From 0b7bdd4189350db8a46f0d6a972fc371b7d64dac Mon Sep 17 00:00:00 2001 From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com> Date: Sat, 19 Sep 2026 10:37:45 +0000 Subject: [PATCH 1/5] chore(deps): bump yaml from 2.9.0 to 2.9.1 Bumps [yaml](https://github.com/eemeli/yaml) from 2.9.0 to 2.9.1. - [Release notes](https://github.com/eemeli/yaml/releases) - [Commits](https://github.com/eemeli/yaml/compare/v2.9.0...v2.9.1) --- updated-dependencies: - dependency-name: yaml dependency-version: 2.9.1 dependency-type: direct:production update-type: version-update:semver-patch ... Signed-off-by: dependabot[bot] --- package-lock.json | 40 +++++++++++------------ src/packages/agent-runtime/package.json | 2 +- src/packages/core-domain/package.json | 2 +- src/packages/infra-providers/package.json | 2 +- src/packages/mcp-server/package.json | 2 +- src/sdk/cli/package.json | 2 +- 6 files changed, 25 insertions(+), 25 deletions(-) diff --git a/package-lock.json b/package-lock.json index e57a84f7e..90cf5036b 100644 --- a/package-lock.json +++ b/package-lock.json @@ -16514,7 +16514,7 @@ "license": "MIT", "dependencies": { "@beyondnet/evolith-core-domain": "^1.3.0", - "yaml": "2.9.0" + "yaml": "^2.9.1" }, "devDependencies": { "@types/jest": "30.0.0", @@ -16543,9 +16543,9 @@ } }, "src/packages/agent-runtime/node_modules/yaml": { - "version": "2.9.0", - "resolved": "https://registry.npmjs.org/yaml/-/yaml-2.9.0.tgz", - "integrity": "sha512-2AvhNX3mb8zd6Zy7INTtSpl1F15HW6Wnqj0srWlkKLcpYl/gMIMJiyuGq2KeI2YFxUPjdlB+3Lc10seMLtL4cA==", + "version": "2.9.1", + "resolved": "https://registry.npmjs.org/yaml/-/yaml-2.9.1.tgz", + "integrity": "sha512-3NxN8+78OdzbT7C/WjGsyfPAtJaN3FNDsWxv7Y7mcDsT/oOmgW8BpyQQFFBnvZE3j9Y2Sdz1ULFLezL7Eb2yFw==", "license": "ISC", "bin": { "yaml": "bin.mjs" @@ -16604,7 +16604,7 @@ "ajv": "8.20.0", "ajv-formats": "3.0.1", "typescript": "6.0.3", - "yaml": "2.9.0", + "yaml": "^2.9.1", "zod": "4.4.3" }, "devDependencies": { @@ -16815,9 +16815,9 @@ } }, "src/packages/core-domain/node_modules/yaml": { - "version": "2.9.0", - "resolved": "https://registry.npmjs.org/yaml/-/yaml-2.9.0.tgz", - "integrity": "sha512-2AvhNX3mb8zd6Zy7INTtSpl1F15HW6Wnqj0srWlkKLcpYl/gMIMJiyuGq2KeI2YFxUPjdlB+3Lc10seMLtL4cA==", + "version": "2.9.1", + "resolved": "https://registry.npmjs.org/yaml/-/yaml-2.9.1.tgz", + "integrity": "sha512-3NxN8+78OdzbT7C/WjGsyfPAtJaN3FNDsWxv7Y7mcDsT/oOmgW8BpyQQFFBnvZE3j9Y2Sdz1ULFLezL7Eb2yFw==", "license": "ISC", "bin": { "yaml": "bin.mjs" @@ -16850,7 +16850,7 @@ "ajv": "8.20.0", "ajv-formats": "3.0.1", "fs-extra": "10.1.0", - "yaml": "2.9.0" + "yaml": "^2.9.1" }, "devDependencies": { "@types/fs-extra": "11.0.4", @@ -16872,9 +16872,9 @@ } }, "src/packages/infra-providers/node_modules/yaml": { - "version": "2.9.0", - "resolved": "https://registry.npmjs.org/yaml/-/yaml-2.9.0.tgz", - "integrity": "sha512-2AvhNX3mb8zd6Zy7INTtSpl1F15HW6Wnqj0srWlkKLcpYl/gMIMJiyuGq2KeI2YFxUPjdlB+3Lc10seMLtL4cA==", + "version": "2.9.1", + "resolved": "https://registry.npmjs.org/yaml/-/yaml-2.9.1.tgz", + "integrity": "sha512-3NxN8+78OdzbT7C/WjGsyfPAtJaN3FNDsWxv7Y7mcDsT/oOmgW8BpyQQFFBnvZE3j9Y2Sdz1ULFLezL7Eb2yFw==", "license": "ISC", "bin": { "yaml": "bin.mjs" @@ -16917,7 +16917,7 @@ "prom-client": "15.1.3", "reflect-metadata": "0.2.2", "rxjs": "7.8.2", - "yaml": "2.9.0" + "yaml": "^2.9.1" }, "bin": { "evolith-mcp": "dist/main.js" @@ -17251,9 +17251,9 @@ } }, "src/packages/mcp-server/node_modules/yaml": { - "version": "2.9.0", - "resolved": "https://registry.npmjs.org/yaml/-/yaml-2.9.0.tgz", - "integrity": "sha512-2AvhNX3mb8zd6Zy7INTtSpl1F15HW6Wnqj0srWlkKLcpYl/gMIMJiyuGq2KeI2YFxUPjdlB+3Lc10seMLtL4cA==", + "version": "2.9.1", + "resolved": "https://registry.npmjs.org/yaml/-/yaml-2.9.1.tgz", + "integrity": "sha512-3NxN8+78OdzbT7C/WjGsyfPAtJaN3FNDsWxv7Y7mcDsT/oOmgW8BpyQQFFBnvZE3j9Y2Sdz1ULFLezL7Eb2yFw==", "license": "ISC", "bin": { "yaml": "bin.mjs" @@ -17348,7 +17348,7 @@ "inherits": "2.0.4", "nest-commander": "3.20.1", "path-to-regexp": "8.4.2", - "yaml": "2.9.0" + "yaml": "^2.9.1" }, "bin": { "evolith": "dist/main.js", @@ -17779,9 +17779,9 @@ } }, "src/sdk/cli/node_modules/yaml": { - "version": "2.9.0", - "resolved": "https://registry.npmjs.org/yaml/-/yaml-2.9.0.tgz", - "integrity": "sha512-2AvhNX3mb8zd6Zy7INTtSpl1F15HW6Wnqj0srWlkKLcpYl/gMIMJiyuGq2KeI2YFxUPjdlB+3Lc10seMLtL4cA==", + "version": "2.9.1", + "resolved": "https://registry.npmjs.org/yaml/-/yaml-2.9.1.tgz", + "integrity": "sha512-3NxN8+78OdzbT7C/WjGsyfPAtJaN3FNDsWxv7Y7mcDsT/oOmgW8BpyQQFFBnvZE3j9Y2Sdz1ULFLezL7Eb2yFw==", "license": "ISC", "bin": { "yaml": "bin.mjs" diff --git a/src/packages/agent-runtime/package.json b/src/packages/agent-runtime/package.json index c5409b13a..1032db678 100644 --- a/src/packages/agent-runtime/package.json +++ b/src/packages/agent-runtime/package.json @@ -44,7 +44,7 @@ }, "dependencies": { "@beyondnet/evolith-core-domain": "^1.3.0", - "yaml": "2.9.0" + "yaml": "2.9.1" }, "devDependencies": { "@types/jest": "30.0.0", diff --git a/src/packages/core-domain/package.json b/src/packages/core-domain/package.json index b59e607e0..7e92579d4 100644 --- a/src/packages/core-domain/package.json +++ b/src/packages/core-domain/package.json @@ -106,7 +106,7 @@ "ajv": "8.20.0", "ajv-formats": "3.0.1", "typescript": "6.0.3", - "yaml": "2.9.0", + "yaml": "2.9.1", "zod": "4.4.3" }, "peerDependencies": { diff --git a/src/packages/infra-providers/package.json b/src/packages/infra-providers/package.json index 6aba6d97a..f4ce59493 100644 --- a/src/packages/infra-providers/package.json +++ b/src/packages/infra-providers/package.json @@ -33,7 +33,7 @@ "ajv": "8.20.0", "ajv-formats": "3.0.1", "fs-extra": "10.1.0", - "yaml": "2.9.0" + "yaml": "2.9.1" }, "devDependencies": { "@types/fs-extra": "11.0.4", diff --git a/src/packages/mcp-server/package.json b/src/packages/mcp-server/package.json index 3a504987a..30cc27444 100644 --- a/src/packages/mcp-server/package.json +++ b/src/packages/mcp-server/package.json @@ -68,7 +68,7 @@ "prom-client": "15.1.3", "reflect-metadata": "0.2.2", "rxjs": "7.8.2", - "yaml": "2.9.0" + "yaml": "2.9.1" }, "devDependencies": { "@nestjs/cli": "11.0.24", diff --git a/src/sdk/cli/package.json b/src/sdk/cli/package.json index b88d8a789..4cb8c688a 100644 --- a/src/sdk/cli/package.json +++ b/src/sdk/cli/package.json @@ -94,7 +94,7 @@ "inherits": "2.0.4", "nest-commander": "3.20.1", "path-to-regexp": "8.4.2", - "yaml": "2.9.0" + "yaml": "2.9.1" }, "devDependencies": { "@nestjs/testing": "11.1.28", From ae4288b858e3f31a6a942923a44cd5974cfb8604 Mon Sep 17 00:00:00 2001 From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com> Date: Sat, 19 Sep 2026 10:38:13 +0000 Subject: [PATCH 2/5] chore(deps): bump docker/metadata-action from 5.10.0 to 6.2.0 Bumps [docker/metadata-action](https://github.com/docker/metadata-action) from 5.10.0 to 6.2.0. - [Release notes](https://github.com/docker/metadata-action/releases) - [Commits](https://github.com/docker/metadata-action/compare/c299e40c65443455700f0fdfc63efafe5b349051...dc802804100637a589fabce1cb79ff13a1411302) --- updated-dependencies: - dependency-name: docker/metadata-action dependency-version: 6.2.0 dependency-type: direct:production update-type: version-update:semver-major ... Signed-off-by: dependabot[bot] --- .github/workflows/docker-images.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.github/workflows/docker-images.yml b/.github/workflows/docker-images.yml index 257c6ec78..c81a497c2 100644 --- a/.github/workflows/docker-images.yml +++ b/.github/workflows/docker-images.yml @@ -48,7 +48,7 @@ jobs: - name: Compute tags id: meta - uses: docker/metadata-action@c299e40c65443455700f0fdfc63efafe5b349051 # v5.10.0 + uses: docker/metadata-action@dc802804100637a589fabce1cb79ff13a1411302 # v6.2.0 with: images: ghcr.io/${{ github.repository_owner }}/${{ matrix.name }} # `type=ref,event=tag` publishes the git tag VERBATIM — `v1.1.0`, with From e042782eb4c6068ac0a3d20922e547ef4e38d3dd Mon Sep 17 00:00:00 2001 From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com> Date: Sat, 19 Sep 2026 10:39:16 +0000 Subject: [PATCH 3/5] chore(deps): bump actions/github-script from 7.1.0 to 9.0.0 Bumps [actions/github-script](https://github.com/actions/github-script) from 7.1.0 to 9.0.0. - [Release notes](https://github.com/actions/github-script/releases) - [Commits](https://github.com/actions/github-script/compare/v7.1.0...3a2844b7e9c422d3c10d287c895573f7108da1b3) --- updated-dependencies: - dependency-name: actions/github-script dependency-version: 9.0.0 dependency-type: direct:production update-type: version-update:semver-major ... Signed-off-by: dependabot[bot] --- .github/workflows/published-canary.yml | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/.github/workflows/published-canary.yml b/.github/workflows/published-canary.yml index d86e6021c..2ed84f3c0 100644 --- a/.github/workflows/published-canary.yml +++ b/.github/workflows/published-canary.yml @@ -67,7 +67,7 @@ jobs: # duplicated, so a week of red is one thread and not seven. - name: Open or update the canary issue if: failure() && github.event_name == 'schedule' - uses: actions/github-script@f28e40c7f34bde8b3046d885e986cb6290c5673b # v7.1.0 + uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0 with: script: | const fs = require('fs'); @@ -106,7 +106,7 @@ jobs: # healthy again the thread says so and closes itself. - name: Close the canary issue when the registry is healthy again if: success() && github.event_name == 'schedule' - uses: actions/github-script@f28e40c7f34bde8b3046d885e986cb6290c5673b # v7.1.0 + uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0 with: script: | const existing = await github.rest.issues.listForRepo({ From ee248427ed5b674a3d76154ecf42bb6521582edc Mon Sep 17 00:00:00 2001 From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com> Date: Sat, 19 Sep 2026 10:39:25 +0000 Subject: [PATCH 4/5] chore(deps): bump docker/build-push-action from 6.19.2 to 7.4.0 Bumps [docker/build-push-action](https://github.com/docker/build-push-action) from 6.19.2 to 7.4.0. - [Release notes](https://github.com/docker/build-push-action/releases) - [Commits](https://github.com/docker/build-push-action/compare/v6.19.2...c3c9e263c25d99ce0380d002d59b67737d91b0dc) --- updated-dependencies: - dependency-name: docker/build-push-action dependency-version: 7.4.0 dependency-type: direct:production update-type: version-update:semver-major ... Signed-off-by: dependabot[bot] --- .github/workflows/ci-cd.yml | 2 +- .github/workflows/docker-images.yml | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/.github/workflows/ci-cd.yml b/.github/workflows/ci-cd.yml index 7a0b52351..ade1d16fd 100644 --- a/.github/workflows/ci-cd.yml +++ b/.github/workflows/ci-cd.yml @@ -918,7 +918,7 @@ jobs: password: ${{ secrets.GITHUB_TOKEN }} - name: Build ${{ matrix.service }} (push only from main/tags) - uses: docker/build-push-action@53b7df96c91f9c12dcc8a07bcb9ccacbed38856a # v7.3.0 + uses: docker/build-push-action@c3c9e263c25d99ce0380d002d59b67737d91b0dc # v7.4.0 with: context: ${{ matrix.context }} file: ${{ matrix.dockerfile }} diff --git a/.github/workflows/docker-images.yml b/.github/workflows/docker-images.yml index 257c6ec78..3a670d1fe 100644 --- a/.github/workflows/docker-images.yml +++ b/.github/workflows/docker-images.yml @@ -70,7 +70,7 @@ jobs: uses: docker/setup-buildx-action@8d2750c68a42422c14e847fe6c8ac0403b4cbd6f # v3.12.0 - name: Build and push - uses: docker/build-push-action@10e90e3645eae34f1e60eeb005ba3a3d33f178e8 # v6.19.2 + uses: docker/build-push-action@c3c9e263c25d99ce0380d002d59b67737d91b0dc # v7.4.0 with: # Build context is the repository root for all services (the Dockerfiles # COPY repo-relative paths; agent-runtime builds the workspace packages). From af7484cd49be1f0c3d269faccab635d91c0dc67c Mon Sep 17 00:00:00 2001 From: aarroyo Date: Sat, 19 Sep 2026 06:46:20 -0500 Subject: [PATCH 5/5] chore(deps): quitar passport-custom muerto, subir codeql-action en bloque y afinar dependabot MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Segunda tanda del triaje de PRs de Dependabot (2026-09-19), la que abrió el propio cambio de dependabot.yml de #723: - `passport-custom` estaba declarado en `src/apps/core-api` sin un solo import de passport, passport-custom ni @nestjs/passport en todo `src/`. #728 proponía subirlo; lo correcto es quitarlo. - `github/codeql-action/{init,autobuild,analyze,upload-sarif}` pasan de 4.37.9 a 4.38.0 a la vez (hash b96794f0, el del tag v4.38.0). Dependabot los proponía por separado (#731 analyze, #733 init) y cada PR moría en CodeQL SAST con «Loaded a configuration file for version '4.37.9', but running version '4.38.0'». Se agrupan `github/codeql-action*` en dependabot.yml para que la próxima vez venga en un PR. - `nestjs-pino` 5.x exige Node >= 22.12 y el repo corre en Node 20 por diseño (#727, cerrado); se ignoran sus majors como ya se hace con `@nestjs/*`. - De paso npm normaliza en el lock los rangos que Dependabot escribió con `^` para `yaml` y `@clack/prompts` en workspaces que los fijan exactos. Co-Authored-By: Claude Opus 5 --- .github/dependabot.yml | 11 ++++++++++ .github/workflows/openssf-scorecard.yml | 2 +- .github/workflows/sdk-cli-ci.yml | 8 +++---- package-lock.json | 29 +++++-------------------- src/apps/core-api/package.json | 1 - 5 files changed, 22 insertions(+), 29 deletions(-) diff --git a/.github/dependabot.yml b/.github/dependabot.yml index 1bf6c0b2f..4883b203e 100644 --- a/.github/dependabot.yml +++ b/.github/dependabot.yml @@ -9,8 +9,19 @@ updates: # Un major por paquete rompe los 5 workspaces (ver PRs #720 y #721, cerrados). - dependency-name: "@nestjs/*" update-types: ["version-update:semver-major"] + # nestjs-pino 5.x exige Node >= 22.12 y el repo corre en Node 20 por diseño + # (engines raíz `>=20 <21`, imágenes node:20-alpine). Es una migración de + # runtime, no un bump (ver PR #727, cerrado). + - dependency-name: "nestjs-pino" + update-types: ["version-update:semver-major"] - package-ecosystem: github-actions directory: / schedule: interval: monthly + groups: + # init, autobuild, analyze y upload-sarif tienen que moverse JUNTOS: analyze + # rechaza la configuración escrita por un init de otra versión (ver PRs #731 + # y #733, cerrados). Dependabot los trata como dependencias distintas. + codeql-action: + patterns: ["github/codeql-action*"] diff --git a/.github/workflows/openssf-scorecard.yml b/.github/workflows/openssf-scorecard.yml index bed418ef2..c337ad5bc 100644 --- a/.github/workflows/openssf-scorecard.yml +++ b/.github/workflows/openssf-scorecard.yml @@ -112,7 +112,7 @@ jobs: retention-days: 90 - name: Upload results to code scanning - uses: github/codeql-action/upload-sarif@cdf488f595d80d6e07e03d4674febd5ab45fa938 # v4.37.9 + uses: github/codeql-action/upload-sarif@b96794f015dfd88f77b49b1c93e0fa7110f94c63 # v4.38.0 with: sarif_file: scorecard-results.sarif diff --git a/.github/workflows/sdk-cli-ci.yml b/.github/workflows/sdk-cli-ci.yml index 387e69e10..ea7dad28a 100644 --- a/.github/workflows/sdk-cli-ci.yml +++ b/.github/workflows/sdk-cli-ci.yml @@ -421,16 +421,16 @@ jobs: uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 - name: Initialize CodeQL - uses: github/codeql-action/init@cdf488f595d80d6e07e03d4674febd5ab45fa938 # v4.37.9 + uses: github/codeql-action/init@b96794f015dfd88f77b49b1c93e0fa7110f94c63 # v4.38.0 with: languages: javascript-typescript queries: security-and-quality - name: Autobuild - uses: github/codeql-action/autobuild@cdf488f595d80d6e07e03d4674febd5ab45fa938 # v4.37.9 + uses: github/codeql-action/autobuild@b96794f015dfd88f77b49b1c93e0fa7110f94c63 # v4.38.0 - name: Perform CodeQL Analysis - uses: github/codeql-action/analyze@cdf488f595d80d6e07e03d4674febd5ab45fa938 # v4.37.9 + uses: github/codeql-action/analyze@b96794f015dfd88f77b49b1c93e0fa7110f94c63 # v4.38.0 with: category: "/language:javascript-typescript" @@ -457,7 +457,7 @@ jobs: severity: 'CRITICAL,HIGH' - name: Upload Trivy SARIF Report - uses: github/codeql-action/upload-sarif@cdf488f595d80d6e07e03d4674febd5ab45fa938 # v4.37.9 + uses: github/codeql-action/upload-sarif@b96794f015dfd88f77b49b1c93e0fa7110f94c63 # v4.38.0 if: always() with: sarif_file: 'trivy-results.sarif' diff --git a/package-lock.json b/package-lock.json index 03b8fba0b..99432b840 100644 --- a/package-lock.json +++ b/package-lock.json @@ -13747,22 +13747,6 @@ "node": ">= 0.8" } }, - "node_modules/passport-custom": { - "version": "1.1.1", - "license": "MIT", - "dependencies": { - "passport-strategy": "1.x.x" - }, - "engines": { - "node": ">= 0.10.0" - } - }, - "node_modules/passport-strategy": { - "version": "1.0.0", - "engines": { - "node": ">= 0.4.0" - } - }, "node_modules/path-exists": { "version": "4.0.0", "dev": true, @@ -16293,7 +16277,6 @@ "helmet": "8.2.0", "keyv": "5.6.0", "nestjs-pino": "4.6.1", - "passport-custom": "1.1.1", "pino": "10.3.1", "pino-http": "11.0.0", "prom-client": "15.1.3", @@ -16514,7 +16497,7 @@ "license": "MIT", "dependencies": { "@beyondnet/evolith-core-domain": "^1.3.0", - "yaml": "^2.9.1" + "yaml": "2.9.1" }, "devDependencies": { "@types/jest": "30.0.0", @@ -16604,7 +16587,7 @@ "ajv": "8.20.0", "ajv-formats": "3.0.1", "typescript": "6.0.3", - "yaml": "^2.9.1", + "yaml": "2.9.1", "zod": "4.4.3" }, "devDependencies": { @@ -16850,7 +16833,7 @@ "ajv": "8.20.0", "ajv-formats": "3.0.1", "fs-extra": "10.1.0", - "yaml": "^2.9.1" + "yaml": "2.9.1" }, "devDependencies": { "@types/fs-extra": "11.0.4", @@ -16917,7 +16900,7 @@ "prom-client": "15.1.3", "reflect-metadata": "0.2.2", "rxjs": "7.8.2", - "yaml": "^2.9.1" + "yaml": "2.9.1" }, "bin": { "evolith-mcp": "dist/main.js" @@ -17328,7 +17311,7 @@ "@beyondnet/evolith-core-domain": "1.3.2", "@beyondnet/evolith-infra-providers": "1.2.1", "@beyondnet/evolith-sdk": "2.0.0", - "@clack/prompts": "^1.8.1", + "@clack/prompts": "1.8.1", "@hono/node-server": "1.19.15", "@modelcontextprotocol/sdk": "1.29.0", "@nestjs/common": "11.2.1", @@ -17348,7 +17331,7 @@ "inherits": "2.0.4", "nest-commander": "3.20.1", "path-to-regexp": "8.4.2", - "yaml": "^2.9.1" + "yaml": "2.9.1" }, "bin": { "evolith": "dist/main.js", diff --git a/src/apps/core-api/package.json b/src/apps/core-api/package.json index cceaab328..d73ba2974 100644 --- a/src/apps/core-api/package.json +++ b/src/apps/core-api/package.json @@ -42,7 +42,6 @@ "helmet": "8.2.0", "keyv": "5.6.0", "nestjs-pino": "4.6.1", - "passport-custom": "1.1.1", "pino": "10.3.1", "pino-http": "11.0.0", "prom-client": "15.1.3",