Repository navigation
Conversation
Opt-in input that sets Playwright's ignoreHTTPSErrors on the browser context so the scanner can run against staging hosts with self-signed or invalid certs. Default off; behavior unchanged unless enabled. Closes #150 Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
…updates Bumps the github-actions group with 2 updates in the / directory: [actions/setup-node](https://github.com/actions/setup-node) and [ruby/setup-ruby](https://github.com/ruby/setup-ruby). Updates `actions/setup-node` from 7.0.0 to 7.1.0 - [Release notes](https://github.com/actions/setup-node/releases) - [Commits](actions/setup-node@8207627...949feb2) Updates `ruby/setup-ruby` from 1.327.0 to 1.328.0 - [Release notes](https://github.com/ruby/setup-ruby/releases) - [Changelog](https://github.com/ruby/setup-ruby/blob/master/release.rb) - [Commits](ruby/setup-ruby@1459426...e81a8fa) --- updated-dependencies: - dependency-name: actions/setup-node dependency-version: 7.1.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: github-actions - dependency-name: ruby/setup-ruby dependency-version: 1.328.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: github-actions ... Signed-off-by: dependabot[bot] <support@github.com>
…updates (#283) Bumps the github-actions group with 2 updates in the / directory: [actions/setup-node](https://github.com/actions/setup-node) and [ruby/setup-ruby](https://github.com/ruby/setup-ruby). Updates `actions/setup-node` from 7.0.0 to 7.1.0 <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/actions/setup-node/releases">actions/setup-node's releases</a>.</em></p> <blockquote> <h2>v7.1.0</h2> <h2>What's Changed</h2> <h3>Enhancements:</h3> <ul> <li>Add support for mise.toml file by <a href="https://github.com/gperdomor"><code>@gperdomor</code></a> in <a href="https://redirect.github.com/actions/setup-node/pull/1421">actions/setup-node#1421</a></li> <li>Support absolute paths in node-version-file by <a href="https://github.com/v-mahabaleshwars"><code>@v-mahabaleshwars</code></a> in <a href="https://redirect.github.com/actions/setup-node/pull/1633">actions/setup-node#1633</a></li> </ul> <h3>Bug fixes:</h3> <ul> <li>Add Node version validation and manifest fetch retry by <a href="https://github.com/v-jitenderpalsingh"><code>@v-jitenderpalsingh</code></a> in <a href="https://redirect.github.com/actions/setup-node/pull/1580">actions/setup-node#1580</a></li> </ul> <h3>Documentation updates:</h3> <ul> <li>README.md: bump actions/checkout to latest version 7 by <a href="https://github.com/deining"><code>@deining</code></a> in <a href="https://redirect.github.com/actions/setup-node/pull/1578">actions/setup-node#1578</a></li> <li>docs: add V7 ESM migration and NODE_AUTH_TOKEN behavior change by <a href="https://github.com/v-gowridurgad"><code>@v-gowridurgad</code></a> in <a href="https://redirect.github.com/actions/setup-node/pull/1593">actions/setup-node#1593</a></li> <li>Fixed cache recommendation syntax by <a href="https://github.com/SubJunk"><code>@SubJunk</code></a> in <a href="https://redirect.github.com/actions/setup-node/pull/1603">actions/setup-node#1603</a></li> </ul> <h3>Dependency updates:</h3> <ul> <li>Update workflow pins and migrate Node matrices to modern versions by <a href="https://github.com/v-HarithaVattikuti"><code>@v-HarithaVattikuti</code></a> in <a href="https://redirect.github.com/actions/setup-node/pull/1583">actions/setup-node#1583</a></li> <li>Upgrade <code>@actions/cache</code> to 6.2.0 by <a href="https://github.com/philip-gai"><code>@philip-gai</code></a> in <a href="https://redirect.github.com/actions/setup-node/pull/1584">actions/setup-node#1584</a></li> <li>Pin <code>@types/node</code> to v24 by <a href="https://github.com/v-priyagupta108"><code>@v-priyagupta108</code></a> in <a href="https://redirect.github.com/actions/setup-node/pull/1585">actions/setup-node#1585</a></li> <li>Override brace-expansion to 5.0.8 by <a href="https://github.com/v-priyagupta108"><code>@v-priyagupta108</code></a> with <a href="https://github.com/Copilot"><code>@Copilot</code></a> in <a href="https://redirect.github.com/actions/setup-node/pull/1599">actions/setup-node#1599</a></li> <li>Upgrade actions/checkout from 7.0.0 to 7.0.1 by <a href="https://github.com/dependabot"><code>@dependabot</code></a> in <a href="https://redirect.github.com/actions/setup-node/pull/1598">actions/setup-node#1598</a></li> <li>Upgrade prettier from 3.8.4 to 3.9.6 by <a href="https://github.com/dependabot"><code>@dependabot</code></a> in <a href="https://redirect.github.com/actions/setup-node/pull/1590">actions/setup-node#1590</a></li> <li>Upgrade <code>@vercel/ncc</code> from 0.44.0 to 0.45.0 by <a href="https://github.com/dependabot"><code>@dependabot</code></a> in <a href="https://redirect.github.com/actions/setup-node/pull/1610">actions/setup-node#1610</a></li> <li>Upgrade pnpm/action-setup from 6.0.9 to 6.0.10 by <a href="https://github.com/dependabot"><code>@dependabot</code></a> in <a href="https://redirect.github.com/actions/setup-node/pull/1602">actions/setup-node#1602</a></li> <li>Upgrade baseline-browser-mapping from 2.10.38 to 2.11.22 by <a href="https://github.com/dependabot"><code>@dependabot</code></a> in <a href="https://redirect.github.com/actions/setup-node/pull/1629">actions/setup-node#1629</a></li> <li>Upgrade <code>@types/semver</code> from 7.7.1 to 7.8.0 by <a href="https://github.com/dependabot"><code>@dependabot</code></a> in <a href="https://redirect.github.com/actions/setup-node/pull/1616">actions/setup-node#1616</a></li> <li>Upgrade <code>@typescript-eslint/parser</code> from 8.62.0 to 8.70.0 by <a href="https://github.com/dependabot"><code>@dependabot</code></a> in <a href="https://redirect.github.com/actions/setup-node/pull/1615">actions/setup-node#1615</a></li> <li>Upgrade pnpm/action-setup from 6.0.10 to 6.1.0 by <a href="https://github.com/dependabot"><code>@dependabot</code></a> in <a href="https://redirect.github.com/actions/setup-node/pull/1631">actions/setup-node#1631</a></li> <li>Upgrade jest-each from 30.4.1 to 30.5.2 by <a href="https://github.com/dependabot"><code>@dependabot</code></a> in <a href="https://redirect.github.com/actions/setup-node/pull/1636">actions/setup-node#1636</a></li> <li>Upgrade eslint-plugin-n from 18.1.0 to 18.3.0 by <a href="https://github.com/dependabot"><code>@dependabot</code></a> in <a href="https://redirect.github.com/actions/setup-node/pull/1638">actions/setup-node#1638</a></li> <li>Update dependencies and add license files by <a href="https://github.com/v-HarithaVattikuti"><code>@v-HarithaVattikuti</code></a> in <a href="https://redirect.github.com/actions/setup-node/pull/1642">actions/setup-node#1642</a></li> <li>Upgrade eslint from 10.5.0 to 10.11.0 and package.json from 7.0.0 to 7.1.0 by <a href="https://github.com/dependabot"><code>@dependabot</code></a> in <a href="https://redirect.github.com/actions/setup-node/pull/1635">actions/setup-node#1635</a></li> </ul> <h2>New Contributors</h2> <ul> <li><a href="https://github.com/v-jitenderpalsingh"><code>@v-jitenderpalsingh</code></a> made their first contribution in <a href="https://redirect.github.com/actions/setup-node/pull/1580">actions/setup-node#1580</a></li> <li><a href="https://github.com/philip-gai"><code>@philip-gai</code></a> made their first contribution in <a href="https://redirect.github.com/actions/setup-node/pull/1584">actions/setup-node#1584</a></li> <li><a href="https://github.com/gperdomor"><code>@gperdomor</code></a> made their first contribution in <a href="https://redirect.github.com/actions/setup-node/pull/1421">actions/setup-node#1421</a></li> <li><a href="https://github.com/SubJunk"><code>@SubJunk</code></a> made their first contribution in <a href="https://redirect.github.com/actions/setup-node/pull/1603">actions/setup-node#1603</a></li> </ul> <p><strong>Full Changelog</strong>: <a href="https://github.com/actions/setup-node/compare/v7.0.0...v7.1.0">https://github.com/actions/setup-node/compare/v7.0.0...v7.1.0</a></p> </blockquote> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/actions/setup-node/commit/949feb2413d6458794dcd2491c4babbbce0c15c1"><code>949feb2</code></a> Bump eslint from 10.5.0 to 10.11.0 and package.json from 7.0.0 to 7.1.0 (<a href="https://redirect.github.com/actions/setup-node/issues/1635">#1635</a>)</li> <li><a href="https://github.com/actions/setup-node/commit/7207c4f1189c7ee83ddf20c7c68bd1af6fdd751c"><code>7207c4f</code></a> chore: update dependencies and add license files (<a href="https://redirect.github.com/actions/setup-node/issues/1642">#1642</a>)</li> <li><a href="https://github.com/actions/setup-node/commit/54337e0d02de9202d0948aaff36ad556375497b9"><code>54337e0</code></a> Bump eslint-plugin-n from 18.1.0 to 18.3.0 (<a href="https://redirect.github.com/actions/setup-node/issues/1638">#1638</a>)</li> <li><a href="https://github.com/actions/setup-node/commit/fb54fa8c14c63410cc752f0ae3b7b3ca6af161fc"><code>fb54fa8</code></a> Bump jest-each from 30.4.1 to 30.5.2 (<a href="https://redirect.github.com/actions/setup-node/issues/1636">#1636</a>)</li> <li><a href="https://github.com/actions/setup-node/commit/7f84f1d52d0c56afb45c62fee31a93b843cea4d6"><code>7f84f1d</code></a> Bump pnpm/action-setup from 6.0.10 to 6.1.0 (<a href="https://redirect.github.com/actions/setup-node/issues/1631">#1631</a>)</li> <li><a href="https://github.com/actions/setup-node/commit/0c54c7b07420dcba69a7d832587f55ebdf771c9e"><code>0c54c7b</code></a> Bump <code>@typescript-eslint/parser</code> from 8.62.0 to 8.70.0 (<a href="https://redirect.github.com/actions/setup-node/issues/1615">#1615</a>)</li> <li><a href="https://github.com/actions/setup-node/commit/a8294190049a9c296f01b9a432aff41dd83d8284"><code>a829419</code></a> Bump <code>@types/semver</code> from 7.7.1 to 7.8.0 (<a href="https://redirect.github.com/actions/setup-node/issues/1616">#1616</a>)</li> <li><a href="https://github.com/actions/setup-node/commit/680d1e489b82f1243de15bc7665c0007e3c9a860"><code>680d1e4</code></a> Support absolute paths in node-version-file (<a href="https://redirect.github.com/actions/setup-node/issues/1633">#1633</a>)</li> <li><a href="https://github.com/actions/setup-node/commit/db0fb3a98ed314b69026b6e8c9be26a7e2fe65a8"><code>db0fb3a</code></a> Bump baseline-browser-mapping from 2.10.38 to 2.11.22 (<a href="https://redirect.github.com/actions/setup-node/issues/1629">#1629</a>)</li> <li><a href="https://github.com/actions/setup-node/commit/94196ee1d15439c1b6651cd87ef14e88ec435966"><code>94196ee</code></a> Bump pnpm/action-setup from 6.0.9 to 6.0.10 (<a href="https://redirect.github.com/actions/setup-node/issues/1602">#1602</a>)</li> <li>Additional commits viewable in <a href="https://github.com/actions/setup-node/compare/820762786026740c76f36085b0efc47a31fe5020...949feb2413d6458794dcd2491c4babbbce0c15c1">compare view</a></li> </ul> </details> <br /> Updates `ruby/setup-ruby` from 1.327.0 to 1.328.0 <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/ruby/setup-ruby/releases">ruby/setup-ruby's releases</a>.</em></p> <blockquote> <h2>v1.328.0</h2> <h2>What's Changed</h2> <ul> <li>Fix windows msys1 setup by <a href="https://github.com/ntkme"><code>@ntkme</code></a> in <a href="https://redirect.github.com/ruby/setup-ruby/pull/947">ruby/setup-ruby#947</a></li> </ul> <p><strong>Full Changelog</strong>: <a href="https://github.com/ruby/setup-ruby/compare/v1.327.0...v1.328.0">https://github.com/ruby/setup-ruby/compare/v1.327.0...v1.328.0</a></p> </blockquote> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/ruby/setup-ruby/commit/e81a8fa391b11a595c1b7ed84177cc0fe02faf83"><code>e81a8fa</code></a> Fix windows msys1 setup</li> <li>See full diff in <a href="https://github.com/ruby/setup-ruby/compare/14594264cd68ce8a2345dd349bc3d138a4ef85c8...e81a8fa391b11a595c1b7ed84177cc0fe02faf83">compare view</a></li> </ul> </details> <br /> Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore <dependency name> major version` will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself) - `@dependabot ignore <dependency name> minor version` will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself) - `@dependabot ignore <dependency name>` will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself) - `@dependabot unignore <dependency name>` will remove all of the ignore conditions of the specified dependency - `@dependabot unignore <dependency name> <ignore condition>` will remove the ignore condition of the specified dependency and ignore conditions </details>
Bumps [vite](https://github.com/vitejs/vite/tree/HEAD/packages/vite) from 8.2.2 to 8.3.5. <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/vitejs/vite/releases">vite's releases</a>.</em></p> <blockquote> <h2>v8.3.5</h2> <h3>Bug Fixes</h3> <ul> <li><strong>build:</strong> handle missing chunk import maps (<a href="https://redirect.github.com/vitejs/vite/issues/23777">#23777</a>) (<a href="https://github.com/vitejs/vite/commit/8d7623d9b5647714a5b20cbd787a5401ca846229">8d7623d</a>)</li> <li><strong>build:</strong> include preload dependencies to chunk import map hashing (<a href="https://redirect.github.com/vitejs/vite/issues/23793">#23793</a>) (<a href="https://github.com/vitejs/vite/commit/4d16e7c14d5e1c361f148238b1e81131238ab8e9">4d16e7c</a>)</li> <li><strong>bundled-dev:</strong> apply <code>server.origin</code> to asset URLs (<a href="https://redirect.github.com/vitejs/vite/issues/23683">#23683</a>) (<a href="https://github.com/vitejs/vite/commit/52ba877693c8633458d163117504a8259beb3cf5">52ba877</a>)</li> <li><strong>bundled-dev:</strong> declare utf-8 charset in fallback page (<a href="https://redirect.github.com/vitejs/vite/issues/23846">#23846</a>) (<a href="https://github.com/vitejs/vite/commit/197daf6c4c7bfdaa005bebcc41dd2ff22fa3a5b6">197daf6</a>)</li> <li><strong>bundled-dev:</strong> ignore build.chunkImportMap (<a href="https://redirect.github.com/vitejs/vite/issues/23685">#23685</a>) (<a href="https://github.com/vitejs/vite/commit/cfe917d67d279a13f20ae9449e3befa736b64b07">cfe917d</a>)</li> <li><strong>bundled-dev:</strong> include user <code>import.meta.env.*</code> defines in the <code>import.meta.env</code> object (<a href="https://redirect.github.com/vitejs/vite/issues/23713">#23713</a>) (<a href="https://github.com/vitejs/vite/commit/6019aa79975465516da7c6f532d568422b019a25">6019aa7</a>)</li> <li><strong>bundled-dev:</strong> map forwarded error stacks through the bundle source maps (<a href="https://redirect.github.com/vitejs/vite/issues/23741">#23741</a>) (<a href="https://github.com/vitejs/vite/commit/11fe1e46ff0c136cb90fbe263ba03993bc94df18">11fe1e4</a>)</li> <li><strong>bundled-dev:</strong> normalize served output files (<a href="https://redirect.github.com/vitejs/vite/issues/23684">#23684</a>) (<a href="https://github.com/vitejs/vite/commit/df4e02cc8317a62f21edefc79a9690571ffed1f3">df4e02c</a>)</li> <li><strong>bundled-dev:</strong> stop hmr propagation at modules that are no longer imported (<a href="https://redirect.github.com/vitejs/vite/issues/23839">#23839</a>) (<a href="https://github.com/vitejs/vite/commit/7471e8c3b32d3d55243590bb7713e602c9fb0212">7471e8c</a>)</li> <li><strong>css:</strong> don't fail on a literal <code>%</code> in <code>url()</code> (<a href="https://redirect.github.com/vitejs/vite/issues/23676">#23676</a>) (<a href="https://github.com/vitejs/vite/commit/50b382d31835b8b4bc8b6964738ac03146e44261">50b382d</a>)</li> <li><strong>deps:</strong> update all non-major dependencies (<a href="https://redirect.github.com/vitejs/vite/issues/23731">#23731</a>) (<a href="https://github.com/vitejs/vite/commit/cf80aa552cac02eac0293330ccd5fde3c7ae8d29">cf80aa5</a>)</li> <li><strong>deps:</strong> update all non-major dependencies (<a href="https://redirect.github.com/vitejs/vite/issues/23826">#23826</a>) (<a href="https://github.com/vitejs/vite/commit/77d8373510da1b26ce057eb2248e570b7f63fde9">77d8373</a>)</li> <li><strong>deps:</strong> update rolldown-related dependencies (<a href="https://redirect.github.com/vitejs/vite/issues/23733">#23733</a>) (<a href="https://github.com/vitejs/vite/commit/43f0d052e514c3ad2dea2f7dc44b0720e1f62f48">43f0d05</a>)</li> <li><strong>deps:</strong> update rolldown-related dependencies (<a href="https://redirect.github.com/vitejs/vite/issues/23827">#23827</a>) (<a href="https://github.com/vitejs/vite/commit/c2e04187e49aab7ab809989f0537b4906653acab">c2e0418</a>)</li> <li><strong>optimizer:</strong> fall back to yarn.lock for lockfile hash (<a href="https://redirect.github.com/vitejs/vite/issues/23667">#23667</a>) (<a href="https://github.com/vitejs/vite/commit/f20609630faa93026924275115d1426fdc08629e">f206096</a>)</li> <li><strong>optimizer:</strong> scan <code>oxc.jsxInject</code> imports (<a href="https://redirect.github.com/vitejs/vite/issues/23758">#23758</a>) (<a href="https://github.com/vitejs/vite/commit/38f3cb45b1490ed24775547ceafa677b91a57714">38f3cb4</a>)</li> <li><strong>optimizer:</strong> skip patches dir check for yarn.lock fallback (<a href="https://redirect.github.com/vitejs/vite/issues/23725">#23725</a>) (<a href="https://github.com/vitejs/vite/commit/8e890e1ce438bfbc07ea4931ce332e40589940fa">8e890e1</a>)</li> <li><strong>optimizer:</strong> skip patches dir hash for nub lockfile (<a href="https://redirect.github.com/vitejs/vite/issues/23761">#23761</a>) (<a href="https://github.com/vitejs/vite/commit/a7d56967ef0050a09c0507e63a18164bc7a0d486">a7d5696</a>)</li> <li><strong>resolve:</strong> support subpath imports with multiple <code>#</code> (<a href="https://redirect.github.com/vitejs/vite/issues/23631">#23631</a>) (<a href="https://github.com/vitejs/vite/commit/0d86b3485fbbd0fcb9a1f70a14adedfcb7a1fff1">0d86b34</a>)</li> <li><strong>resolve:</strong> update resolve.exports to 2.0.4 (<a href="https://redirect.github.com/vitejs/vite/issues/23739">#23739</a>) (<a href="https://github.com/vitejs/vite/commit/4ea708a3ae9a324c6aabca59fade4082bf72f3e5">4ea708a</a>)</li> <li><strong>server:</strong> handle socket errors on upgrade requests not taken by the HMR server (<a href="https://redirect.github.com/vitejs/vite/issues/23728">#23728</a>) (<a href="https://github.com/vitejs/vite/commit/c2c9ef4dcd05b3e4d88844ea3a13dc23819ca2a5">c2c9ef4</a>)</li> <li><strong>server:</strong> only strip base when path matches a full segment (<a href="https://redirect.github.com/vitejs/vite/issues/23641">#23641</a>) (<a href="https://github.com/vitejs/vite/commit/3dfde87b90a9f80b125d710e3e5d4fc795662db6">3dfde87</a>)</li> </ul> <h3>Performance Improvements</h3> <ul> <li><strong>ssr:</strong> extract inline source maps without a regexp (<a href="https://redirect.github.com/vitejs/vite/issues/23775">#23775</a>) (<a href="https://github.com/vitejs/vite/commit/6a0278055d8501bbaf65b8d34ec094722b4e877a">6a02780</a>)</li> </ul> <h3>Miscellaneous Chores</h3> <ul> <li>migrate to Oxlint (<a href="https://redirect.github.com/vitejs/vite/issues/23746">#23746</a>) (<a href="https://github.com/vitejs/vite/commit/5b73935881424ed5919571036dd89d3868590f92">5b73935</a>)</li> </ul> <h3>Code Refactoring</h3> <ul> <li><strong>deps:</strong> replace <code>@vercel/detect-agent</code> with <code>std-env</code> (<a href="https://redirect.github.com/vitejs/vite/issues/23744">#23744</a>) (<a href="https://github.com/vitejs/vite/commit/ce4293f15cc5cd221c5ed60f5cd64e82ca5cbaf5">ce4293f</a>)</li> <li><strong>dev:</strong> consolidate moduleURL to file path utilities (<a href="https://redirect.github.com/vitejs/vite/issues/23828">#23828</a>) (<a href="https://github.com/vitejs/vite/commit/df7b40ee9d691e9f4e2413244f6665ef5482dce3">df7b40e</a>)</li> <li><strong>dev:</strong> separate import resolution from URL conversion (<a href="https://redirect.github.com/vitejs/vite/issues/23791">#23791</a>) (<a href="https://github.com/vitejs/vite/commit/611668983d4b717f5e5e66cf9f7125bd94f92bf7">6116689</a>)</li> <li><strong>dev:</strong> share ModuleURL and BrowserURL conversions (<a href="https://redirect.github.com/vitejs/vite/issues/23790">#23790</a>) (<a href="https://github.com/vitejs/vite/commit/446954c69c806795c83fe2f97c28ae8f9ef83731">446954c</a>)</li> <li><strong>dev:</strong> use ModuleURLs throughout HTML transforms (<a href="https://redirect.github.com/vitejs/vite/issues/23815">#23815</a>) (<a href="https://github.com/vitejs/vite/commit/a16299092c0f0f3f90e05d4bb5f0168b293c2b52">a162990</a>)</li> </ul> <h2>v8.3.4</h2> <h3>Features</h3> <ul> <li><strong>bundled-dev:</strong> support <code>import.meta.hot.acceptExports</code> (<a href="https://redirect.github.com/vitejs/vite/issues/23463">#23463</a>) (<a href="https://github.com/vitejs/vite/commit/bc0f21c56a2e003a4d2dd23ccb9da3ec8c706c4e">bc0f21c</a>)</li> </ul> <h3>Bug Fixes</h3> <ul> <li>avoid mutating hmr defaults (fix <a href="https://redirect.github.com/vitejs/vite/issues/23575">#23575</a>) (<a href="https://redirect.github.com/vitejs/vite/issues/23576">#23576</a>) (<a href="https://github.com/vitejs/vite/commit/574d5e351905fe99891364d03c2440531378f7fd">574d5e3</a>)</li> </ul> <!-- raw HTML omitted --> </blockquote> <p>... (truncated)</p> </details> <details> <summary>Changelog</summary> <p><em>Sourced from <a href="https://github.com/vitejs/vite/blob/main/packages/vite/CHANGELOG.md">vite's changelog</a>.</em></p> <blockquote> <h2><!-- raw HTML omitted --><a href="https://github.com/vitejs/vite/compare/v8.3.4...v8.3.5">8.3.5</a> (2026-10-21)<!-- raw HTML omitted --></h2> <h3>Bug Fixes</h3> <ul> <li><strong>build:</strong> handle missing chunk import maps (<a href="https://redirect.github.com/vitejs/vite/issues/23777">#23777</a>) (<a href="https://github.com/vitejs/vite/commit/8d7623d9b5647714a5b20cbd787a5401ca846229">8d7623d</a>)</li> <li><strong>build:</strong> include preload dependencies to chunk import map hashing (<a href="https://redirect.github.com/vitejs/vite/issues/23793">#23793</a>) (<a href="https://github.com/vitejs/vite/commit/4d16e7c14d5e1c361f148238b1e81131238ab8e9">4d16e7c</a>)</li> <li><strong>bundled-dev:</strong> apply <code>server.origin</code> to asset URLs (<a href="https://redirect.github.com/vitejs/vite/issues/23683">#23683</a>) (<a href="https://github.com/vitejs/vite/commit/52ba877693c8633458d163117504a8259beb3cf5">52ba877</a>)</li> <li><strong>bundled-dev:</strong> declare utf-8 charset in fallback page (<a href="https://redirect.github.com/vitejs/vite/issues/23846">#23846</a>) (<a href="https://github.com/vitejs/vite/commit/197daf6c4c7bfdaa005bebcc41dd2ff22fa3a5b6">197daf6</a>)</li> <li><strong>bundled-dev:</strong> ignore build.chunkImportMap (<a href="https://redirect.github.com/vitejs/vite/issues/23685">#23685</a>) (<a href="https://github.com/vitejs/vite/commit/cfe917d67d279a13f20ae9449e3befa736b64b07">cfe917d</a>)</li> <li><strong>bundled-dev:</strong> include user <code>import.meta.env.*</code> defines in the <code>import.meta.env</code> object (<a href="https://redirect.github.com/vitejs/vite/issues/23713">#23713</a>) (<a href="https://github.com/vitejs/vite/commit/6019aa79975465516da7c6f532d568422b019a25">6019aa7</a>)</li> <li><strong>bundled-dev:</strong> map forwarded error stacks through the bundle source maps (<a href="https://redirect.github.com/vitejs/vite/issues/23741">#23741</a>) (<a href="https://github.com/vitejs/vite/commit/11fe1e46ff0c136cb90fbe263ba03993bc94df18">11fe1e4</a>)</li> <li><strong>bundled-dev:</strong> normalize served output files (<a href="https://redirect.github.com/vitejs/vite/issues/23684">#23684</a>) (<a href="https://github.com/vitejs/vite/commit/df4e02cc8317a62f21edefc79a9690571ffed1f3">df4e02c</a>)</li> <li><strong>bundled-dev:</strong> stop hmr propagation at modules that are no longer imported (<a href="https://redirect.github.com/vitejs/vite/issues/23839">#23839</a>) (<a href="https://github.com/vitejs/vite/commit/7471e8c3b32d3d55243590bb7713e602c9fb0212">7471e8c</a>)</li> <li><strong>css:</strong> don't fail on a literal <code>%</code> in <code>url()</code> (<a href="https://redirect.github.com/vitejs/vite/issues/23676">#23676</a>) (<a href="https://github.com/vitejs/vite/commit/50b382d31835b8b4bc8b6964738ac03146e44261">50b382d</a>)</li> <li><strong>deps:</strong> update all non-major dependencies (<a href="https://redirect.github.com/vitejs/vite/issues/23731">#23731</a>) (<a href="https://github.com/vitejs/vite/commit/cf80aa552cac02eac0293330ccd5fde3c7ae8d29">cf80aa5</a>)</li> <li><strong>deps:</strong> update all non-major dependencies (<a href="https://redirect.github.com/vitejs/vite/issues/23826">#23826</a>) (<a href="https://github.com/vitejs/vite/commit/77d8373510da1b26ce057eb2248e570b7f63fde9">77d8373</a>)</li> <li><strong>deps:</strong> update rolldown-related dependencies (<a href="https://redirect.github.com/vitejs/vite/issues/23733">#23733</a>) (<a href="https://github.com/vitejs/vite/commit/43f0d052e514c3ad2dea2f7dc44b0720e1f62f48">43f0d05</a>)</li> <li><strong>deps:</strong> update rolldown-related dependencies (<a href="https://redirect.github.com/vitejs/vite/issues/23827">#23827</a>) (<a href="https://github.com/vitejs/vite/commit/c2e04187e49aab7ab809989f0537b4906653acab">c2e0418</a>)</li> <li><strong>optimizer:</strong> fall back to yarn.lock for lockfile hash (<a href="https://redirect.github.com/vitejs/vite/issues/23667">#23667</a>) (<a href="https://github.com/vitejs/vite/commit/f20609630faa93026924275115d1426fdc08629e">f206096</a>)</li> <li><strong>optimizer:</strong> scan <code>oxc.jsxInject</code> imports (<a href="https://redirect.github.com/vitejs/vite/issues/23758">#23758</a>) (<a href="https://github.com/vitejs/vite/commit/38f3cb45b1490ed24775547ceafa677b91a57714">38f3cb4</a>)</li> <li><strong>optimizer:</strong> skip patches dir check for yarn.lock fallback (<a href="https://redirect.github.com/vitejs/vite/issues/23725">#23725</a>) (<a href="https://github.com/vitejs/vite/commit/8e890e1ce438bfbc07ea4931ce332e40589940fa">8e890e1</a>)</li> <li><strong>optimizer:</strong> skip patches dir hash for nub lockfile (<a href="https://redirect.github.com/vitejs/vite/issues/23761">#23761</a>) (<a href="https://github.com/vitejs/vite/commit/a7d56967ef0050a09c0507e63a18164bc7a0d486">a7d5696</a>)</li> <li><strong>resolve:</strong> support subpath imports with multiple <code>#</code> (<a href="https://redirect.github.com/vitejs/vite/issues/23631">#23631</a>) (<a href="https://github.com/vitejs/vite/commit/0d86b3485fbbd0fcb9a1f70a14adedfcb7a1fff1">0d86b34</a>)</li> <li><strong>resolve:</strong> update resolve.exports to 2.0.4 (<a href="https://redirect.github.com/vitejs/vite/issues/23739">#23739</a>) (<a href="https://github.com/vitejs/vite/commit/4ea708a3ae9a324c6aabca59fade4082bf72f3e5">4ea708a</a>)</li> <li><strong>server:</strong> handle socket errors on upgrade requests not taken by the HMR server (<a href="https://redirect.github.com/vitejs/vite/issues/23728">#23728</a>) (<a href="https://github.com/vitejs/vite/commit/c2c9ef4dcd05b3e4d88844ea3a13dc23819ca2a5">c2c9ef4</a>)</li> <li><strong>server:</strong> only strip base when path matches a full segment (<a href="https://redirect.github.com/vitejs/vite/issues/23641">#23641</a>) (<a href="https://github.com/vitejs/vite/commit/3dfde87b90a9f80b125d710e3e5d4fc795662db6">3dfde87</a>)</li> </ul> <h3>Performance Improvements</h3> <ul> <li><strong>ssr:</strong> extract inline source maps without a regexp (<a href="https://redirect.github.com/vitejs/vite/issues/23775">#23775</a>) (<a href="https://github.com/vitejs/vite/commit/6a0278055d8501bbaf65b8d34ec094722b4e877a">6a02780</a>)</li> </ul> <h3>Miscellaneous Chores</h3> <ul> <li>migrate to Oxlint (<a href="https://redirect.github.com/vitejs/vite/issues/23746">#23746</a>) (<a href="https://github.com/vitejs/vite/commit/5b73935881424ed5919571036dd89d3868590f92">5b73935</a>)</li> </ul> <h3>Code Refactoring</h3> <ul> <li><strong>deps:</strong> replace <code>@vercel/detect-agent</code> with <code>std-env</code> (<a href="https://redirect.github.com/vitejs/vite/issues/23744">#23744</a>) (<a href="https://github.com/vitejs/vite/commit/ce4293f15cc5cd221c5ed60f5cd64e82ca5cbaf5">ce4293f</a>)</li> <li><strong>dev:</strong> consolidate moduleURL to file path utilities (<a href="https://redirect.github.com/vitejs/vite/issues/23828">#23828</a>) (<a href="https://github.com/vitejs/vite/commit/df7b40ee9d691e9f4e2413244f6665ef5482dce3">df7b40e</a>)</li> <li><strong>dev:</strong> separate import resolution from URL conversion (<a href="https://redirect.github.com/vitejs/vite/issues/23791">#23791</a>) (<a href="https://github.com/vitejs/vite/commit/611668983d4b717f5e5e66cf9f7125bd94f92bf7">6116689</a>)</li> <li><strong>dev:</strong> share ModuleURL and BrowserURL conversions (<a href="https://redirect.github.com/vitejs/vite/issues/23790">#23790</a>) (<a href="https://github.com/vitejs/vite/commit/446954c69c806795c83fe2f97c28ae8f9ef83731">446954c</a>)</li> <li><strong>dev:</strong> use ModuleURLs throughout HTML transforms (<a href="https://redirect.github.com/vitejs/vite/issues/23815">#23815</a>) (<a href="https://github.com/vitejs/vite/commit/a16299092c0f0f3f90e05d4bb5f0168b293c2b52">a162990</a>)</li> </ul> <h2><!-- raw HTML omitted --><a href="https://github.com/vitejs/vite/compare/v8.3.3...v8.3.4">8.3.4</a> (2026-10-08)<!-- raw HTML omitted --></h2> <h3>Features</h3> <ul> <li><strong>bundled-dev:</strong> support <code>import.meta.hot.acceptExports</code> (<a href="https://redirect.github.com/vitejs/vite/issues/23463">#23463</a>) (<a href="https://github.com/vitejs/vite/commit/bc0f21c56a2e003a4d2dd23ccb9da3ec8c706c4e">bc0f21c</a>)</li> </ul> <h3>Bug Fixes</h3> <ul> <li>avoid mutating hmr defaults (fix <a href="https://redirect.github.com/vitejs/vite/issues/23575">#23575</a>) (<a href="https://redirect.github.com/vitejs/vite/issues/23576">#23576</a>) (<a href="https://github.com/vitejs/vite/commit/574d5e351905fe99891364d03c2440531378f7fd">574d5e3</a>)</li> </ul> <!-- raw HTML omitted --> </blockquote> <p>... (truncated)</p> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/vitejs/vite/commit/981f07fa4580fb88b333c4450431e4715d2a0b82"><code>981f07f</code></a> release: v8.3.5 (<a href="https://github.com/vitejs/vite/tree/HEAD/packages/vite/issues/23856">#23856</a>)</li> <li><a href="https://github.com/vitejs/vite/commit/0d86b3485fbbd0fcb9a1f70a14adedfcb7a1fff1"><code>0d86b34</code></a> fix(resolve): support subpath imports with multiple <code>#</code> (<a href="https://github.com/vitejs/vite/tree/HEAD/packages/vite/issues/23631">#23631</a>)</li> <li><a href="https://github.com/vitejs/vite/commit/6a0278055d8501bbaf65b8d34ec094722b4e877a"><code>6a02780</code></a> perf(ssr): extract inline source maps without a regexp (<a href="https://github.com/vitejs/vite/tree/HEAD/packages/vite/issues/23775">#23775</a>)</li> <li><a href="https://github.com/vitejs/vite/commit/8e890e1ce438bfbc07ea4931ce332e40589940fa"><code>8e890e1</code></a> fix(optimizer): skip patches dir check for yarn.lock fallback (<a href="https://github.com/vitejs/vite/tree/HEAD/packages/vite/issues/23725">#23725</a>)</li> <li><a href="https://github.com/vitejs/vite/commit/197daf6c4c7bfdaa005bebcc41dd2ff22fa3a5b6"><code>197daf6</code></a> fix(bundled-dev): declare utf-8 charset in fallback page (<a href="https://github.com/vitejs/vite/tree/HEAD/packages/vite/issues/23846">#23846</a>)</li> <li><a href="https://github.com/vitejs/vite/commit/4d16e7c14d5e1c361f148238b1e81131238ab8e9"><code>4d16e7c</code></a> fix(build): include preload dependencies to chunk import map hashing (<a href="https://github.com/vitejs/vite/tree/HEAD/packages/vite/issues/23793">#23793</a>)</li> <li><a href="https://github.com/vitejs/vite/commit/df7b40ee9d691e9f4e2413244f6665ef5482dce3"><code>df7b40e</code></a> refactor(dev): consolidate moduleURL to file path utilities (<a href="https://github.com/vitejs/vite/tree/HEAD/packages/vite/issues/23828">#23828</a>)</li> <li><a href="https://github.com/vitejs/vite/commit/a16299092c0f0f3f90e05d4bb5f0168b293c2b52"><code>a162990</code></a> refactor(dev): use ModuleURLs throughout HTML transforms (<a href="https://github.com/vitejs/vite/tree/HEAD/packages/vite/issues/23815">#23815</a>)</li> <li><a href="https://github.com/vitejs/vite/commit/611668983d4b717f5e5e66cf9f7125bd94f92bf7"><code>6116689</code></a> refactor(dev): separate import resolution from URL conversion (<a href="https://github.com/vitejs/vite/tree/HEAD/packages/vite/issues/23791">#23791</a>)</li> <li><a href="https://github.com/vitejs/vite/commit/446954c69c806795c83fe2f97c28ae8f9ef83731"><code>446954c</code></a> refactor(dev): share ModuleURL and BrowserURL conversions (<a href="https://github.com/vitejs/vite/tree/HEAD/packages/vite/issues/23790">#23790</a>)</li> <li>Additional commits viewable in <a href="https://github.com/vitejs/vite/commits/v8.3.5/packages/vite">compare view</a></li> </ul> </details> <br /> [](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself) You can disable automated security fix PRs for this repo from the [Security Alerts page](https://github.com/github/accessibility-scanner/network/alerts). </details> Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Bumps [undici](https://github.com/nodejs/undici) from 6.29.0 to 6.29.1. <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/nodejs/undici/releases">undici's releases</a>.</em></p> <blockquote> <h2>v6.29.1</h2> <h2>Security fixes</h2> <h3>High severity</h3> <h4>Denial of service via TLS 1.2 certificate-changing renegotiation</h4> <p><strong>CVE-2026-87018 · <a href="https://github.com/nodejs/undici/security/advisories/GHSA-qrxm-fqhp-jwvm">GHSA-qrxm-fqhp-jwvm</a></strong></p> <p>A malicious or compromised HTTPS server could crash the Node.js process by initiating TLS 1.2 renegotiation and presenting a different, CA-trusted certificate whose hostname did not match the requested host. The resulting socket error reached an assertion in undici's HTTP/1.1 and HTTP/2 connection handling. This release handles post-connect certificate errors without terminating the process.</p> <h4>TLS certificate validation bypass through dropped <code>Agent</code> options</h4> <p><strong>CVE-2026-109383 · <a href="https://github.com/nodejs/undici/security/advisories/GHSA-2m5v-pch6-74hx">GHSA-2m5v-pch6-74hx</a></strong></p> <p><code>Agent</code> used a JSON-based clone for constructor options, which silently removed function-valued TLS options such as <code>checkServerIdentity</code>. Applications relying on custom certificate or public-key verification could therefore accept a certificate that the callback was intended to reject. This release preserves TLS options when creating per-origin dispatchers.</p> <h4>Denial of service through excessive <code>Content-Encoding</code> values</h4> <p><strong>CVE-2026-109869 · <a href="https://github.com/nodejs/undici/security/advisories/GHSA-xjj6-f33q-929c">GHSA-xjj6-f33q-929c</a></strong></p> <p>A malicious HTTP server could crash the Node.js process by returning more than five content codings and closing the connection before sending the body. Although <code>fetch()</code> rejected the response, an error from an orphaned internal stream could remain unhandled. This release validates the content-encoding chain before creating the body stream and aborts oversized chains safely.</p> <h3>Medium severity</h3> <h4>Denial of service through unbounded EventSource parser state</h4> <p><strong>CVE-2026-109924 · <a href="https://github.com/nodejs/undici/security/advisories/GHSA-4qv8-2p9j-2685">GHSA-4qv8-2p9j-2685</a></strong></p> <p>A malicious Server-Sent Events endpoint could exhaust process memory by sending many tiny <code>data:</code> fields without completing an event, or by splitting an unfinished line across many chunks. This release bounds retained EventSource parser state, including field counts, buffered chunks, unfinished-line length, and retained field data.</p> <h4>Denial of service through unbounded automatic WebSocket PONG buffering</h4> <p><strong>CVE-2026-109932 · <a href="https://github.com/nodejs/undici/security/advisories/GHSA-9fm3-97px-rjf6">GHSA-9fm3-97px-rjf6</a></strong></p> <p>A malicious WebSocket server could exhaust process memory by flooding the client with PING frames while not reading the automatic PONG responses. undici previously ignored socket backpressure and allowed the outbound queue to grow without bound. This release pauses frame parsing when PONG writes encounter backpressure and resumes after the socket drains.</p> <h2>What's Changed</h2> <ul> <li>[v6.x] fix(fetch): fix aborting Streams (<a href="https://redirect.github.com/nodejs/undici/issues/3754">#3754</a>) by <a href="https://github.com/mrityunjay-pandey"><code>@mrityunjay-pandey</code></a> in <a href="https://redirect.github.com/nodejs/undici/pull/6000">nodejs/undici#6000</a></li> </ul> <p><strong>Full Changelog</strong>: <a href="https://github.com/nodejs/undici/compare/v6.29.0...v6.29.1">https://github.com/nodejs/undici/compare/v6.29.0...v6.29.1</a></p> </blockquote> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/nodejs/undici/commit/8c57f6c68c95465338ae97bfc991cb1513d2f76e"><code>8c57f6c</code></a> [Release] v6.29.1 (<a href="https://redirect.github.com/nodejs/undici/issues/6023">#6023</a>)</li> <li><a href="https://github.com/nodejs/undici/commit/39f93e142df03e559fe7c3d1fc7fba9beee2c185"><code>39f93e1</code></a> fix(websocket): bound automatic PONG writes under backpressure</li> <li><a href="https://github.com/nodejs/undici/commit/c43b23fdc6b37e1283d4347408bb16800f867d9e"><code>c43b23f</code></a> fix(eventsource): bound retained SSE parser state</li> <li><a href="https://github.com/nodejs/undici/commit/1325a87dfb3492f8e87e6b0a84b3bda4e82e3436"><code>1325a87</code></a> fix(fetch): abort excessive content encoding responses</li> <li><a href="https://github.com/nodejs/undici/commit/8c59f6b302898cb2e9b0f7962cd7212b6e597c9f"><code>8c59f6b</code></a> fix: preserve Agent connection options</li> <li><a href="https://github.com/nodejs/undici/commit/b40fbfc0651703cf9fa9f6ced68b679f28d8bb28"><code>b40fbfc</code></a> fix: handle post-connect TLS certificate errors</li> <li><a href="https://github.com/nodejs/undici/commit/407630ac0a2f3bc65c596ed078dcffbeec0285c4"><code>407630a</code></a> [v6.x] fix(fetch): fix aborting Streams (<a href="https://redirect.github.com/nodejs/undici/issues/3754">#3754</a>) (<a href="https://redirect.github.com/nodejs/undici/issues/6000">#6000</a>)</li> <li>See full diff in <a href="https://github.com/nodejs/undici/compare/v6.29.0...v6.29.1">compare view</a></li> </ul> </details> <br /> [](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself) You can disable automated security fix PRs for this repo from the [Security Alerts page](https://github.com/github/accessibility-scanner/network/alerts). </details> Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Co-authored-by: Kendall Gassner <kendallgassner@github.com>
Shorten rule labels beyond GitHub's 50-character limit with a deterministic hash suffix, and preserve the complete rule ID in the issue body. Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> Copilot-Session: 5df06479-27fd-4edc-9e52-14ce2618d8d9
Long accessibility rule IDs can exceed GitHub's 50-character label limit and prevent issue creation. This change keeps long labels readable while adding a deterministic four-character hash suffix, and includes the full rule ID in the issue body for traceability. Focused tests cover the label length and suffix, distinguish IDs with a shared visible prefix, and verify the full rule ID appears in the body. The file action test suite passes. Fixes #260 🤖 Assisted by Copilot
Bumps the github-actions group with 1 update in the / directory: [ruby/setup-ruby](https://github.com/ruby/setup-ruby). Updates `ruby/setup-ruby` from 1.328.0 to 1.329.0 - [Release notes](https://github.com/ruby/setup-ruby/releases) - [Changelog](https://github.com/ruby/setup-ruby/blob/master/release.rb) - [Commits](ruby/setup-ruby@e81a8fa...651ff0d) --- updated-dependencies: - dependency-name: ruby/setup-ruby dependency-version: 1.329.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: github-actions ... Signed-off-by: dependabot[bot] <support@github.com>
…ub-actions group across 1 directory (#290) Bumps the github-actions group with 1 update in the / directory: [ruby/setup-ruby](https://github.com/ruby/setup-ruby). Updates `ruby/setup-ruby` from 1.328.0 to 1.329.0 <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/ruby/setup-ruby/releases">ruby/setup-ruby's releases</a>.</em></p> <blockquote> <h2>v1.329.0</h2> <h2>What's Changed</h2> <ul> <li>Add ruby-4.1.0-preview1 by <a href="https://github.com/ruby-builder-bot"><code>@ruby-builder-bot</code></a> in <a href="https://redirect.github.com/ruby/setup-ruby/pull/948">ruby/setup-ruby#948</a></li> </ul> <p><strong>Full Changelog</strong>: <a href="https://github.com/ruby/setup-ruby/compare/v1.328.0...v1.329.0">https://github.com/ruby/setup-ruby/compare/v1.328.0...v1.329.0</a></p> </blockquote> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/ruby/setup-ruby/commit/651ff0d62c5c79bed6d53ec518387aae20e72c1a"><code>651ff0d</code></a> Add ruby-4.1.0-preview1</li> <li>See full diff in <a href="https://github.com/ruby/setup-ruby/compare/e81a8fa391b11a595c1b7ed84177cc0fe02faf83...651ff0d62c5c79bed6d53ec518387aae20e72c1a">compare view</a></li> </ul> </details> <br /> [](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore <dependency name> major version` will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself) - `@dependabot ignore <dependency name> minor version` will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself) - `@dependabot ignore <dependency name>` will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself) - `@dependabot unignore <dependency name>` will remove all of the ignore conditions of the specified dependency - `@dependabot unignore <dependency name> <ignore condition>` will remove the ignore condition of the specified dependency and ignore conditions </details>
Co-authored-by: helen <906334+helen@users.noreply.github.com>
Noticed this while cutting a new release for #260, seems like we should test all of the built-in scans. Might even have caught this earlier.
…s-errors-self-signed-ssl # Conflicts: # .github/actions/find/action.yml # .github/actions/find/tests/findForUrl.test.ts # README.md
The built-in login flow ran in a browser context without ignoreHTTPSErrors, so login failed on self-signed hosts before Find could run. Auth now takes the same input and the root action passes it through. The find index test expects the new sixth argument.
Added a warning about disabling TLS certificate validation when ignoring HTTPS errors in the README.
Bumps the github-actions group with 1 update in the / directory: [ruby/setup-ruby](https://github.com/ruby/setup-ruby). Updates `ruby/setup-ruby` from 1.329.0 to 1.334.0 - [Release notes](https://github.com/ruby/setup-ruby/releases) - [Changelog](https://github.com/ruby/setup-ruby/blob/master/release.rb) - [Commits](ruby/setup-ruby@651ff0d...26e5b7d) --- updated-dependencies: - dependency-name: ruby/setup-ruby dependency-version: 1.334.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: github-actions ... Signed-off-by: dependabot[bot] <support@github.com>
…ub-actions group across 1 directory (#295) Bumps the github-actions group with 1 update in the / directory: [ruby/setup-ruby](https://github.com/ruby/setup-ruby). Updates `ruby/setup-ruby` from 1.329.0 to 1.334.0 <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/ruby/setup-ruby/releases">ruby/setup-ruby's releases</a>.</em></p> <blockquote> <h2>v1.334.0</h2> <h2>What's Changed</h2> <ul> <li>Add ruby-3.3.13,ruby-3.4.12,ruby-4.0.9 by <a href="https://github.com/ruby-builder-bot"><code>@ruby-builder-bot</code></a> in <a href="https://redirect.github.com/ruby/setup-ruby/pull/956">ruby/setup-ruby#956</a></li> </ul> <p><strong>Full Changelog</strong>: <a href="https://github.com/ruby/setup-ruby/compare/v1.333.0...v1.334.0">https://github.com/ruby/setup-ruby/compare/v1.333.0...v1.334.0</a></p> <h2>v1.333.0</h2> <h2>What's Changed</h2> <ul> <li>Add ruby-4.0.8 by <a href="https://github.com/ruby-builder-bot"><code>@ruby-builder-bot</code></a> in <a href="https://redirect.github.com/ruby/setup-ruby/pull/955">ruby/setup-ruby#955</a></li> </ul> <p><strong>Full Changelog</strong>: <a href="https://github.com/ruby/setup-ruby/compare/v1.332.0...v1.333.0">https://github.com/ruby/setup-ruby/compare/v1.332.0...v1.333.0</a></p> <h2>v1.332.0</h2> <h2>What's Changed</h2> <ul> <li>Update CRuby releases on Windows (CVE-2026-111943) by <a href="https://github.com/ruby-builder-bot"><code>@ruby-builder-bot</code></a> in <a href="https://redirect.github.com/ruby/setup-ruby/pull/952">ruby/setup-ruby#952</a></li> </ul> <p><strong>Full Changelog</strong>: <a href="https://github.com/ruby/setup-ruby/compare/v1.331.0...v1.332.0">https://github.com/ruby/setup-ruby/compare/v1.331.0...v1.332.0</a></p> <h2>v1.331.0</h2> <h2>What's Changed</h2> <ul> <li>Use ruby's <code>Gem::Version</code> instead of npm's <code>semver</code> to parse rubygems version by <a href="https://github.com/ntkme"><code>@ntkme</code></a> in <a href="https://redirect.github.com/ruby/setup-ruby/pull/946">ruby/setup-ruby#946</a></li> </ul> <p><strong>Full Changelog</strong>: <a href="https://github.com/ruby/setup-ruby/compare/v1.330.0...v1.331.0">https://github.com/ruby/setup-ruby/compare/v1.330.0...v1.331.0</a></p> <h2>v1.330.0</h2> <h2>What's Changed</h2> <ul> <li>Suggest the latest patch release when a version is unavailable by <a href="https://github.com/CyberNativeAI"><code>@CyberNativeAI</code></a> in <a href="https://redirect.github.com/ruby/setup-ruby/pull/949">ruby/setup-ruby#949</a></li> </ul> <h2>New Contributors</h2> <ul> <li><a href="https://github.com/CyberNativeAI"><code>@CyberNativeAI</code></a> made their first contribution in <a href="https://redirect.github.com/ruby/setup-ruby/pull/949">ruby/setup-ruby#949</a></li> </ul> <p><strong>Full Changelog</strong>: <a href="https://github.com/ruby/setup-ruby/compare/v1.329.0...v1.330.0">https://github.com/ruby/setup-ruby/compare/v1.329.0...v1.330.0</a></p> </blockquote> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/ruby/setup-ruby/commit/26e5b7d197ebf60545ee9667bcbace0be11ccaec"><code>26e5b7d</code></a> Add ruby-3.3.13,ruby-3.4.12,ruby-4.0.9</li> <li><a href="https://github.com/ruby/setup-ruby/commit/e1bd6146574da5e0795075b5319b300edb30c5b0"><code>e1bd614</code></a> Add ruby-4.0.8</li> <li><a href="https://github.com/ruby/setup-ruby/commit/b1da4809b005e0178fe08a1d57317bffc00b7b4c"><code>b1da480</code></a> Update CRuby releases on Windows</li> <li><a href="https://github.com/ruby/setup-ruby/commit/824c0e29fdfc7d689c191c27acc969d2d04b7dd8"><code>824c0e2</code></a> Use ruby's <code>Gem::Version</code> instead of npm's <code>semver</code> to parse rubygems version</li> <li><a href="https://github.com/ruby/setup-ruby/commit/a89e929fdc35d88f2b8f20f26452c4adbeb9e371"><code>a89e929</code></a> Tweak wording in the README, update link and simplify</li> <li><a href="https://github.com/ruby/setup-ruby/commit/fbbff8d308d5ec28d10c789af3950de5c41ad9b3"><code>fbbff8d</code></a> Suggest the latest patch release when a version is unavailable</li> <li>See full diff in <a href="https://github.com/ruby/setup-ruby/compare/651ff0d62c5c79bed6d53ec518387aae20e72c1a...26e5b7d197ebf60545ee9667bcbace0be11ccaec">compare view</a></li> </ul> </details> <br /> [](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore <dependency name> major version` will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself) - `@dependabot ignore <dependency name> minor version` will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself) - `@dependabot ignore <dependency name>` will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself) - `@dependabot unignore <dependency name>` will remove all of the ignore conditions of the specified dependency - `@dependabot unignore <dependency name> <ignore condition>` will remove the ignore condition of the specified dependency and ignore conditions </details>
…ronments (#224) ## Summary Adds an `ignore_https_errors` input so the scanner can run against environments with self-signed or otherwise invalid certificates, e.g. internal staging hosts (#150). Off by default; nothing changes unless explicitly opted in. ## Changes - `action.yml`: new optional `ignore_https_errors` input (default `false`), documented in the README. - `index.ts`: reads the input (`loadIgnoreHttpsErrors`) and threads it through to the scan. - `findForUrl.ts`: when enabled, sets Playwright's `ignoreHTTPSErrors: true` on the browser context; when disabled the context options are untouched. Note: this touches the same file as #223 (the SPA networkidle wait), so whichever lands second may need a trivial rebase; the changes are logically independent. ## Testing `vitest run tests/findForUrl.test.ts` — 8 passed, including new cases asserting the context gets `ignoreHTTPSErrors` only when the input is enabled. Closes #150 AI was used for assistance.
helen
requested review from
accessibility-bot
and
an auto review from Copilot
November 4, 2026 23:27
![github-advanced-security[bot]](https://avatars.githubusercontent.com/in/57789?s=60&v=4){kind=small}
Contributor
There was a problem hiding this comment.
🟡 Changes recommended
The ignore_https_errors scan option also disables certificate validation for login_url, risking credential interception without a separate authentication opt-in.
1 open issue
What changed in this PR
Prepares v3.5.2 by bringing self-signed HTTPS support, rule-label length handling, and dependency updates into the v3 action.
Changes:
- Adds an optional HTTPS certificate-error bypass for authentication and scanning, addressing #150.
- Shortens long rule labels while preserving full rule identifiers in issue bodies, addressing #260.
- Adds regression coverage, enables AccessLint in integration tests, and updates dependencies and workflow actions.
| File | Description |
|---|---|
tests/site-with-errors.test.ts |
Adjusts assertions to accommodate AccessLint findings. |
README.md |
Documents the HTTPS-error input. |
package-lock.json |
Updates locked dependencies. |
action.yml |
Exposes and forwards the HTTPS-error input. |
.github/workflows/test.yml |
Enables AccessLint and updates Ruby setup. |
.github/workflows/lint.yml |
Updates Node setup. |
.github/actions/find/tests/index.test.ts |
Updates the expected scan arguments. |
.github/actions/find/tests/findForUrl.test.ts |
Tests HTTPS-error option forwarding and defaults. |
.github/actions/find/src/index.ts |
Reads and passes the HTTPS-error setting. |
.github/actions/find/src/findForUrl.ts |
Applies the setting to browser contexts. |
.github/actions/find/README.md |
Documents the scan option. |
.github/actions/find/action.yml |
Declares the scan option and default. |
.github/actions/file/tests/openIssue.test.ts |
Tests deterministic shortening of long labels. |
.github/actions/file/tests/generateIssueBody.test.ts |
Tests full rule identifiers in issue bodies. |
.github/actions/file/src/openIssue.ts |
Caps rule labels with a hash suffix. |
.github/actions/file/src/generateIssueBody.ts |
Includes full rule identifiers in issue bodies. |
.github/actions/auth/src/index.ts |
Applies the HTTPS-error setting during authentication. |
.github/actions/auth/README.md |
Documents the authentication option and security risks. |
.github/actions/auth/action.yml |
Declares the authentication option and default. |
Review effort: Balanced (auto)
|
You are seeing this message because GitHub Code Scanning has recently been set up for this repository, or this pull request contains the workflow file for the Code Scanning tool. What Enabling Code Scanning Means:
For more information about GitHub Code Scanning, check out the documentation. |
6 tasks
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
This addresses: