chore(ci): bump docker/login-action from 4 to 4.5.2 in the actions-minor group across 1 directory - #8
Closed
dependabot[bot] wants to merge 3915 commits into
Closed
Conversation
Async sub-agents cross turn boundaries, so ordering the Log by when a row settled scrambled the run: a sub-agent spawned three turns ago landed next to whatever finished beside it. `UsageEvent` now carries the spawn-tree identity — `startedAt` (first observed), `subagentKey`, and `parentSubagentKey` — all optional, so old clients and old daemons keep parsing. A row belongs to the turn that spawned it. The Log reads that as a human reads a run: chat turn, its sub-agents, then theirs. `usage-format` grows the grouping and formatting rules with tests, `formatClockTime` gives day-grouped lists a time that doesn't repeat the date already in its header, and the message-time setting is relabelled "Time format" since it now governs the activity log too. `SegmentedControl` gains `wrap` — segments never shrink, so a control with many options is wider than a phone and wrapping is the only way it fits. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
"View documentation" always tried to create a workspace for the source directory. The daemon rejects a second workspace on an occupied checkout (WorkspaceDirectoryOccupiedError), so for any project already open the button surfaced that error instead of the file the user asked for. Reading a README never justifies a workspace of its own: look for the live workspace backed by that directory first — same resolved-path equality the daemon uses in `findOccupyingWorkspaceForCwd`, so "reuse" here matches "rejected" there — and create one only when nothing is there. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
READMEs are full of `<p align="center">`, `<div>`, `<center>`, and `<span>` used purely for alignment. GitHub renders them invisibly; the viewer printed the raw tags as literal text, which is strictly worse than dropping them. All four now unwrap to their children, with block tags keeping the paragraph boundary markdown-it needs. Unmatched opens — usually a close tag stranded in the next part after an inline image split the token run — are dropped too. Unknown non-layout tags still pass through inert. Also breaks the file-rendering charter's relative-image workstream out into its own file: `` and `<img src="…">` fail in two different places, and the fallback behaviour is still an open decision. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
The home screen kept the platform scrollbar, which reserves a gutter on web and shifted the centred tile column off-centre whenever content overflowed. Wraps the scroll region and routes it through the existing `useWebScrollViewScrollbar` overlay (auto-hiding, no gutter) at every width; native keeps its own indicator, which already auto-hides. Also drops the dead `PrBadge` copy left behind in `sidebar-workspace-row-content` when it moved to its own module. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
New charters, all plan-only, no code:
* context-management — full accounting of everything sent before you type
(context graph, skills, MCP, memory) behind a 3-pane tab, severity read
as a share of the model window. Supersedes and absorbs context-health,
which is deleted rather than left to drift alongside it.
* history-management — archived chats have no delete or retention path at
all today; the RPC exists with no UI, plus four retention bugs.
* marketing-strategy — Otto's public voice (Philippe, first person) and
the social channels that don't exist yet.
* outreach — awareness plan scoped to the website, with the eligibility
gates most channels currently fail.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Both sides dropped the upstream social badges from the README; kept the local side, which replaces them with a GitHub Issues badge. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
HTML with a markdown equivalent is now converted (<h1> -> #, <strong> -> **, lists, blockquotes, <hr>); everything else drops its tag and keeps its text, so raw markup never reaches the reader. Unrenderable images fall back to alt text, and `remoteImages` decides which surfaces may fetch at all. The standing policy now lives in docs/markdown-rendering.md. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
The preview body used to infer its state from `isLoading && !preview`, which conflated "still loading" with "nothing to show". It now takes one resolved FilePreviewState, so loading, unavailable, and ready are distinct branches. Alongside: the file view-mode bar and its segmented control pick up the compact sizing pass, and the viewer passes remoteImages: "altText" so a repo document cannot reach the network just by being previewed. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Otto Tools and Browser Tools trailed the Agents page, where they read as a footnote to agent behaviour rather than the tool surfaces they are. They now sit on a dedicated Tools sidebar section after Teams. Speech settings move the other way, onto the Agents page, and each card owns its own section header (Dictation / Voice / OpenAI) instead of sharing one. The OpenAI key card only appears when OpenAI actually backs an engine slot. Labels tightened to match: the browser master is "Enable Browser tools", mirroring "Enable Otto tools", and its category row is just "Control" since the section header already says Browser. docs/preview.md follows. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Phases 0-3 of the context-management charter, plus the edge-convert half of Phase 4. The daemon scans a workspace's real context graph -- context files and their @imports vs. plain links, memory index, skills roster, MCP tool schemas, Otto's own injected prompt -- and evaluates the fixed weight of it as a share of the model window, not as a bare token count. Daemon: context-graph-scanner walks provider conventions (Claude, Codex, OpenCode) from the project root; markdown-refs separates an @import (loaded every request) from a link (loaded only if the agent reads it), which is the load-bearing distinction the whole report rests on. evaluator turns that into severity, content-findings adds the deterministic "worth fixing" list, and edge-convert flips a reference between the two modes on disk. Reports cache on a 15s TTL; converting an edge invalidates explicitly and pushes fresh. App: a three-pane Context tab (graph tree, file view, findings) reachable from the workspace tab menu and the sidebar project row, plus a composer track that warns when fixed context takes a large share of the window. Dismissal is device-local, per workspace. Both the tab and the warning sit behind the contextManagement feature flag; the warning has its own settings toggle, since the tab stays useful either way. MCP tool weight is exact for openai-compat only -- the other providers hand mcpServers to a subprocess and never expose schemas in-process, so that row is absent rather than guessed. The window picker defaults to 200K: the daemon accepts a real window, nothing populates it yet. Not built: demote-to-subdirectory, skills/MCP toggles, AI compaction with per-hunk diff. The charter says why each was deferred rather than forgotten. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Refine: an AI rewrite loop with review -- diff always against the pinned original, per-hunk keep/drop, re-run with a new instruction, and nothing written until Accept. AI Refactor is explicitly not the foundation. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
The file explorer, file preview, and editor outline all gated their overlay scrollbar on `isWeb && !isCompact`, so mobile web fell back to the platform's dated bar. The app's own bar is wanted there too, and the hook no-ops off web, which makes the compact half of the condition dead weight. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
The Context tab's left column was a fixed 320px, which is too narrow to read a long path and too wide once you're working in the file pane. It now drags, clamped so the file pane never falls below a readable width, and the chosen width persists app-wide -- it's a preference about this tool, not a fact about any one project. Width lives on a plain Animated.View shell rather than the Unistyles node, since Reanimated must not share a node Unistyles also patches. A narrower window reconciles a too-large persisted width before it renders. Alongside: the sidebar's fonts take the +2 compact bump and the back chevron the gentler 1.5x, since this is the first screen on a phone. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
The menu labels moved to "chat" (Copy chat id, Reload chat) to match the UI term; the assertions still named the old one. 9 tests green. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
The comment pointed at explorer-sidebar "for the same split", which reads as if the Context sidebar inherited the open/close slide. It didn't -- there is no useSidebarSlide, no opacity, no rendered gate, because this sidebar never goes away. The animated node exists so the pan gesture can move the splitter on the UI thread without re-rendering the tree and file pane every frame. The one-rule StyleSheet.create for that shell becomes a plain constant. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
The Worth fixing list flattens every finding into one list, where a row had no way to say which file it came from or take you there. Findings now carry their node id and the 1-based line span of their range, resolved on the daemon while the file text is already in hand, so a row opens the file and selects the offending span. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
The rate-limit and context-health bands both derived their fill by parsing a theme token inside StyleSheet.create: hexColorWithAlpha(theme.colors.statusWarning, 0.12) ?? theme.colors.surface1 theme.colors.* is a real value in React but not inside the stylesheet factory, so the regex never matched, the helper returned undefined, and the ?? silently painted bare surface1. The bands had no tint at any alpha. Fill now comes from status*Surface tokens passed straight through, with per-theme values (dark carries more alpha — the same wash that shouts on near-white barely registers on a dark surface). Adds a tone system so this stays fixed. Tones are named by color, not by meaning, because that is how they get asked for. A band picks orange, red, blue, green, or purple; every theme supplies its own calibrated value. The fly-out geometry moves into a reusable FlyoutBand so callers own only when to show it and what it says, never a color value. Drops the hardcoded #f59e0b / #ef4444 the warning icons used in both light and dark mode. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
macOS builds ship unsigned, so no latest-mac.yml is published. The updater had no darwin gate, so a mac install asked GitHub for that manifest, 404'd, and held a permanent update error. Publishing the manifest would not have fixed it. arm64 gets an ad-hoc signature (arm64 macOS refuses to execute a wholly unsigned binary) and x64 gets none at all; an ad-hoc signature's designated requirement comes from the cdhash and changes every build, so Squirrel.Mac can never validate a replacement bundle. A manifest would only buy a download that then fails to install. So darwin gets a notify-only runtime instead: it reads the releases API directly, honours the channel and the rollout gate, refuses to offer a downgrade, and skips a release whose mac artifact is missing (the mac jobs can land after a release publishes, and a failed mac build has nothing to download). "Update now" opens the download page, where the Gatekeeper instructions live, and reports installed:false rather than claiming a restart that isn't coming. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Since the unsigned mac jobs landed, every release carries
Otto-<version>-{arm64,x64}-unsigned.dmg — while the download page went on
saying macOS builds aren't offered because there's no Mac dev environment.
The page now lists both arches and, more importantly, says what an unsigned
build does on first launch: Gatekeeper reports a quarantined unsigned app as
*damaged* rather than showing the usual unidentified-developer prompt, so
without the right-click-Open and xattr instructions the download reads as
broken. It also states that these builds don't auto-update.
Mac assets stay optional throughout. The mac jobs can finish after a release
publishes, and finalize-rollout tolerates a failed mac build so Windows and
Linux still ship — requiring a mac asset would pin the site to an older
release whenever mac alone fails. Missing assets degrade to no mac links.
The hero button sends mac visitors to the download page rather than straight
at a .dmg: the instructions have to be in view, and arch detection is a
guess. navigator.platform reports MacIntel on Apple Silicon too, so only
Chromium's userAgentData can identify Intel; everything else defaults to
Silicon. That ternary previously returned the same value on both branches.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
… help dialog The sidebar/explorer toggle tooltips and the keyboard shortcuts dialog rendered hardcoded default key combos, so any user remap made them advertise a binding that no longer fires. They now resolve through `useShortcutKeys` / `getBindingIdForAction` + the override store, and render nothing when an action has no binding on the current platform. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Outbound links now land in an Otto browser tab in the current workspace instead of handing off to the system browser. The `linkOpenBehavior` setting still offers "external", and the existing fallbacks (non-http schemes, no pane available) are unchanged. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Voice cues are part of the intended Visualizer experience, and the Visualizer's existing sound mute already silences them, so defaulting them off just hid the feature. Flips `visualizerVoiceCues` to true and updates docs/visualizer.md. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
A research-heavy agentic task in the default suite: a self-contained orderkit codebase (bench/corpus.ts, 10 interlinked Python + markdown files) whose pricing bug can only be fixed correctly by finding and reading docs/SPEC.md - the two load-bearing rules (discounts apply to the original subtotal; combined discount capped at 50%) live only in the docs, not the code. The model explores with read/list/search/find tools (docs read-only, tests hidden), fixes pricing.py, and is scored on a hidden 6-test oracle via the real interpreter, with peak context utilization surfaced. Verified graduated: buggy 2/6, code-only fix 3/6, spec-driven fix 6/6; the summary flags "missed the spec" and how much context was held. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Chatting on Android went laggy as a transcript grew: typing stuttered, the frame rate dropped, and the device heated up. All of it was JS-thread cost that scaled with transcript length, which is why a fresh chat felt fast. Native, where FlatList owns the mounted window: - The live turn renders in the inverted list's ListHeaderComponent, so every ~48ms stream flush changed a FlatList prop, re-rendered VirtualizedList and walked every mounted cell. The header node now publishes through an external store read by a stable component, and the FlatList element is memoized, so a flush re-renders only the live turn. History spacing depends on live-head presence but not its text, so the live head's ids ride along as extraData. - Virtualizer config was desktop-sized: windowSize 21 to 7, initialNumToRender 40 to 12, maxToRenderPerBatch 40 to 10, updateCellsBatchingPeriod 0 to 50. removeClippedSubviews stays false on purpose: the biggest remaining Android lever, but a known blank-cell source on inverted lists. Needs on-device proof. Mobile web had the opposite problem. The history split was gated on !isMobileBreakpoint, so a phone browser mounted the entire transcript with no fallback virtualizer at all. The gate is now platform === "web" alone, with a mounted window of 8 against desktop's 12. Native stays excluded from that split by design, and the tests now pin it: strategy-native merges both segments back into one data array and renders every row the same way, so splitting there buys nothing and double-virtualizing would wreck height measurement. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Snapshot of work that was already in the tree, committed at the user's request alongside the mobile streaming perf fix. Not authored or verified in this session; grouped separately so it can be reverted on its own. Covers the observed-backgrounded subagent path across protocol, agent-manager, projections and the Claude provider, desktop browser shortcut forwarding, and in-progress composer track/seam work. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
The seam shadow stopped at the front card's top edge, but the front card has rounded top corners: where the curve cuts in it paints nothing, so the tucked bottom strip of the card behind showed through in two corner notches at the far left and right. Unshaded, those read as bright nicks in the seam. Run the strip down to the card's own bottom edge instead, holding full strength through the tucked remainder so the notches match the darkest point of the falloff with no visible band boundary. The stops are computed from the depth and the tuck rather than hardcoded, and the tuck now reads SPACING[4] directly instead of a duplicated 16. Anchor the strip to ChatWidthBounds rather than the surface. An absolutely-positioned child anchors to the padding box, inside the surface's 1px border, and the expandable surfaces clip to that same box with overflow: hidden -- either way the taller strip would stop short of the card's real edges. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
…epo flow Phase 1 of making the long-horizon eval actually long. The synthetic extra-long-horizon corpus (~8-10K tokens) only pushed held context to 1-2% on a large window, so a model could "crush" it without ingesting much. Bench fidelity: - New context-stress task (bench/context-corpus.ts + contextStressTask, in the default TASKS, weight 4): a staged pipeline of N passthrough placeholder modules whose per-stage rules live ONLY in a spec generated to ~55% of the served context window (contextWindow threaded through). The correct rule is nowhere in the code, so a model cannot score without holding the spec -- the >=50%-held guarantee is by construction. Hidden per-stage oracle via the real interpreter; deterministic, bounded mod 1000 so JS expectations match Python. - long-horizon now also reports held context. - Curated mined-repo flow: curated-repos.ts presets + `otto brain bench --curated <name>` (requires an explicit --repo-dir; the working copy is reset hard, never the live checkout). Repo.test() gains a files filter and the oracle runs are scoped to the mined test paths, so a repo task no longer runs the whole workspace suite. Reporting/TUI (scorecard audit): - HTML report: score bars are one hue with direct per-task labels + weights and a weighted Overall row, fixing the palette-overflow that hid later tasks (extra-long-horizon) and never explaining the weighted mean. - TUI: Configuration and Benchmark panels share one width; a context-held block surfaces per-task utilization on the scorecard. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Connectors for the user-mode initiative: a provider-neutral way to attach packaged MCP servers / data sources and fan them out to every provider (data in, deliverables out). - app: Settings connectors UI (connectors-section.tsx, connectors-config.ts) and host-page wiring. - server: connectors/connector-tools.ts, session + bootstrap + websocket-server hooks, provider-registry / provider-snapshot-manager, openai-compat agent/mcp wiring to expose connector tools, and daemon.connectors persistence. - protocol: connector message + provider-config schema additions, plus the backgrounded agent-snapshot field (COMPAT(backgroundedObservedSubagents)) that the already-committed observed-backgrounded consumer needs. All optional / back-compatible. - client: daemon-client connector RPCs. - docs: projects/user-mode/user-mode.md charter + README ledger row. Also: split mergeMutableConfigIntoPersistedConfig into resolveNextAgents + buildPersistedDaemonSection to stay under the cyclomatic-complexity limit after the connectors branch, and rebuilt stale protocol/client declarations so the whole workspace typechecks clean. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Three test files pinned config-schema defaults with an exact toEqual and drifted when agentBehaviors gained todoNudge and todoReconcileOnIdle (and, for the client, when the brain config block landed): - client index.test.ts: the config.get / config.patch assertions - server agent-manager.test.ts: the three launch-context assertions, which is the server-tests failure on both Windows and Ubuntu Each file carried the same literal two to four times, so one new config key broke CI in nine places. Fold each file's copies into one shared constant. The strict toEqual stays on purpose: the protocol contract requires every new config field to ship a default, and this assertion failing when someone adds one is the check working. provider-icon-name.test.ts asserted that every ACP catalog entry with an icon appears in the protocol icon registry. otto-brain ships an icon but is deliberately NOT in that registry -- provider-icons.ts resolves it through an app-local map it consults first. Putting it in the protocol registry would be wrong twice over: it is Otto's own host rather than an ACP provider, and guessTerminalProfileIcon would then match a command named "otto-brain". Assert the real invariant against getProviderIcon instead -- a catalog entry with an icon never falls back to the generic bot -- which covers both routes. Docker never packed @otto-code/brain, but both @otto-code/server and @otto-code/cli depend on it, so the global install fell through to the public registry and 404'd on an unpublished package. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Add a static, mode-tagged connector catalog (~50 entries, audience user|developer so User Mode never shows engineering connectors) and a "Browse connectors" picker that pre-fills the Add form, including a token field injected as a stdio env var or an Authorization: Bearer header. Templates and credential env vars are starting points to verify against each connector's official MCP docs, not asserted live values. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
When a Codex turn finalized one assistant message and opened another, the provider prepended "\n\n---\n\n" to the next message's first delta. That rendered as a full-width horizontal rule inside the bubble, and because it lived in the model's text it followed the reply into copies and retained transcripts. reduceFinalText had to strip it back out, which is the tell that it was only ever meant to be visual. The separation it was drawing already exists: a second Codex item carries a different messageId, so appendAssistantMessage starts a fresh stream row, the block groups differ, and spacing.ts falls through to the normal SPACING[4] inter-bubble gap. The rule was a second, louder separator on top of one that was already working. Removes the constant, the pendingAssistantMessageBoundary flag and its three arming sites, and the strip-back in reduceFinalText. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
The provider-neutral connectors layer added a `connectors: []` default to the daemon config, so the client config-get/patch assertion drifted again. One line now that the filled defaults are a shared constant. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Brain: - bench: parse the test verdict from unittest STDERR with the OK/FAILED status anchored to the end, so a solution that prints "OK" to stdout can no longer spoof a passing score (+ regression tests) - lifecycle: `otto brain start`/`restart` reconstruct the full sub-command path so the detached child runs `otto brain serve`, not the non-existent `otto serve` - serve: mask hfToken in /__host/config; serialize model switches so a config-driven switch can't overlap a request-driven one - download: reject/contain path-traversal in HF-provided file paths - runtime: escape single quotes for PowerShell Expand-Archive (apostrophe paths) - bench: size max_tokens for unrestricted (-1) reasoning; tighten the context-limit classifier; glob-match find_files so `**/*.py` finds files - tui: stop the health sampler in a finally so a failed bench can't leak it Server: - brain-ops: `--` before positionals, reject empty repo/quant (silent no-op), ignore progress on a terminal (canceled) job - todo-reminders: strip only Otto's own nudge, not any trailing <system-reminder> a user message may contain (+ regression tests) - connectors: emit an error response if list_tools' close() rejects App: - brain models: latest-wins guards on search / quant-list races - composer "Send all": exclude system-injected entries and attachment-unbacked entries from the merged user turn (adds queue `source` to the projection) - connectors: fetch tools outside the setState updater Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
…atalog 15 new User-audience entries across new categories: Office documents (PowerPoint via Microsoft 365; Pages and PDF as local document tools), Ecommerce (Shopify), Marketing & SEO (Ahrefs, Google Search Console, Google Business Profile), Advertising (Google Ads, Meta Ads, TikTok Ads, Pinterest Ads, Reddit Ads, StackAdapt), Social (Meta Business pages); ClickUp joins Calendar & tasks. Native PowerPoint/Pages/PDF export remains User Mode charter work, separate from these read/write connectors. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
LinkedIn Ads and Microsoft Advertising under Advertising; LinkedIn Pages (organic) under Social. All User audience. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
The actions in .github/workflows/ had drifted up to three majors behind, and the only signal was a Node 20 deprecation annotation buried in every run log. Nothing was watching: Dependabot alerts and security updates were both off. Actions bumped to their latest majors: checkout v5/v6 -> v7, setup-node v4 -> v7, upload-artifact v4 -> v7, download-artifact v4 -> v8, setup-dotnet v4 -> v6, setup-java v4 -> v5, expo-github-action v8 -> v9. The docker/* actions and install-nix-action were already current. Three of those majors carry real breaking changes, none of which apply here: setup-node v5 auto-caches only when package.json has a packageManager field (we have none, and 24 of 25 call sites already pin cache: npm); checkout v7 blocks fork-PR checkout under pull_request_target/workflow_run (we use neither); download-artifact v5 changed output paths for single downloads by ID (all three call sites use name/pattern). download-artifact v8 also promotes a digest mismatch from warning to error, which is a correctness win worth taking. gradle/actions is held at v5 deliberately, not v6. v6 moves caching into gradle-actions-caching, a proprietary component under Gradle's commercial Terms of Use. v5 is Node 24 native and clears the deprecation without accepting those terms. Node 22 -> 24.18.1 (Active LTS, EOL 2028-04-30). Node 22 has entered maintenance and is security-only until 2027-04-30. Node 26 does not become LTS until 2026-10-28 and 27 is Current, so neither is a candidate yet. The version was pinned in six places that all had to move together: the workflow matrix, .tool-versions, the Docker base image, flake.nix, and both nix/*.nix packages. @types/node is left alone. It is inconsistent across packages (^20.9.0 in five, 24.6.0 in desktop, ^22.15.29 in website) and aligning it would surface fresh type errors, so it belongs in its own change. Adds .github/dependabot.yml for the github-actions ecosystem, grouped weekly with majors broken out. npm is covered by Dependabot security updates instead (a repository setting, now enabled) rather than routine version-bump PRs. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
dependabot
Bot
added
dependencies
…apps Enabling Dependabot alerts surfaced a backlog nothing had been watching. The headline count of 389 was inflated: npm's own resolver finds 82 real advisories, and 258 of the 389 rows came from packages/expo-two-way-audio and its two example apps, each carrying a separately-counted lockfile. Critical advisories go 7 -> 0. Fixed outright: tar, shell-quote, @vitest/browser, @xmldom/xmldom, node-forge, tmp, and vite. npm audit fix is unusable in this repo. It fails with an ERESOLVE conflict, trying to resolve expo down to 40.0.1 to satisfy expo-clipboard's expo@"*" peer. Its suggested fixes are also unreliable: it proposed "upgrading" eas-cli to 0.52.0, which is a downgrade from the installed 16.24.1. Fixes here are therefore explicit range bumps plus overrides. Direct dependency bumps: eas-cli 16.24.1 -> 21.4.0, markdown-it 10 -> 15, sharp 0.34.5 -> 0.35.3, @vitest/browser -> 4.1.8, undici -> 7.28.0, vite -> 7.3.5, js-yaml -> 4.3.0, and ws -> 8.21.0 across all six packages that declare it. Root-level overrides pin the transitive offenders; js-yaml and ws use npm's $name syntax because a literal override on a root direct dependency is an EOVERRIDE error. Removes packages/expo-two-way-audio/examples. Both apps sat on Expo 52 / RN 0.76 while the app is on Expo 54 / RN 0.81, nothing referenced or built them, and npm workspaces never installed them. They contributed 174 alert rows purely through stale lockfiles. Verified: typecheck passes across all packages, and the markdown-it dependent suites (mermaid pipeline, mermaid document, task lists) pass on markdown-it 15. Known gap: eas-cli is only exercised by the android and ios release workflows, which are manually dispatched, so CI does not cover the 16 -> 21 jump. Dry-run those before the next mobile release. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
6477d0e regenerated package-lock.json from scratch on Windows, which silently dropped every platform-specific optional dependency for Linux and macOS: 137 platform entries fell to 86, losing all lightningcss, @esbuild, and related native binaries for non-Windows targets. That is the 41441 -> 34375 line drop in that commit, which looked like the removed example apps but was not. Two workflows broke as a result. Deploy Website failed with "Cannot find module '../lightningcss.linux-x64-gnu.node'" while building on Linux, and Nix Update Hash failed with ENOTCACHED because the prefetched npm deps no longer matched the lockfile. This restores the lockfile as npm generated it via --package-lock-only, which preserves entries for all platforms rather than only the host's. The dependency changes from 6477d0e are unaffected: criticals remain at 0 and npm ci --dry-run resolves clean. Lesson for future dependency work in this repo: never delete package-lock.json to force re-resolution. Use --package-lock-only, which is platform-preserving, and accept that some overrides will not bind rather than reaching for a full regeneration. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
v6 moves caching into gradle-actions-caching, a proprietary component under Gradle's commercial Terms of Use. We deliberately hold at v5, which is Node 24 native and clears the deprecation while staying MIT. Without this rule Dependabot re-opens the same PR every week (it already opened #9). Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Bumps the actions-minor group with 1 update in the / directory: [docker/login-action](https://github.com/docker/login-action). Updates `docker/login-action` from 4 to 4.5.2 - [Release notes](https://github.com/docker/login-action/releases) - [Commits](docker/login-action@v4...v4.5.2) --- updated-dependencies: - dependency-name: docker/login-action dependency-version: 4.5.2 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: actions-minor ... Signed-off-by: dependabot[bot] <support@github.com>
dependabot
Bot
changed the title
dependabot
Bot
force-pushed
the
dependabot/github_actions/actions-minor-85123b4e12
branch
from
July 31, 2026 19:15
ac89cbd to
11118b4
Compare
Author
|
Looks like docker/login-action is updatable in another way, so this is no longer needed. |
dependabot
Bot
deleted the
dependabot/github_actions/actions-minor-85123b4e12
branch
August 1, 2026 21:25
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Bumps the actions-minor group with 1 update in the / directory: docker/login-action.
Updates
docker/login-actionfrom 4 to 4.5.2Release notes
Sourced from docker/login-action's releases.
... (truncated)
Commits
a5e9150Merge pull request #1048 from docker/dockerhub-oidc-supporta482ba4build(deps): bump the codeql-actions group with 2 updates9e3d36echore: update generated content14d6a79docker hub oidc support03c8510Merge pull request #1044 from docker/dependabot/npm_and_yarn/docker/actions-t...ad8a81fMerge pull request #1046 from docker/dependabot/npm_and_yarn/brace-expansion-...6d219a4[dependabot skip] chore: update generated contentb320069build(deps): bump@docker/actions-toolkitfrom 0.92.0 to 0.93.008d3680[dependabot skip] chore: update generated content381f5a4Merge pull request #1042 from docker/dependabot/github_actions/codeql-actions...