diff --git a/.github/workflows/cso-runtime-images.yml b/.github/workflows/cso-runtime-images.yml index e0af153d7..fd9e4d425 100644 --- a/.github/workflows/cso-runtime-images.yml +++ b/.github/workflows/cso-runtime-images.yml @@ -156,7 +156,7 @@ jobs: esac docker --host unix:///var/run/docker.sock info - uses: docker/setup-buildx-action@f87e5991a6d7451dcb8d9637bfbc97413f497069 # v4.4.1 - - uses: docker/login-action@dbcb813823bdd20940b903addbd779551569679f # v4 + - uses: docker/login-action@81c6f93d4bc991e510b342a00b419b3bb4efc5c6 # v4 with: registry: ghcr.io username: ${{ github.actor }} diff --git a/.github/workflows/cso-scanner-images.yml b/.github/workflows/cso-scanner-images.yml index a41713ddb..48b872d38 100644 --- a/.github/workflows/cso-scanner-images.yml +++ b/.github/workflows/cso-scanner-images.yml @@ -76,7 +76,7 @@ jobs: esac docker --host unix:///var/run/docker.sock info - uses: docker/setup-buildx-action@f87e5991a6d7451dcb8d9637bfbc97413f497069 # v4.4.1 - - uses: docker/login-action@dbcb813823bdd20940b903addbd779551569679f # v4 + - uses: docker/login-action@81c6f93d4bc991e510b342a00b419b3bb4efc5c6 # v4 with: registry: ghcr.io username: ${{ github.actor }} diff --git a/.github/workflows/eval-sweep.yml b/.github/workflows/eval-sweep.yml index 4f0fca0ee..abcf4ce10 100644 --- a/.github/workflows/eval-sweep.yml +++ b/.github/workflows/eval-sweep.yml @@ -58,7 +58,7 @@ jobs: # (test/ci-image-tag-binding.test.ts pins the identical input list). run: echo "tag=${{ env.IMAGE }}:${{ hashFiles('.github/docker/Dockerfile.ci', 'bun.lock', 'patches/**') }}" >> "$GITHUB_OUTPUT" - - uses: docker/login-action@dbcb813823bdd20940b903addbd779551569679f # v4 + - uses: docker/login-action@81c6f93d4bc991e510b342a00b419b3bb4efc5c6 # v4 with: registry: ghcr.io username: ${{ github.actor }} diff --git a/.github/workflows/evals-marathon.yml b/.github/workflows/evals-marathon.yml index bc1dd63e2..118e21257 100644 --- a/.github/workflows/evals-marathon.yml +++ b/.github/workflows/evals-marathon.yml @@ -42,7 +42,7 @@ jobs: # Byte-identity pinned by test/ci-image-tag-binding.test.ts. run: echo "tag=${{ env.IMAGE }}:${{ hashFiles('.github/docker/Dockerfile.ci', 'bun.lock', 'patches/**') }}" >> "$GITHUB_OUTPUT" - - uses: docker/login-action@dbcb813823bdd20940b903addbd779551569679f # v4 + - uses: docker/login-action@81c6f93d4bc991e510b342a00b419b3bb4efc5c6 # v4 with: registry: ghcr.io username: ${{ github.actor }} diff --git a/.github/workflows/evals-periodic.yml b/.github/workflows/evals-periodic.yml index 2ee49905a..37b0ad1df 100644 --- a/.github/workflows/evals-periodic.yml +++ b/.github/workflows/evals-periodic.yml @@ -89,7 +89,7 @@ jobs: # Byte-identity pinned by test/ci-image-tag-binding.test.ts. run: echo "tag=${{ env.IMAGE }}:${{ hashFiles('.github/docker/Dockerfile.ci', 'bun.lock', 'patches/**') }}" >> "$GITHUB_OUTPUT" - - uses: docker/login-action@dbcb813823bdd20940b903addbd779551569679f # v4 + - uses: docker/login-action@81c6f93d4bc991e510b342a00b419b3bb4efc5c6 # v4 with: registry: ghcr.io username: ${{ github.actor }} @@ -458,7 +458,7 @@ jobs: sudo sysctl -w kernel.apparmor_restrict_unprivileged_userns=0 fi - - uses: docker/login-action@dbcb813823bdd20940b903addbd779551569679f # v4 + - uses: docker/login-action@81c6f93d4bc991e510b342a00b419b3bb4efc5c6 # v4 with: registry: ghcr.io username: ${{ github.actor }} diff --git a/.github/workflows/evals.yml b/.github/workflows/evals.yml index adc35d0d4..b3c796c88 100644 --- a/.github/workflows/evals.yml +++ b/.github/workflows/evals.yml @@ -136,7 +136,7 @@ jobs: # overwrites /workspace and node_modules comes from the lockfile. run: echo "tag=${{ env.IMAGE }}:${{ hashFiles('.github/docker/Dockerfile.ci', 'bun.lock', 'patches/**') }}" >> "$GITHUB_OUTPUT" - - uses: docker/login-action@dbcb813823bdd20940b903addbd779551569679f # v4 + - uses: docker/login-action@81c6f93d4bc991e510b342a00b419b3bb4efc5c6 # v4 with: registry: ghcr.io username: ${{ github.actor }} diff --git a/.github/workflows/scorecard.yml b/.github/workflows/scorecard.yml index 79d159a95..36b16f2be 100644 --- a/.github/workflows/scorecard.yml +++ b/.github/workflows/scorecard.yml @@ -47,6 +47,6 @@ jobs: path: results.sarif retention-days: 5 - - uses: github/codeql-action/upload-sarif@6f2ac81f5cd81fe351a197ba0b00d91d03cd2aee # v4.39.0 + - uses: github/codeql-action/upload-sarif@9b3254085494b55a0f7c4c2b3d2d52cc712ce370 # v4.39.1 with: sarif_file: results.sarif diff --git a/bun.lock b/bun.lock index 750573534..ceae42b77 100644 --- a/bun.lock +++ b/bun.lock @@ -6,13 +6,13 @@ "name": "gstack", "dependencies": { "@anthropic-ai/sdk": "^0.78.0", - "@huggingface/transformers": "^4.3.1", + "@huggingface/transformers": "^4.3.2", "@ngrok/ngrok": "^1.7.0", "cross-spawn": "^7.0.6", "diff": "^9.0.0", "html-to-docx": "1.8.0", "html-to-vdom": "0.7.0", - "marked": "^18.1.1", + "marked": "^18.1.3", "playwright": "^1.65.0", "sharp": "^0.35.4", "socks": "^2.8.10", @@ -21,7 +21,7 @@ }, "devDependencies": { "@anthropic-ai/claude-agent-sdk": "0.2.141", - "@types/bun": "1.4.3", + "@types/bun": "1.4.4", "prettier": "3.9.10", "typescript": "7.0.2", }, @@ -73,7 +73,7 @@ "@huggingface/tokenizers": ["@huggingface/tokenizers@0.2.0", "", {}, "sha512-LidMHe1FpcSYH4vcSjXooda34pC0M8m1gmDOv7SQi6Iv+ib1zX7J3sHBCC9/3FPCkn2k1b55FneVqMRxrr99pg=="], - "@huggingface/transformers": ["@huggingface/transformers@4.3.1", "", { "dependencies": { "@huggingface/jinja": "^0.5.10", "@huggingface/tokenizers": "^0.2.0", "onnxruntime-node": "1.30.0", "onnxruntime-web": "1.31.0-dev.20260914-8d85527a0", "sharp": "^0.35.4" } }, "sha512-5+voSeUCFK6PCKlY15dPhNOKq3/zOTxDN7oC+Wy9dFb1QZ0TSQomZRRy7URRK8YRuUoE9fGMQTTPC5d/pWBJhA=="], + "@huggingface/transformers": ["@huggingface/transformers@4.3.2", "", { "dependencies": { "@huggingface/jinja": "^0.5.10", "@huggingface/tokenizers": "^0.2.0", "onnxruntime-node": "1.30.0", "onnxruntime-web": "1.31.0-dev.20260914-8d85527a0", "sharp": "^0.35.4" } }, "sha512-V3+dqf3iWlRYJ9I9GreM3zGQd0lAXnnoPeddmkOQYWAEE4l/+Fi6p7tx/qVUJlKQgLXGim2W76rTOzz+eC0i7g=="], "@img/colour": ["@img/colour@1.1.0", "", {}, "sha512-Td76q7j57o/tLVdgS746cYARfSyxk8iEfRxewL9h4OMzYhbW4TAcppl0mT4eyqXddh6L/jwoM75mo7ixa/pCeQ=="], @@ -185,7 +185,7 @@ "@protobufjs/utf8": ["@protobufjs/utf8@1.1.2", "", {}, "sha512-b1UQwcEZ4yCnMCD8DAL1VlbvBJE9/IX4FTIp7BG1xYpf29SLazLSrqUkj4w7Y5y7cCVP6E5tcqqcI0xemPkHug=="], - "@types/bun": ["@types/bun@1.4.3", "", { "dependencies": { "bun-types": "1.4.3" } }, "sha512-N67Pqy8JXbAY/j0tNraS3V5mubGvc6rrrNDmDCtZLlFzccbUJPDb0tvgUBC5q4m8ybkP93Jcn1QB+RYQ6PvBhw=="], + "@types/bun": ["@types/bun@1.4.4", "", { "dependencies": { "bun-types": "1.4.4" } }, "sha512-9wkRDXUXK124pEnAutE6n/l18j+i9GC5IAHK8TmX/2nlySETmky0OU6yL5U8pW1AoKh++AN9auDCr647BfurjQ=="], "@types/node": ["@types/node@26.4.0", "", { "dependencies": { "undici-types": "~8.3.0" } }, "sha512-faiGnoIrLH/V8cibOMEAZ8pMw6oXqSukl29ra4mN8GdaB2ZewzeaLj+INpV5N+Z1eKWzY+IzaIZH2EIR6YZRNQ=="], @@ -241,7 +241,7 @@ "browser-split": ["browser-split@0.0.1", "", {}, "sha512-JhvgRb2ihQhsljNda3BI8/UcRHVzrVwo3Q+P8vDtSiyobXuFpuZ9mq+MbRGMnC22CjW3RrfXdg6j6ITX8M+7Ow=="], - "bun-types": ["bun-types@1.4.3", "", { "dependencies": { "@types/node": "*", "undici-types": "*" } }, "sha512-tinRJNGOmUN+tEAsn2y2e942n9JHRHR42iUYzDH75NmhJqVBokGSQkkfSFdNWwsANIdrK6ACH9t01M452YyTwg=="], + "bun-types": ["bun-types@1.4.4", "", { "dependencies": { "@types/node": "*", "undici-types": "*" } }, "sha512-yjrJh5oGX7mMPKGd19YXyIjmEuj4G4zNC30bs7PM9Az7NQ3ndF3j6hbeRdvJTRQEhJ/FYQwW0a2moweEi2hMxQ=="], "bytes": ["bytes@3.1.2", "", {}, "sha512-/Nf7TyzTx6S3yRJObOAV7956r8cr2+Oj8AC5dt8wSP3BQAoeX58NoHyCU8P8zGkNXStjTSi6fzO6F0pBdcYbEg=="], @@ -413,7 +413,7 @@ "long": ["long@5.3.2", "", {}, "sha512-mNAgZ1GmyNhD7AuqnTG3/VQ26o760+ZYBPKjPvugO8+nLbYfX6TVpJPseBvopbdY+qpZ/lKUnmEc1LeZYS3QAA=="], - "marked": ["marked@18.1.1", "", { "bin": { "marked": "bin/marked.js" } }, "sha512-zEGgrtUG8crk+TrMacJSVABU4DYDDkS8uqgU3ohrn/2fW9C2AEfUrO3m6IhpIpQpl7YcVpiXXC9cSMWDANT3dg=="], + "marked": ["marked@18.1.3", "", { "bin": { "marked": "bin/marked.js" } }, "sha512-9ChMH8EVVgjgID49nsL6IWxWk5c6GtAsq/xw7U1ggkjkU5AGuv68oLTVlFRtvcUYZtpbNyjyvGo3YDu0fGapiw=="], "matcher": ["matcher@4.0.0", "", { "dependencies": { "escape-string-regexp": "^4.0.0" } }, "sha512-S6x5wmcDmsDRRU/c2dkccDwQPXoFczc5+HpQ2lON8pnvHlnvHAHj5WlLVvw6n6vNyHuVugYrFohYxbS+pvFpKQ=="], diff --git a/changelog.d/bump-types-bun-transformers-marked-and-ci-actions.md b/changelog.d/bump-types-bun-transformers-marked-and-ci-actions.md new file mode 100644 index 000000000..5e8e8da89 --- /dev/null +++ b/changelog.d/bump-types-bun-transformers-marked-and-ci-actions.md @@ -0,0 +1 @@ +- **Dependency and CI action patch bumps.** `@types/bun` 1.4.3 → 1.4.4, `@huggingface/transformers` 4.3.1 → 4.3.2 and `marked` 18.1.1 → 18.1.3 in `package.json` and `bun.lock`, plus `docker/login-action` 4.6.0 → 4.7.0 (seven steps in six workflows) and `github/codeql-action/upload-sarif` 4.39.0 → 4.39.1 (scorecard), each still pinned to the full commit SHA of its upstream tag. None of the new package versions adds an install script. Carries Dependabot's #3488, #3489 and #3890 onto current main. diff --git a/package.json b/package.json index 33792b7c0..2b8966d28 100644 --- a/package.json +++ b/package.json @@ -70,13 +70,13 @@ }, "dependencies": { "@anthropic-ai/sdk": "^0.78.0", - "@huggingface/transformers": "^4.3.1", + "@huggingface/transformers": "^4.3.2", "@ngrok/ngrok": "^1.7.0", "cross-spawn": "^7.0.6", "diff": "^9.0.0", "html-to-docx": "1.8.0", "html-to-vdom": "0.7.0", - "marked": "^18.1.1", + "marked": "^18.1.3", "playwright": "^1.65.0", "sharp": "^0.35.4", "socks": "^2.8.10", @@ -98,7 +98,7 @@ ], "devDependencies": { "@anthropic-ai/claude-agent-sdk": "0.2.141", - "@types/bun": "1.4.3", + "@types/bun": "1.4.4", "prettier": "3.9.10", "typescript": "7.0.2" },