system go command was unrelated; a checksum-verified official Go toolchain fixes that environment failure.
  • Browser smoke testing is inapplicable: this repository has no UI. Actual action execution is covered by seven-class hosted-runner PR smoke CI; local deterministic tests use bounded fixtures.
  • PR readiness requires current-head CI and completed Codex review. Release additionally requires authorized manual seven-class default-max and 18-label compatibility dispatch; this run does not dispatch that separate 26-job gate.
Pinned action runtime graphs and shipped-module security evidence (2026-10-12)

Action runtime dependency review - 2026-10-12

This supplements the main ledger. All three actions use the
latest stable upstream release. Their published bundles are immutable; project
npm overrides cannot modify them. Retain supported actions and revisit deferred
leaves when upstream rebuilds a supported release. No speculative private forks.

Tables inventory production declarations from the exact pinned upstream lockfiles
(excluding development-only packages). They are not a claim that every declared
package is reachable in a compiled entrypoint. Registry targets were checked on
2026-10-12. Bundled behavior and advisory evidence are distinguished below.

Shipped code and security

  • setup-node 7.1.0 ships vulnerable smol-toml scanning code in both entrypoints:
    setup
    and post.
    Official npm 1.7.1 struct.js matches the bundled module after ncc normalization;
    its quadratic scan is fixed in 1.9.0+.
    These workflows use explicit node-version: "22", not a TOML version file.
    This limits the relevant input path; it does not patch the action.
    Advisory
  • setup-node's brace-expansion bundle is the patched 5.0.12 implementation,
    corroborated by exact source and behavioral checks. A prior review's 5.0.8
    claim does not describe this pin. The upgrade removes old 1.x/5.0.6 declarations
    and upgrades its Undici declaration from 6.27.0 to 6.29.0.
    Shipped brace implementation
  • checkout 7.0.1 declares Undici 6.27.0 (six advisory records; fixes in 6.28.1+).
    Official-tarball comparison matches 89 of 99 Undici source modules, including
    retry, cookie and WebSocket security-critical code, in checkout and both
    setup-python entrypoints. This confirms shipped code, not workflow exploitability.
    Bundle
  • setup-python 7.0.0 declares brace-expansion 1.1.15/5.0.6, Undici 6.27.0,
    and fast-xml-parser 5.9.3. Audit returns 19 affected range records (13 distinct
    advisory IDs). Exact-normalized source matches brace 1.1.15 in both entrypoints and
    brace 5.0.6 in setup. The supplied npm tarball integrity was verified. Official fast-xml-parser 5.9.3 DocTypeReader and OrderedObjParser source
    matches both bundles after ncc normalization. Repeated DOCTYPE calls reset
    document-wide entity limits: call,
    reset.
    Setup bundle
Retained dependency Considered fix Outcome / retry condition
setup-node: smol-toml 1.7.1 1.9.0+; latest 1.9.1 Deferred: latest action bundles affected code; retry a supported rebuilt action.
checkout/setup-python: Undici 6.27.0 6.28.1+; supported 6.x latest 6.29.0 Deferred: action-owned bundle; retry upstream release. Advisory
setup-python: brace-expansion 1.1.15/5.0.6 1.1.21 / 5.0.12 Deferred: both bundled families need upstream refresh. Advisory
setup-python: fast-xml-parser 5.9.3 5.10.1+ Deferred: latest parent retains affected implementation; retry supported rebuild. Advisory

Current parent releases are already selected. Forcing leaves in this repository
would leave downloaded action bundles untouched. Replacing setup/checkout with
custom shell code would introduce a new authentication/cache/platform maintenance
surface rather than a supported dependency migration. CI success does not clear
these upstream security deferrals; they remain explicit release risks.

setup-node

Exact upstream lock. Before: 7.0.0; final: 7.1.0.

Dependency Before Considered stable target Final Outcome
@actions/cache 6.1.0 6.3.0 6.3.0 Upgraded with parent.
@actions/core 3.0.1 3.0.1 3.0.1 Already current.
@actions/exec 3.0.0 3.0.0 3.0.0 Already current.
@actions/github 9.1.1 9.1.1 9.1.1 Already current.
@actions/glob 0.6.1, 0.7.0 0.7.0 0.7.0 Upgraded with parent.
@actions/http-client 3.0.2, 4.0.1 4.0.1 3.0.2, 4.0.1 Deferred: parent-managed; retry upstream.
@actions/io 3.0.2 3.0.2 3.0.2 Already current.
@actions/tool-cache 4.0.0 4.0.0 4.0.0 Already current.
@azure/abort-controller 2.1.2 2.2.0 2.1.2 Deferred: parent-managed; retry upstream.
@azure/core-auth 1.10.1 1.11.0 1.10.1 Deferred: parent-managed; retry upstream.
@azure/core-client 1.10.1 1.11.1 1.10.1 Deferred: parent-managed; retry upstream.
@azure/core-http-compat 2.4.0 2.5.0 2.4.0 Deferred: parent-managed; retry upstream.
@azure/core-lro 2.7.2 3.4.1 2.7.2 Deferred: parent-managed; retry upstream.
@azure/core-paging 1.6.2 1.7.0 1.6.2 Deferred: parent-managed; retry upstream.
@azure/core-rest-pipeline 1.23.0 1.25.0 1.23.0 Deferred: parent-managed; retry upstream.
@azure/core-tracing 1.3.1 1.4.0 1.3.1 Deferred: parent-managed; retry upstream.
@azure/core-util 1.13.1 1.14.0 1.13.1 Deferred: parent-managed; retry upstream.
@azure/core-xml 1.5.1 1.6.0 1.5.1 Deferred: parent-managed; retry upstream.
@azure/logger 1.3.0 1.4.0 1.3.0 Deferred: parent-managed; retry upstream.
@azure/storage-blob 12.31.0 12.34.0 12.31.0 Deferred: parent-managed; retry upstream.
@azure/storage-common 12.3.0 12.5.0 12.3.0 Deferred: parent-managed; retry upstream.
@nodable/entities 2.1.0 3.1.0 2.1.0 Deferred: parent-managed; retry upstream.
@octokit/auth-token 6.0.0 6.0.0 6.0.0 Already current.
@octokit/core 7.0.6 7.0.8 7.0.6 Deferred: parent-managed; retry upstream.
@octokit/endpoint 11.0.3 11.0.5 11.0.3 Deferred: parent-managed; retry upstream.
@octokit/graphql 9.0.3 9.0.5 9.0.3 Deferred: parent-managed; retry upstream.
@octokit/openapi-types 27.0.0 29.0.1 27.0.0 Deferred: parent-managed; retry upstream.
@octokit/plugin-paginate-rest 14.0.0 16.0.0 14.0.0 Deferred: parent-managed; retry upstream.
@octokit/plugin-rest-endpoint-methods 17.0.0 18.0.0 17.0.0 Deferred: parent-managed; retry upstream.
@octokit/request 10.0.8 10.0.16 10.0.8 Deferred: parent-managed; retry upstream.
@octokit/request-error 7.1.0 7.1.2 7.1.0 Deferred: parent-managed; retry upstream.
@octokit/types 16.0.0 18.0.0 16.0.0 Deferred: parent-managed; retry upstream.
@protobuf-ts/runtime 2.11.1 2.11.1 2.11.1 Already current.
@protobuf-ts/runtime-rpc 2.11.1 2.11.1 2.11.1 Already current.
@typespec/ts-http-runtime 0.3.5 0.3.9 0.3.5 Deferred: parent-managed; retry upstream.
agent-base 7.1.4 9.0.0 7.1.4 Deferred: parent-managed; retry upstream.
balanced-match 1.0.2, 4.0.4 4.0.4 4.0.4 Upgraded with parent.
before-after-hook 4.0.0 4.0.0 4.0.0 Already current.
brace-expansion 1.1.13, 5.0.6 5.0.12 5.0.12 Upgraded with parent.
concat-map 0.0.1 0.0.2 — Upgraded: removed by parent.
debug 4.4.3 4.4.3 4.4.3 Already current.
events 3.3.0 3.3.0 3.3.0 Already current.
fast-content-type-parse 3.0.0 4.0.1 3.0.0 Deferred: parent-managed; retry upstream.
fast-xml-builder 1.2.0 1.3.1 1.2.0 Deferred: parent-managed; retry upstream.
fast-xml-parser 5.7.2 5.11.2 5.7.2 Deferred: parent-managed; retry upstream.
http-proxy-agent 7.0.2 9.1.0 7.0.2 Deferred: parent-managed; retry upstream.
https-proxy-agent 7.0.6 9.1.0 7.0.6 Deferred: parent-managed; retry upstream.
json-with-bigint 3.5.8 3.5.12 3.5.8 Deferred: parent-managed; retry upstream.
minimatch 10.2.5, 3.1.5 10.2.6 10.2.6 Upgraded with parent.
ms 2.1.3 2.1.3 2.1.3 Already current.
path-expression-matcher 1.5.0 1.6.2 1.5.0 Deferred: parent-managed; retry upstream.
semver 7.8.5 7.8.5 7.8.5 Already current.
smol-toml — 1.9.1 1.7.1 Deferred: newly introduced parser; advisory above.
strnum 2.2.3 2.5.1 2.2.3 Deferred: parent-managed; retry upstream.
tslib 2.8.1 2.8.1 2.8.1 Already current.
tunnel 0.0.6 0.0.6 0.0.6 Already current.
undici 6.27.0 8.11.2 6.29.0 Upgraded with parent.
universal-user-agent 7.0.3 7.0.3 7.0.3 Already current.
xml-naming 0.1.0 0.3.0 0.1.0 Deferred: parent-managed; retry upstream.

checkout

Exact upstream lock. Before and final parent unchanged.

Dependency Before Considered stable target Final Outcome
@actions/core 3.0.1 3.0.1 3.0.1 Already current.
@actions/exec 3.0.0 3.0.0 3.0.0 Already current.
@actions/github 9.1.1 9.1.1 9.1.1 Already current.
@actions/http-client 3.0.2, 4.0.1 4.0.1 3.0.2, 4.0.1 Deferred: parent-managed; retry upstream.
@actions/io 3.0.2 3.0.2 3.0.2 Already current.
@actions/tool-cache 4.0.0 4.0.0 4.0.0 Already current.
@octokit/auth-token 6.0.0 6.0.0 6.0.0 Already current.
@octokit/core 7.0.6 7.0.8 7.0.6 Deferred: parent-managed; retry upstream.
@octokit/endpoint 11.0.3 11.0.5 11.0.3 Deferred: parent-managed; retry upstream.
@octokit/graphql 9.0.3 9.0.5 9.0.3 Deferred: parent-managed; retry upstream.
@octokit/openapi-types 27.0.0 29.0.1 27.0.0 Deferred: parent-managed; retry upstream.
@octokit/plugin-paginate-rest 14.0.0 16.0.0 14.0.0 Deferred: parent-managed; retry upstream.
@octokit/plugin-rest-endpoint-methods 17.0.0 18.0.0 17.0.0 Deferred: parent-managed; retry upstream.
@octokit/request 10.0.10 10.0.16 10.0.10 Deferred: parent-managed; retry upstream.
@octokit/request-error 7.1.0 7.1.2 7.1.0 Deferred: parent-managed; retry upstream.
@octokit/types 16.0.0 18.0.0 16.0.0 Deferred: parent-managed; retry upstream.
before-after-hook 4.0.0 4.0.0 4.0.0 Already current.
content-type 2.0.0 3.1.1 2.0.0 Deferred: parent-managed; retry upstream.
json-with-bigint 3.5.8 3.5.12 3.5.8 Deferred: parent-managed; retry upstream.
semver 7.8.4 7.8.5 7.8.4 Deferred: parent-managed; retry upstream.
tunnel 0.0.6 0.0.6 0.0.6 Already current.
undici 6.27.0 8.11.2 6.27.0 Deferred: parent-managed; retry upstream.
universal-user-agent 7.0.3 7.0.3 7.0.3 Already current.

setup-python

Exact upstream lock. Before and final parent unchanged.

Dependency Before Considered stable target Final Outcome
@actions/cache 6.2.0 6.3.0 6.2.0 Deferred: parent-managed; retry upstream.
@actions/core 3.0.1 3.0.1 3.0.1 Already current.
@actions/exec 3.0.0 3.0.0 3.0.0 Already current.
@actions/glob 0.6.1, 0.7.0 0.7.0 0.6.1, 0.7.0 Deferred: parent-managed; retry upstream.
@actions/http-client 4.0.1 4.0.1 4.0.1 Already current.
@actions/io 3.0.2 3.0.2 3.0.2 Already current.
@actions/tool-cache 4.0.0 4.0.0 4.0.0 Already current.
@azure/abort-controller 2.1.2 2.2.0 2.1.2 Deferred: parent-managed; retry upstream.
@azure/core-auth 1.10.1 1.11.0 1.10.1 Deferred: parent-managed; retry upstream.
@azure/core-client 1.10.2 1.11.1 1.10.2 Deferred: parent-managed; retry upstream.
@azure/core-http-compat 2.4.0 2.5.0 2.4.0 Deferred: parent-managed; retry upstream.
@azure/core-lro 2.7.2 3.4.1 2.7.2 Deferred: parent-managed; retry upstream.
@azure/core-paging 1.6.2 1.7.0 1.6.2 Deferred: parent-managed; retry upstream.
@azure/core-rest-pipeline 1.24.0 1.25.0 1.24.0 Deferred: parent-managed; retry upstream.
@azure/core-tracing 1.3.1 1.4.0 1.3.1 Deferred: parent-managed; retry upstream.
@azure/core-util 1.13.1 1.14.0 1.13.1 Deferred: parent-managed; retry upstream.
@azure/core-xml 1.5.1 1.6.0 1.5.1 Deferred: parent-managed; retry upstream.
@azure/logger 1.3.0 1.4.0 1.3.0 Deferred: parent-managed; retry upstream.
@azure/storage-blob 12.32.0 12.34.0 12.32.0 Deferred: parent-managed; retry upstream.
@azure/storage-common 12.4.0 12.5.0 12.4.0 Deferred: parent-managed; retry upstream.
@iarna/toml 3.0.0 2.2.5 3.0.0 Deferred: parent-managed; retry upstream.
@nodable/entities 2.2.0 3.1.0 2.2.0 Deferred: parent-managed; retry upstream.
@protobuf-ts/runtime 2.11.1 2.11.1 2.11.1 Already current.
@protobuf-ts/runtime-rpc 2.11.1 2.11.1 2.11.1 Already current.
@typespec/ts-http-runtime 0.3.6 0.3.9 0.3.6 Deferred: parent-managed; retry upstream.
agent-base 7.1.4 9.0.0 7.1.4 Deferred: parent-managed; retry upstream.
anynum 1.0.1 1.0.1 1.0.1 Already current.
balanced-match 1.0.2, 4.0.4 4.0.4 1.0.2, 4.0.4 Deferred: parent-managed; retry upstream.
brace-expansion 1.1.15, 5.0.6 5.0.12 1.1.15, 5.0.6 Deferred: parent-managed; retry upstream.
concat-map 0.0.1 0.0.2 0.0.1 Deferred: parent-managed; retry upstream.
debug 4.4.3 4.4.3 4.4.3 Already current.
events 3.3.0 3.3.0 3.3.0 Already current.
fast-xml-builder 1.2.0 1.3.1 1.2.0 Deferred: parent-managed; retry upstream.
fast-xml-parser 5.9.3 5.11.2 5.9.3 Deferred: parent-managed; retry upstream.
http-proxy-agent 7.0.2 9.1.0 7.0.2 Deferred: parent-managed; retry upstream.
https-proxy-agent 7.0.6 9.1.0 7.0.6 Deferred: parent-managed; retry upstream.
is-unsafe 1.0.1 2.0.2 1.0.1 Deferred: parent-managed; retry upstream.
minimatch 10.2.5, 3.1.5 10.2.6 10.2.5, 3.1.5 Deferred: parent-managed; retry upstream.
ms 2.1.3 2.1.3 2.1.3 Already current.
path-expression-matcher 1.6.0 1.6.2 1.6.0 Deferred: parent-managed; retry upstream.
semver 7.8.5 7.8.5 7.8.5 Already current.
strnum 2.4.1 2.5.1 2.4.1 Deferred: parent-managed; retry upstream.
tslib 2.8.1 2.8.1 2.8.1 Already current.
tunnel 0.0.6 0.0.6 0.0.6 Already current.
undici 6.27.0 8.11.2 6.27.0 Deferred: parent-managed; retry upstream.
xml-naming 0.1.0 0.3.0 0.1.0 Deferred: parent-managed; retry upstream.

dependabot Bot and others added 2 commits October 11, 2026 01:12
@dependabot
build(deps): bump actions/setup-node
770388e 
Bumps the github-actions group with 1 update: [actions/setup-node](https://github.com/actions/setup-node).


Updates `actions/setup-node` from 7.0.0 to 7.1.0
- [Release notes](https://github.com/actions/setup-node/releases)
- [Commits](actions/setup-node@8207627...949feb2)

---
updated-dependencies:
- dependency-name: actions/setup-node
  dependency-version: 7.1.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: github-actions
...

Signed-off-by: dependabot[bot] <support@github.com>
@justinthelaw
build(deps): upgrade toolchain and condense maintained docs
13ad2a1 
Preserve Dependabot PR #63 as an ancestor; update Prettier and Python lint runtime.
Record complete dependency outcomes and upstream tooling security deferrals.
@justinthelaw ChatGPT Codex Connector

justinthelaw commented Oct 12, 2026

Copy link
Copy Markdown
Owner Author

@codex review

@chatgpt-codex-connector

chatgpt-codex-connector Bot commented Oct 12, 2026 •
edited
Loading

Copy link
Copy Markdown

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review Status Commit Review trigger
📝 Code Review ✅ Completed 2026-10-12T15:55:54.375644Z 6d89727 Manual request
ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

  • Open a pull request for review
  • Mark a draft as ready
  • Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

@justinthelaw
justinthelaw marked this pull request as ready for review October 12, 2026 15:37
chatgpt-codex-connector[bot]
chatgpt-codex-connector Bot reviewed Oct 12, 2026
View reviewed changes

@chatgpt-codex-connector chatgpt-codex-connector Bot left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 13ad2a14bd

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

  • Open a pull request for review
  • Mark a draft as ready
  • Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

Comment thread docs/dependency-upgrades/2026-10-12.md Outdated
Comment thread README.md
@justinthelaw
docs: scope swap example to privileged Linux
bf74b1b 
Add a documentation regression that fails for unscoped swap snippets.
@justinthelaw
docs: audit pinned action runtime bundles and deferrals
6d89727 
Inventory exact pinned action production graphs and verify affected shipped modules against official package sources.
@justinthelaw ChatGPT Codex Connector

justinthelaw commented Oct 12, 2026

Copy link
Copy Markdown
Owner Author

@codex review

@chatgpt-codex-connector

chatgpt-codex-connector Bot commented Oct 12, 2026

Copy link
Copy Markdown

Codex Review: Didn't find any major issues. Can't wait for the next one!

Reviewed commit: 6d89727eb7

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

  • Open a pull request for review
  • Mark a draft as ready
  • Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

@justinthelaw justinthelaw mentioned this pull request Oct 12, 2026
Closed
@justinthelaw
justinthelaw merged commit 2b7b287 into main Oct 12, 2026
12 checks passed
@justinthelaw
justinthelaw deleted the codex/upgrades-2026-10-12 branch October 12, 2026 16:03
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@chatgpt-codex-connector chatgpt-codex-connector[bot] chatgpt-codex-connector[bot] left review comments

Assignees

No one assigned

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

1 participant

@justinthelaw