Summary
Dependabot reported 13 open alerts on this repository in the week of
1–8 September, across both package.json manifests. Separately, five
workflows have been failing continuously on develop.
Dependabot alerts
Root package-lock.json:
| package |
severity |
patched in |
undici |
3 moderate, 2 low, 2 moderate (three advisory ranges) |
6.24.0 / 6.27.0 / 6.28.0 |
tmp |
high |
0.2.6 |
.github/website/package-lock.json:
| package |
severity |
patched in |
js-yaml (4.x line) |
high |
4.3.1 |
js-yaml (3.x line, via gray-matter) |
high |
3.15.1 |
nanoid |
high |
3.3.18 |
postcss |
moderate |
8.5.23 |
Failing workflows
| workflow |
cause |
| Labeling • Discussions, Issues & PRs |
minimatch imported but never declared; resolves transitively to CJS 3.1.5, so import { minimatch } throws at module load |
| Issue Management Orchestration |
same |
| Projects • Add & Sync meta from labels |
gh issue view runs before any actions/checkout, so gh has no repository context |
| Linting |
pre-existing eslint no-undef and @typescript-eslint/no-explicit-any errors |
| Testing |
pre-existing suite failures (auditLogger.logPhaseProgression is not a function, Cannot use 'import.meta' outside a module) |
Issue Compliance is also red, but correctly so — it is reporting that issue
#2296 is missing its DoR and DoD sections. That is a true positive about the
issue, not a broken workflow.
Scope
Covered by the linked PR: the 13 alerts, the three workflow bugs, and the
stale action versions still on the deprecated Node 20 majors.
Not covered: the pre-existing Linting and Testing failures. Those have
been red on develop for days, are unrelated to dependency updates, and want
their own piece of work.
Summary
Dependabot reported 13 open alerts on this repository in the week of
1–8 September, across both
package.jsonmanifests. Separately, fiveworkflows have been failing continuously on
develop.Dependabot alerts
Root
package-lock.json:undicitmp.github/website/package-lock.json:js-yaml(4.x line)js-yaml(3.x line, viagray-matter)nanoidpostcssFailing workflows
minimatchimported but never declared; resolves transitively to CJS 3.1.5, soimport { minimatch }throws at module loadgh issue viewruns before anyactions/checkout, soghhas no repository contextno-undefand@typescript-eslint/no-explicit-anyerrorsauditLogger.logPhaseProgression is not a function,Cannot use 'import.meta' outside a module)Issue Complianceis also red, but correctly so — it is reporting that issue#2296 is missing its DoR and DoD sections. That is a true positive about the
issue, not a broken workflow.
Scope
Covered by the linked PR: the 13 alerts, the three workflow bugs, and the
stale action versions still on the deprecated Node 20 majors.
Not covered: the pre-existing
LintingandTestingfailures. Those havebeen red on
developfor days, are unrelated to dependency updates, and wanttheir own piece of work.