Skip to content

Conversation

@dependabot
Copy link
Contributor

@dependabot dependabot bot commented on behalf of github Aug 24, 2024

Bumps micromatch from 4.0.5 to 4.0.8.

Changelog

Sourced from micromatch's changelog.

[4.0.8] - 2024-08-22

[4.0.7] - 2024-05-22

  • this is basically v4.0.5, with some README updates
  • it is vulnerable to CVE-2024-4067
  • Updated braces to v3.0.3 to avoid CVE-2024-4068
  • does NOT break API compatibility

[4.0.6] - 2024-05-21

  • Added hasBraces to check if a pattern contains braces.
  • Fixes CVE-2024-4067
  • BREAKS API COMPATIBILITY
  • Should be labeled as a major release, but it's not.
Commits

Dependabot compatibility score

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.


Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot merge will merge this PR after your CI passes on it
  • @dependabot squash and merge will squash and merge this PR after your CI passes on it
  • @dependabot cancel merge will cancel a previously requested merge and block automerging
  • @dependabot reopen will reopen this PR if it is closed
  • @dependabot close will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually
  • @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
  • @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
  • @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
  • @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
    You can disable automated security fix PRs for this repo from the Security Alerts page.

Bumps [micromatch](https://github.com/micromatch/micromatch) from 4.0.5 to 4.0.8.
- [Release notes](https://github.com/micromatch/micromatch/releases)
- [Changelog](https://github.com/micromatch/micromatch/blob/4.0.8/CHANGELOG.md)
- [Commits](micromatch/micromatch@4.0.5...4.0.8)

---
updated-dependencies:
- dependency-name: micromatch
  dependency-type: indirect
...

Signed-off-by: dependabot[bot] <[email protected]>
@dependabot dependabot bot added the dependencies Pull requests that update a dependency file label Aug 24, 2024
@dependabot dependabot bot requested review from dscho and mxschmitt as code owners August 24, 2024 10:53
@mxschmitt mxschmitt merged commit c85bfb7 into master Aug 24, 2024
@mxschmitt mxschmitt deleted the dependabot/npm_and_yarn/micromatch-4.0.8 branch August 24, 2024 10:56
yanksyoon added a commit to canonical/action-tmate that referenced this pull request May 15, 2025
* Don't create /continue on macOS

* add connect-timeout variable

Signed-off-by: Dave Lee <[email protected]>

* run the build

Signed-off-by: Dave Lee <[email protected]>

* action.yml

Signed-off-by: Dave Lee <[email protected]>

* connect-timeout-seconds is a better name

Signed-off-by: Dave Lee <[email protected]>

* chore(deps): bump to use actions/checkout v4 (node20 runtime) (mxschmitt#197)

* chore(deps-dev): bump braces from 3.0.2 to 3.0.3 (mxschmitt#196)

* chore(deps-dev): bump micromatch from 4.0.5 to 4.0.8 (mxschmitt#201)

* Adding support for RHEL-based distributions

Signed-off-by: Loic Pottier <[email protected]>
Signed-off-by: Johannes Schindelin <[email protected]>

* chore(deps-dev): bump cross-spawn from 7.0.3 to 7.0.5 (mxschmitt#207)

* add new input msys2-location

add new msys2-location input and use instead of hardcoding c:\msys64

* Update README.md with new input

* Update index.js

* use msys2-location input in didTmateQuit and continueFileExists

* Offer `mxschmitt/action-tmate/detached` for convenience

The `mxschmitt/action-tmate/detached` Action does exactly the same as
the `mxschmitt/action-tmate` Action, except defaulting to detached mode.

This will come in handy in the increasingly many cases I seem to
experience of late where I want to use the detached mode without the
price of adding a `with` section.

Not a big price, but it accumulates.

Signed-off-by: Johannes Schindelin <[email protected]>

* README: document the `mxschmitt/action-tmate/detached` Action

This "sub-"Action merely switches the default to `detached: true`. Which
is so much more convenient than having to add a `with:` section _just_
for that mode.

Signed-off-by: Johannes Schindelin <[email protected]>

* ci(manual-detached-test): use the `./detached` "sub-Action"

Signed-off-by: Johannes Schindelin <[email protected]>

* ci(manual-detached-test): drop no-longer-needed setting

We now limit access to the actor by default, iff the actor has a public
SSH key registered in their GitHub profile.

Signed-off-by: Johannes Schindelin <[email protected]>

* ci(manual-test): stop mentioning the obsolete ubuntu-20.04 pool

It has gone to the ~Google~GitHub Graveyard.

Signed-off-by: Johannes Schindelin <[email protected]>

* Add support for output

* Add ssh to output

* (feature) Add outputs to detached action as well

* ci: verify that the `action.yml` files are in sync

In mxschmitt#218, I added a
convenient way to launch this Action in detached mode:
`mxschmitt/action-tmate/detached@v3`.

The way this is implemented is a copy/edited version of `action.yml` in
the `detached/` subdirectory.

This runs the danger of inadvertent divergences, as happened in
mxschmitt#221 (which I caught in
time and the contributor gracefully addressed).

Let's add automation not only to update the file easily but also to
cause a failure in the PR build with a helpful message suggesting how to
fix the problem.

Signed-off-by: Johannes Schindelin <[email protected]>

* detached/action.yml: synchronize with `action.yml`

There was a difference in whitespace, caught by the new step in
`checkin.yml`.

Signed-off-by: Johannes Schindelin <[email protected]>

* ci: fix 'Verify that the project is built'

The output of that step, if something goes wrong, claims that `dist/` is
not up to date, but the build product is in `lib/`.

Also, `git status -s` shows not only differences in the tracked files,
but also untracked files (which should not exist at that stage). Let's
avoid puzzling contributors when there are untracked files by logging
the output of `git status -s`.

Signed-off-by: Johannes Schindelin <[email protected]>

* ci(manual-test): update list of runner images

See https://github.com/actions/runner-images/blob/310e8e963731084df01bcbdbd5044a5ca7fc0c88/README.md#available-images.

* ci(manual-test): convert from a matrix job to a single job

With this change, the `manual-test` workflow accepts user input as to
what runner OS or Docker image to run on.

It is more useful this way, too, as I never encountered a situation
where I would want to run this Action on multiple runners, having to log
in concurrently into multiple tmate sessions, and I doubt that anyone
else has encountered that situation, either.

Signed-off-by: Johannes Schindelin <[email protected]>

* Add a node.js script to update manual-test's `runs-on` options

As I had suggested in
mxschmitt#224 (comment),
it would be good to have some sort of automation to update the
ever-changing list of runner pools that are supported by GitHub.

Signed-off-by: Johannes Schindelin <[email protected]>

* ci(manual-test): update `runs-on` options

Brought to you by the new `update-manual-test.js` script.

Signed-off-by: Johannes Schindelin <[email protected]>

* update-manual-test: special-case Windows/ARM64 runners

For a little more than two weeks, as of time of writing, there are
GitHub-hosted Windows/ARM64 runners (at long last!), announced here:
https://github.blog/changelog/2025-04-14-windows-arm64-hosted-runners-now-available-in-public-preview/

These are not yet listed in the `runner-images` README, therefore we
want to add them manually.

Signed-off-by: Johannes Schindelin <[email protected]>

* manual-test: install MSYS2 on Windows/ARM64

The Windows/ARM64 runners that are currently in public preview do not
have MSYS2 installed by default, so let's do that.

Signed-off-by: Johannes Schindelin <[email protected]>

---------

Signed-off-by: Dave Lee <[email protected]>
Signed-off-by: Loic Pottier <[email protected]>
Signed-off-by: Johannes Schindelin <[email protected]>
Co-authored-by: Vadim Peretokin <[email protected]>
Co-authored-by: Dave Lee <[email protected]>
Co-authored-by: Johannes Schindelin <[email protected]>
Co-authored-by: Rui Chen <[email protected]>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: Loic Pottier <[email protected]>
Co-authored-by: jeremyd2019 <[email protected]>
Co-authored-by: Max schwenk <[email protected]>
Co-authored-by: Yukai Chou <[email protected]>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

dependencies Pull requests that update a dependency file

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants