Bump dependabot/fetch-metadata from 2.5.0 to 3.1.0#10
Conversation
Bumps [dependabot/fetch-metadata](https://github.com/dependabot/fetch-metadata) from 2.5.0 to 3.1.0. - [Release notes](https://github.com/dependabot/fetch-metadata/releases) - [Commits](dependabot/fetch-metadata@v2.5.0...v3.1.0) --- updated-dependencies: - dependency-name: dependabot/fetch-metadata dependency-version: 3.1.0 dependency-type: direct:production update-type: version-update:semver-major ... Signed-off-by: dependabot[bot] <support@github.com>
LabelsThe following labels could not be found: Please fix the above issues or remove invalid values from |
|
[claude] dependabot review — breaking Major bump 2.5.0 → 3.1.0 di dependabot/fetch-metadata: il breaking change dichiarato in v3.0.0 è il requisito di Node.js v24 come runtime dell'action. Il drop di runtime è gestito dai runner GitHub-hosted (ubuntu-latest), non dal nostro codice. Ho verificato l'unico punto d'uso in .github/workflows/dependabot-auto-merge.yml:17: usiamo solo l'input github-token e l'output update-type, entrambi pienamente supportati in v3.1.0 (anzi v3.1.0 contiene un fix proprio su update-type per PR Python/Composer/Terraform). Le altre modifiche sono interne: switch del build da ncc a esbuild, upgrade di @actions/core a v3 e @actions/github a v9, parsing versione da metadata link, gestione dipendenze duplicate. Nessuna signature di input/output che usiamo è cambiata. Nessuna config da riscrivere lato nostro. Per questo, pur trattandosi formalmente di major bump, raccomando il merge: la verifica del codice del repo conferma che non tocchiamo API rotte. Punti rilevanti:
Aggiornamento valutato safe: nessuna obiezione automatica al merge (la decisione resta umana). |
1 participant
Bumps dependabot/fetch-metadata from 2.5.0 to 3.1.0.
Release notes
Sourced from dependabot/fetch-metadata's releases.
... (truncated)
Commits
25dd0e3v3.1.0 (#692)e073f50Merge pull request #705 from dependabot/dependabot/npm_and_yarn/hono-4.12.140670e16build(deps-dev): bump hono from 4.12.12 to 4.12.147a7fe10Merge pull request #702 from dependabot/dependabot/npm_and_yarn/dependencies-...5168191Updating dist build23882e1build(deps): bump@actions/githubin the dependencies group1072469Merge pull request #701 from dependabot/dependabot/github_actions/actions/cre...43f8a00build(deps): bump actions/create-github-app-token from 3.0.0 to 3.1.1b4d904aMerge pull request #703 from dependabot/dependabot/npm_and_yarn/globals-17.5.0c8046bbbuild(deps-dev): bump globals from 17.4.0 to 17.5.0Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting
@dependabot rebase.Dependabot commands and options
You can trigger Dependabot actions by commenting on this PR:
@dependabot rebasewill rebase this PR@dependabot recreatewill recreate this PR, overwriting any edits that have been made to it@dependabot show <dependency name> ignore conditionswill show all of the ignore conditions of the specified dependency@dependabot ignore this major versionwill close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)@dependabot ignore this minor versionwill close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)@dependabot ignore this dependencywill close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)