Bumps the development-dependencies group with 2 updates in the /
directory: [dotenv](https://github.com/motdotla/dotenv) and
[esbuild](https://github.com/evanw/esbuild).
Updates `dotenv` from 17.2.1 to 17.2.2
<details>
<summary>Changelog</summary>
<p><em>Sourced from <a
href="https://github.com/motdotla/dotenv/blob/master/CHANGELOG.md">dotenv's
changelog</a>.</em></p>
<blockquote>
<h2><a
href="https://github.com/motdotla/dotenv/compare/v17.2.1...v17.2.2">17.2.2</a>
(2025-09-02)</h2>
<h3>Added</h3>
<ul>
<li>🙏 A big thank you to new sponsor <a
href="https://tuple.app/dotenv">Tuple.app</a> - <em>the premier screen
sharing app for developers on macOS and Windows.</em> Go check them out.
It's wonderful and generous of them to give back to open source by
sponsoring dotenv. Give them some love back.</li>
</ul>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="2ea1a76fd5"><code>2ea1a76</code></a>
17.2.2</li>
<li><a
href="0947a8308b"><code>0947a83</code></a>
changelog 🪵</li>
<li><a
href="c8fb4aa58e"><code>c8fb4aa</code></a>
changelog 🪵</li>
<li><a
href="a2b13d2995"><code>a2b13d2</code></a>
update README</li>
<li><a
href="d92a91e200"><code>d92a91e</code></a>
remove</li>
<li>See full diff in <a
href="https://github.com/motdotla/dotenv/compare/v17.2.1...v17.2.2">compare
view</a></li>
</ul>
</details>
<br />
Updates `esbuild` from 0.25.8 to 0.25.9
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/evanw/esbuild/releases">esbuild's
releases</a>.</em></p>
<blockquote>
<h2>v0.25.9</h2>
<ul>
<li>
<p>Better support building projects that use Yarn on Windows (<a
href="https://redirect.github.com/evanw/esbuild/issues/3131">#3131</a>,
<a
href="https://redirect.github.com/evanw/esbuild/issues/3663">#3663</a>)</p>
<p>With this release, you can now use esbuild to bundle projects that
use Yarn Plug'n'Play on Windows on drives other than the <code>C:</code>
drive. The problem was as follows:</p>
<ol>
<li>Yarn in Plug'n'Play mode on Windows stores its global module cache
on the <code>C:</code> drive</li>
<li>Some developers put their projects on the <code>D:</code> drive</li>
<li>Yarn generates relative paths that use <code>../..</code> to get
from the project directory to the cache directory</li>
<li>Windows-style paths don't support directory traversal between drives
via <code>..</code> (so <code>D:\..</code> is just <code>D:</code>)</li>
<li>I didn't have access to a Windows machine for testing this edge
case</li>
</ol>
<p>Yarn works around this edge case by pretending Windows-style paths
beginning with <code>C:\</code> are actually Unix-style paths beginning
with <code>/C:/</code>, so the <code>../..</code> path segments are able
to navigate across drives inside Yarn's implementation. This was broken
for a long time in esbuild but I finally got access to a Windows machine
and was able to debug and fix this edge case. So you should now be able
to bundle these projects with esbuild.</p>
</li>
<li>
<p>Preserve parentheses around function expressions (<a
href="https://redirect.github.com/evanw/esbuild/issues/4252">#4252</a>)</p>
<p>The V8 JavaScript VM uses parentheses around function expressions as
an optimization hint to immediately compile the function. Otherwise the
function would be lazily-compiled, which has additional overhead if that
function is always called immediately as lazy compilation involves
parsing the function twice. You can read <a
href="https://v8.dev/blog/preparser">V8's blog post about this</a> for
more details.</p>
<p>Previously esbuild did not represent parentheses around functions in
the AST so they were lost during compilation. With this change, esbuild
will now preserve parentheses around function expressions when they are
present in the original source code. This means these optimization hints
will not be lost when bundling with esbuild. In addition, esbuild will
now automatically add this optimization hint to immediately-invoked
function expressions. Here's an example:</p>
<pre lang="js"><code>// Original code
const fn0 = () => 0
const fn1 = (() => 1)
console.log(fn0, function() { return fn1() }())
<p>// Old output<br />
const fn0 = () => 0;<br />
const fn1 = () => 1;<br />
console.log(fn0, function() {<br />
return fn1();<br />
}());</p>
<p>// New output<br />
const fn0 = () => 0;<br />
const fn1 = (() => 1);<br />
console.log(fn0, (function() {<br />
return fn1();<br />
})());<br />
</code></pre></p>
<p>Note that you do not want to wrap all function expressions in
parentheses. This optimization hint should only be used for functions
that are called on initial load. Using this hint for functions that are
not called on initial load will unnecessarily delay the initial load.
Again, see V8's blog post linked above for details.</p>
</li>
<li>
<p>Update Go from 1.23.10 to 1.23.12 (<a
href="https://redirect.github.com/evanw/esbuild/issues/4257">#4257</a>,
<a
href="https://redirect.github.com/evanw/esbuild/pull/4258">#4258</a>)</p>
<p>This should have no effect on existing code as this version change
does not change Go's operating system support. It may remove certain
false positive reports (specifically CVE-2025-4674 and CVE-2025-47907)
from vulnerability scanners that only detect which version of the Go
compiler esbuild uses.</p>
</li>
</ul>
</blockquote>
</details>
<details>
<summary>Changelog</summary>
<p><em>Sourced from <a
href="https://github.com/evanw/esbuild/blob/main/CHANGELOG.md">esbuild's
changelog</a>.</em></p>
<blockquote>
<h2>0.25.9</h2>
<ul>
<li>
<p>Better support building projects that use Yarn on Windows (<a
href="https://redirect.github.com/evanw/esbuild/issues/3131">#3131</a>,
<a
href="https://redirect.github.com/evanw/esbuild/issues/3663">#3663</a>)</p>
<p>With this release, you can now use esbuild to bundle projects that
use Yarn Plug'n'Play on Windows on drives other than the <code>C:</code>
drive. The problem was as follows:</p>
<ol>
<li>Yarn in Plug'n'Play mode on Windows stores its global module cache
on the <code>C:</code> drive</li>
<li>Some developers put their projects on the <code>D:</code> drive</li>
<li>Yarn generates relative paths that use <code>../..</code> to get
from the project directory to the cache directory</li>
<li>Windows-style paths don't support directory traversal between drives
via <code>..</code> (so <code>D:\..</code> is just <code>D:</code>)</li>
<li>I didn't have access to a Windows machine for testing this edge
case</li>
</ol>
<p>Yarn works around this edge case by pretending Windows-style paths
beginning with <code>C:\</code> are actually Unix-style paths beginning
with <code>/C:/</code>, so the <code>../..</code> path segments are able
to navigate across drives inside Yarn's implementation. This was broken
for a long time in esbuild but I finally got access to a Windows machine
and was able to debug and fix this edge case. So you should now be able
to bundle these projects with esbuild.</p>
</li>
<li>
<p>Preserve parentheses around function expressions (<a
href="https://redirect.github.com/evanw/esbuild/issues/4252">#4252</a>)</p>
<p>The V8 JavaScript VM uses parentheses around function expressions as
an optimization hint to immediately compile the function. Otherwise the
function would be lazily-compiled, which has additional overhead if that
function is always called immediately as lazy compilation involves
parsing the function twice. You can read <a
href="https://v8.dev/blog/preparser">V8's blog post about this</a> for
more details.</p>
<p>Previously esbuild did not represent parentheses around functions in
the AST so they were lost during compilation. With this change, esbuild
will now preserve parentheses around function expressions when they are
present in the original source code. This means these optimization hints
will not be lost when bundling with esbuild. In addition, esbuild will
now automatically add this optimization hint to immediately-invoked
function expressions. Here's an example:</p>
<pre lang="js"><code>// Original code
const fn0 = () => 0
const fn1 = (() => 1)
console.log(fn0, function() { return fn1() }())
<p>// Old output<br />
const fn0 = () => 0;<br />
const fn1 = () => 1;<br />
console.log(fn0, function() {<br />
return fn1();<br />
}());</p>
<p>// New output<br />
const fn0 = () => 0;<br />
const fn1 = (() => 1);<br />
console.log(fn0, (function() {<br />
return fn1();<br />
})());<br />
</code></pre></p>
<p>Note that you do not want to wrap all function expressions in
parentheses. This optimization hint should only be used for functions
that are called on initial load. Using this hint for functions that are
not called on initial load will unnecessarily delay the initial load.
Again, see V8's blog post linked above for details.</p>
</li>
<li>
<p>Update Go from 1.23.10 to 1.23.12 (<a
href="https://redirect.github.com/evanw/esbuild/issues/4257">#4257</a>,
<a
href="https://redirect.github.com/evanw/esbuild/pull/4258">#4258</a>)</p>
<p>This should have no effect on existing code as this version change
does not change Go's operating system support. It may remove certain
false positive reports (specifically CVE-2025-4674 and CVE-2025-47907)
from vulnerability scanners that only detect which version of the Go
compiler esbuild uses.</p>
</li>
</ul>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="195e05c16f"><code>195e05c</code></a>
publish 0.25.9 to npm</li>
<li><a
href="3dac33f2a2"><code>3dac33f</code></a>
fix <a
href="https://redirect.github.com/evanw/esbuild/issues/3131">#3131</a>,
fix <a
href="https://redirect.github.com/evanw/esbuild/issues/3663">#3663</a>:
yarnpnp + windows + D drive</li>
<li><a
href="0f2c5c8c11"><code>0f2c5c8</code></a>
mock fs now supports multiple volumes on windows</li>
<li><a
href="100a51e791"><code>100a51e</code></a>
split out yarnpnp snapshot tests</li>
<li><a
href="13aace38bd"><code>13aace3</code></a>
remove <code>C:</code> assumption from windows snapshot tests</li>
<li><a
href="f1f413f18b"><code>f1f413f</code></a>
fix <a
href="https://redirect.github.com/evanw/esbuild/issues/4252">#4252</a>:
preserve parentheses around functions</li>
<li><a
href="1bc809190b"><code>1bc8091</code></a>
fix <a
href="https://redirect.github.com/evanw/esbuild/issues/4257">#4257</a>,
close <a
href="https://redirect.github.com/evanw/esbuild/issues/4258">#4258</a>:
go 1.23.10 => 1.23.12</li>
<li><a
href="bc52135d02"><code>bc52135</code></a>
move the go compiler version to <code>go.version</code></li>
<li><a
href="a0af5d1037"><code>a0af5d1</code></a>
makefile: use <code>ESBUILD_VERSION</code> consistently</li>
<li>See full diff in <a
href="https://github.com/evanw/esbuild/compare/v0.25.8...v0.25.9">compare
view</a></li>
</ul>
</details>
<br />
Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.
[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)
---
<details>
<summary>Dependabot commands and options</summary>
<br />
You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot merge` will merge this PR after your CI passes on it
- `@dependabot squash and merge` will squash and merge this PR after
your CI passes on it
- `@dependabot cancel merge` will cancel a previously requested merge
and block automerging
- `@dependabot reopen` will reopen this PR if it is closed
- `@dependabot close` will close this PR and stop Dependabot recreating
it. You can achieve the same result by closing it manually
- `@dependabot show <dependency name> ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore <dependency name> major version` will close this
group update PR and stop Dependabot creating any more for the specific
dependency's major version (unless you unignore this specific
dependency's major version or upgrade to it yourself)
- `@dependabot ignore <dependency name> minor version` will close this
group update PR and stop Dependabot creating any more for the specific
dependency's minor version (unless you unignore this specific
dependency's minor version or upgrade to it yourself)
- `@dependabot ignore <dependency name>` will close this group update PR
and stop Dependabot creating any more for the specific dependency
(unless you unignore this specific dependency or upgrade to it yourself)
- `@dependabot unignore <dependency name>` will remove all of the ignore
conditions of the specified dependency
- `@dependabot unignore <dependency name> <ignore condition>` will
remove the ignore condition of the specified dependency and ignore
conditions
</details>
Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Updated release workflow and semantic-release config to include the beta
branch and pattern-matched branches for release automation. The beta
branch is now marked as a prerelease.
Bumps the development-dependencies group with 2 updates in the /
directory: [ava](https://github.com/avajs/ava) and
[esbuild](https://github.com/evanw/esbuild).
Updates `ava` from 6.3.0 to 6.4.0
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/avajs/ava/releases">ava's
releases</a>.</em></p>
<blockquote>
<h2>v6.4.0</h2>
<h2>What's Changed</h2>
<ul>
<li>AVA is now tested with Node.js 24 (but no longer v23) <a
href="https://redirect.github.com/avajs/ava/pull/3379">avajs/ava#3379</a></li>
<li>We're now publishing to npm with <a
href="https://www.npmjs.com/package/ava#provenance">provenance
attestations</a> <a
href="https://redirect.github.com/avajs/ava/pull/3385">avajs/ava#3385</a></li>
</ul>
<h3>Interactive watch mode filters</h3>
<p><a href="https://github.com/mmulet"><code>@mmulet</code></a> did
fantastic work to spearhead interactive watch mode filters. You can now
filter test files by glob patterns, and tests by matching their titles.
It's just like you already could from the CLI itself, but now without
exiting AVA 🚀 <a
href="https://redirect.github.com/avajs/ava/pull/3372">avajs/ava#3372</a></p>
<p>As part of this work we've removed the "sticky"
<code>.only()</code> behavior <a
href="https://redirect.github.com/avajs/ava/pull/3381">avajs/ava#3381</a></p>
<h3>Examples</h3>
<p>We've been remiss in merging <a
href="https://redirect.github.com/avajs/ava/pull/3335">avajs/ava#3335</a>
which updates the examples to use AVA 6. It's done now, examples are up
to date and it's all due to <a
href="https://github.com/tommy-mitchell"><code>@tommy-mitchell</code></a>
👏</p>
<h2>New Contributors</h2>
<ul>
<li><a href="https://github.com/mmulet"><code>@mmulet</code></a> made
their first contribution in <a
href="https://redirect.github.com/avajs/ava/pull/3372">avajs/ava#3372</a></li>
<li><a href="https://github.com/kebbell"><code>@kebbell</code></a> made
their first contribution in <a
href="https://redirect.github.com/avajs/ava/pull/3348">avajs/ava#3348</a></li>
</ul>
<p><strong>Full Changelog</strong>: <a
href="https://github.com/avajs/ava/compare/v6.3.0...v6.4.0">https://github.com/avajs/ava/compare/v6.3.0...v6.4.0</a></p>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="372c241efb"><code>372c241</code></a>
6.4.0</li>
<li><a
href="05ead2812d"><code>05ead28</code></a>
Update release process & maintaining notes</li>
<li><a
href="859f3ff2eb"><code>859f3ff</code></a>
Update examples to use AVA 6</li>
<li><a
href="eb2b48d398"><code>eb2b48d</code></a>
Update XO & other dependencies</li>
<li><a
href="50e02d5cd6"><code>50e02d5</code></a>
Remove compiler option override needed for TypeScript 4.x</li>
<li><a
href="57a3bbe8d4"><code>57a3bbe</code></a>
Implement file globbing and test matching within watch mode</li>
<li><a
href="29cb29accb"><code>29cb29a</code></a>
Remove special .only() behavior in watch mode</li>
<li><a
href="36934b2371"><code>36934b2</code></a>
Fix error handling in watcher tests</li>
<li><a
href="31a1262e6c"><code>31a1262</code></a>
Test with Node.js 24, remove v23 test runs</li>
<li><a
href="a6f42ea472"><code>a6f42ea</code></a>
Upgrade <code>@ava/test</code> to 6.3.0</li>
<li>See full diff in <a
href="https://github.com/avajs/ava/compare/v6.3.0...v6.4.0">compare
view</a></li>
</ul>
</details>
<br />
Updates `esbuild` from 0.25.5 to 0.25.6
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/evanw/esbuild/releases">esbuild's
releases</a>.</em></p>
<blockquote>
<h2>v0.25.6</h2>
<ul>
<li>
<p>Fix a memory leak when <code>cancel()</code> is used on a build
context (<a
href="https://redirect.github.com/evanw/esbuild/issues/4231">#4231</a>)</p>
<p>Calling <code>rebuild()</code> followed by <code>cancel()</code> in
rapid succession could previously leak memory. The bundler uses a
producer/consumer model internally, and the resource leak was caused by
the consumer being termianted while there were still remaining
unreceived results from a producer. To avoid the leak, the consumer now
waits for all producers to finish before terminating.</p>
</li>
<li>
<p>Support empty <code>:is()</code> and <code>:where()</code> syntax in
CSS (<a
href="https://redirect.github.com/evanw/esbuild/issues/4232">#4232</a>)</p>
<p>Previously using these selectors with esbuild would generate a
warning. That warning has been removed in this release for these
cases.</p>
</li>
<li>
<p>Improve tree-shaking of <code>try</code> statements in dead code (<a
href="https://redirect.github.com/evanw/esbuild/issues/4224">#4224</a>)</p>
<p>With this release, esbuild will now remove certain <code>try</code>
statements if esbuild considers them to be within dead code (i.e. code
that is known to not ever be evaluated). For example:</p>
<pre lang="js"><code>// Original code
return 'foo'
try { return 'bar' } catch {}
<p>// Old output (with --minify)
return"foo";try{return"bar"}catch{}</p>
<p>// New output (with --minify)
return"foo";
</code></pre></p>
</li>
<li>
<p>Consider negated bigints to have no side effects</p>
<p>While esbuild currently considers <code>1</code>, <code>-1</code>,
and <code>1n</code> to all have no side effects, it didn't previously
consider <code>-1n</code> to have no side effects. This is because
esbuild does constant folding with numbers but not bigints. However, it
meant that unused negative bigint constants were not tree-shaken. With
this release, esbuild will now consider these expressions to also be
side-effect free:</p>
<pre lang="js"><code>// Original code
let a = 1, b = -1, c = 1n, d = -1n
<p>// Old output (with --bundle --minify)
(()=>{var n=-1n;})();</p>
<p>// New output (with --bundle --minify)
(()=>{})();
</code></pre></p>
</li>
<li>
<p>Support a configurable delay in watch mode before rebuilding (<a
href="https://redirect.github.com/evanw/esbuild/issues/3476">#3476</a>,
<a
href="https://redirect.github.com/evanw/esbuild/issues/4178">#4178</a>)</p>
<p>The <code>watch()</code> API now takes a <code>delay</code> option
that lets you add a delay (in milliseconds) before rebuilding when a
change is detected in watch mode. If you use a tool that regenerates
multiple source files very slowly, this should make it more likely that
esbuild's watch mode won't generate a broken intermediate build before
the successful final build. This option is also available via the CLI
using the <code>--watch-delay=</code> flag.</p>
<p>This should also help avoid confusion about the <code>watch()</code>
API's options argument. It was previously empty to allow for future API
expansion, which caused some people to think that the documentation was
missing. It's no longer empty now that the <code>watch()</code> API has
an option.</p>
</li>
<li>
<p>Allow mixed array for <code>entryPoints</code> API option (<a
href="https://redirect.github.com/evanw/esbuild/issues/4223">#4223</a>)</p>
<p>The TypeScript type definitions now allow you to pass a mixed array
of both string literals and object literals to the
<code>entryPoints</code> API option, such as <code>['foo.js', { out:
'lib', in: 'bar.js' }]</code>. This was always possible to do in
JavaScript but the TypeScript type definitions were previously too
restrictive.</p>
</li>
</ul>
<!-- raw HTML omitted -->
</blockquote>
<p>... (truncated)</p>
</details>
<details>
<summary>Changelog</summary>
<p><em>Sourced from <a
href="https://github.com/evanw/esbuild/blob/main/CHANGELOG.md">esbuild's
changelog</a>.</em></p>
<blockquote>
<h2>0.25.6</h2>
<ul>
<li>
<p>Fix a memory leak when <code>cancel()</code> is used on a build
context (<a
href="https://redirect.github.com/evanw/esbuild/issues/4231">#4231</a>)</p>
<p>Calling <code>rebuild()</code> followed by <code>cancel()</code> in
rapid succession could previously leak memory. The bundler uses a
producer/consumer model internally, and the resource leak was caused by
the consumer being termianted while there were still remaining
unreceived results from a producer. To avoid the leak, the consumer now
waits for all producers to finish before terminating.</p>
</li>
<li>
<p>Support empty <code>:is()</code> and <code>:where()</code> syntax in
CSS (<a
href="https://redirect.github.com/evanw/esbuild/issues/4232">#4232</a>)</p>
<p>Previously using these selectors with esbuild would generate a
warning. That warning has been removed in this release for these
cases.</p>
</li>
<li>
<p>Improve tree-shaking of <code>try</code> statements in dead code (<a
href="https://redirect.github.com/evanw/esbuild/issues/4224">#4224</a>)</p>
<p>With this release, esbuild will now remove certain <code>try</code>
statements if esbuild considers them to be within dead code (i.e. code
that is known to not ever be evaluated). For example:</p>
<pre lang="js"><code>// Original code
return 'foo'
try { return 'bar' } catch {}
<p>// Old output (with --minify)
return"foo";try{return"bar"}catch{}</p>
<p>// New output (with --minify)
return"foo";
</code></pre></p>
</li>
<li>
<p>Consider negated bigints to have no side effects</p>
<p>While esbuild currently considers <code>1</code>, <code>-1</code>,
and <code>1n</code> to all have no side effects, it didn't previously
consider <code>-1n</code> to have no side effects. This is because
esbuild does constant folding with numbers but not bigints. However, it
meant that unused negative bigint constants were not tree-shaken. With
this release, esbuild will now consider these expressions to also be
side-effect free:</p>
<pre lang="js"><code>// Original code
let a = 1, b = -1, c = 1n, d = -1n
<p>// Old output (with --bundle --minify)
(()=>{var n=-1n;})();</p>
<p>// New output (with --bundle --minify)
(()=>{})();
</code></pre></p>
</li>
<li>
<p>Support a configurable delay in watch mode before rebuilding (<a
href="https://redirect.github.com/evanw/esbuild/issues/3476">#3476</a>,
<a
href="https://redirect.github.com/evanw/esbuild/issues/4178">#4178</a>)</p>
<p>The <code>watch()</code> API now takes a <code>delay</code> option
that lets you add a delay (in milliseconds) before rebuilding when a
change is detected in watch mode. If you use a tool that regenerates
multiple source files very slowly, this should make it more likely that
esbuild's watch mode won't generate a broken intermediate build before
the successful final build. This option is also available via the CLI
using the <code>--watch-delay=</code> flag.</p>
<p>This should also help avoid confusion about the <code>watch()</code>
API's options argument. It was previously empty to allow for future API
expansion, which caused some people to think that the documentation was
missing. It's no longer empty now that the <code>watch()</code> API has
an option.</p>
</li>
<li>
<p>Allow mixed array for <code>entryPoints</code> API option (<a
href="https://redirect.github.com/evanw/esbuild/issues/4223">#4223</a>)</p>
<p>The TypeScript type definitions now allow you to pass a mixed array
of both string literals and object literals to the
<code>entryPoints</code> API option, such as <code>['foo.js', { out:
'lib', in: 'bar.js' }]</code>. This was always possible to do in
JavaScript but the TypeScript type definitions were previously too
restrictive.</p>
</li>
</ul>
<!-- raw HTML omitted -->
</blockquote>
<p>... (truncated)</p>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="d38c1f0bc5"><code>d38c1f0</code></a>
publish 0.25.6 to npm</li>
<li><a
href="11e547e2c7"><code>11e547e</code></a>
missing <code>)</code> in release notes</li>
<li><a
href="cc8ac0a5f4"><code>cc8ac0a</code></a>
fix trailing comment whitespace</li>
<li><a
href="1e3fb57adc"><code>1e3fb57</code></a>
fix <a
href="https://redirect.github.com/evanw/esbuild/issues/4178">#4178</a>:
add the <code>--watch-delay=</code> option</li>
<li><a
href="c1f5f18e83"><code>c1f5f18</code></a>
fix <a
href="https://redirect.github.com/evanw/esbuild/issues/4209">#4209</a>:
disable binary executable optimization on WASM platform (<a
href="https://redirect.github.com/evanw/esbuild/issues/4210">#4210</a>)</li>
<li><a
href="3ed5ecce84"><code>3ed5ecc</code></a>
fix incorrect locations in <code>CHANGELOG.md</code></li>
<li><a
href="248089c1a8"><code>248089c</code></a>
fix <a
href="https://redirect.github.com/evanw/esbuild/issues/4224">#4224</a>:
allow <code>try</code> statements to become dead</li>
<li><a
href="42f159cb52"><code>42f159c</code></a>
openharmony: keep makefile targets sorted</li>
<li><a
href="63256e12be"><code>63256e1</code></a>
chore: fix some comments (<a
href="https://redirect.github.com/evanw/esbuild/issues/4211">#4211</a>)</li>
<li><a
href="d803f72e64"><code>d803f72</code></a>
add support for openharmony-arm64 platform (<a
href="https://redirect.github.com/evanw/esbuild/issues/4212">#4212</a>)</li>
<li>Additional commits viewable in <a
href="https://github.com/evanw/esbuild/compare/v0.25.5...v0.25.6">compare
view</a></li>
</ul>
</details>
<br />
Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.
[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)
---
<details>
<summary>Dependabot commands and options</summary>
<br />
You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot merge` will merge this PR after your CI passes on it
- `@dependabot squash and merge` will squash and merge this PR after
your CI passes on it
- `@dependabot cancel merge` will cancel a previously requested merge
and block automerging
- `@dependabot reopen` will reopen this PR if it is closed
- `@dependabot close` will close this PR and stop Dependabot recreating
it. You can achieve the same result by closing it manually
- `@dependabot show <dependency name> ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore <dependency name> major version` will close this
group update PR and stop Dependabot creating any more for the specific
dependency's major version (unless you unignore this specific
dependency's major version or upgrade to it yourself)
- `@dependabot ignore <dependency name> minor version` will close this
group update PR and stop Dependabot creating any more for the specific
dependency's minor version (unless you unignore this specific
dependency's minor version or upgrade to it yourself)
- `@dependabot ignore <dependency name>` will close this group update PR
and stop Dependabot creating any more for the specific dependency
(unless you unignore this specific dependency or upgrade to it yourself)
- `@dependabot unignore <dependency name>` will remove all of the ignore
conditions of the specified dependency
- `@dependabot unignore <dependency name> <ignore condition>` will
remove the ignore condition of the specified dependency and ignore
conditions
</details>
Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Bumps the development-dependencies group with 3 updates in the /
directory: [ava](https://github.com/avajs/ava),
[dotenv](https://github.com/motdotla/dotenv) and
[esbuild](https://github.com/evanw/esbuild).
Updates `ava` from 6.2.0 to 6.3.0
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/avajs/ava/releases">ava's
releases</a>.</em></p>
<blockquote>
<h2>v6.3.0</h2>
<h2>What's Changed</h2>
<ul>
<li>Update dependencies, addressing <code>npm audit</code> warnings by
<a
href="https://github.com/novemberborn"><code>@novemberborn</code></a>
in <a
href="https://redirect.github.com/avajs/ava/pull/3377">avajs/ava#3377</a></li>
<li>Do not count writes to stdout/stderr as non-idling activity for
timeouts by <a
href="https://github.com/mdouglass"><code>@mdouglass</code></a> in <a
href="https://redirect.github.com/avajs/ava/pull/3374">avajs/ava#3374</a></li>
</ul>
<h2>New Contributors</h2>
<ul>
<li><a href="https://github.com/mdouglass"><code>@mdouglass</code></a>
made their first contribution in <a
href="https://redirect.github.com/avajs/ava/pull/3374">avajs/ava#3374</a></li>
</ul>
<p><strong>Full Changelog</strong>: <a
href="https://github.com/avajs/ava/compare/v6.2.0...v6.3.0">https://github.com/avajs/ava/compare/v6.2.0...v6.3.0</a></p>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="ca4240db7f"><code>ca4240d</code></a>
6.3.0</li>
<li><a
href="f243cab3b3"><code>f243cab</code></a>
Do not count writes to stdout/stderr as non-idling activity for
timeouts</li>
<li><a
href="4abb780b5b"><code>4abb780</code></a>
Update dependencies</li>
<li>See full diff in <a
href="https://github.com/avajs/ava/compare/v6.2.0...v6.3.0">compare
view</a></li>
</ul>
</details>
<br />
Updates `dotenv` from 16.4.7 to 16.5.0
<details>
<summary>Changelog</summary>
<p><em>Sourced from <a
href="https://github.com/motdotla/dotenv/blob/master/CHANGELOG.md">dotenv's
changelog</a>.</em></p>
<blockquote>
<h2><a
href="https://github.com/motdotla/dotenv/compare/v16.4.7...v16.5.0">16.5.0</a>
(2025-04-07)</h2>
<h3>Added</h3>
<ul>
<li>🎉 Added new sponsor <a
href="https://graphite.dev/?utm_source=github&utm_medium=repo&utm_campaign=dotenv">Graphite</a>
- <em>the AI developer productivity platform helping teams on GitHub
ship higher quality software, faster</em>.</li>
</ul>
<blockquote>
<p>[!TIP]
<strong><a href="https://github.com/sponsors/motdotla">Become a
sponsor</a></strong></p>
<p>The dotenvx README is viewed thousands of times DAILY on GitHub and
NPM.
Sponsoring dotenv is a great way to get in front of developers and give
back to the developer community at the same time.</p>
</blockquote>
<h3>Changed</h3>
<ul>
<li>Remove <code>_log</code> method. Use <code>_debug</code> <a
href="https://redirect.github.com/motdotla/dotenv/pull/862">#862</a></li>
</ul>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="d39cc9a94e"><code>d39cc9a</code></a>
16.5.0</li>
<li><a
href="2f4e407c73"><code>2f4e407</code></a>
Merge pull request <a
href="https://redirect.github.com/motdotla/dotenv/issues/863">#863</a>
from Fdawgs/patch-1</li>
<li><a
href="a1eef11a70"><code>a1eef11</code></a>
chore(package): add homepage url</li>
<li><a
href="fb7e407892"><code>fb7e407</code></a>
README update</li>
<li><a
href="bf9113fad6"><code>bf9113f</code></a>
README update</li>
<li><a
href="9326f05f95"><code>9326f05</code></a>
changelog 🪵</li>
<li><a
href="2e8da3018a"><code>2e8da30</code></a>
changelog 🪵</li>
<li><a
href="3257b3adaf"><code>3257b3a</code></a>
changelog 🪵</li>
<li><a
href="c0ca62c841"><code>c0ca62c</code></a>
changelog 🪵</li>
<li><a
href="797c5e9d6e"><code>797c5e9</code></a>
changelog 🪵</li>
<li>Additional commits viewable in <a
href="https://github.com/motdotla/dotenv/compare/v16.4.7...v16.5.0">compare
view</a></li>
</ul>
</details>
<br />
Updates `esbuild` from 0.25.2 to 0.25.3
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/evanw/esbuild/releases">esbuild's
releases</a>.</em></p>
<blockquote>
<h2>v0.25.3</h2>
<ul>
<li>
<p>Fix lowered <code>async</code> arrow functions before
<code>super()</code> (<a
href="https://redirect.github.com/evanw/esbuild/issues/4141">#4141</a>,
<a
href="https://redirect.github.com/evanw/esbuild/pull/4142">#4142</a>)</p>
<p>This change makes it possible to call an <code>async</code> arrow
function in a constructor before calling <code>super()</code> when
targeting environments without <code>async</code> support, as long as
the function body doesn't reference <code>this</code>. Here's an example
(notice the change from <code>this</code> to <code>null</code>):</p>
<pre lang="js"><code>// Original code
class Foo extends Object {
constructor() {
(async () => await foo())()
super()
}
}
<p>// Old output (with --target=es2016)<br />
class Foo extends Object {<br />
constructor() {<br />
(() => __async(this, null, function* () {<br />
return yield foo();<br />
}))();<br />
super();<br />
}<br />
}</p>
<p>// New output (with --target=es2016)<br />
class Foo extends Object {<br />
constructor() {<br />
(() => __async(null, null, function* () {<br />
return yield foo();<br />
}))();<br />
super();<br />
}<br />
}<br />
</code></pre></p>
<p>Some background: Arrow functions with the <code>async</code> keyword
are transformed into generator functions for older language targets such
as <code>--target=es2016</code>. Since arrow functions capture
<code>this</code>, the generated code forwards <code>this</code> into
the body of the generator function. However, JavaScript class syntax
forbids using <code>this</code> in a constructor before calling
<code>super()</code>, and this forwarding was problematic since
previously happened even when the function body doesn't use
<code>this</code>. Starting with this release, esbuild will now only
forward <code>this</code> if it's used within the function body.</p>
<p>This fix was contributed by <a
href="https://github.com/magic-akari"><code>@magic-akari</code></a>.</p>
</li>
<li>
<p>Fix memory leak with <code>--watch=true</code> (<a
href="https://redirect.github.com/evanw/esbuild/issues/4131">#4131</a>,
<a
href="https://redirect.github.com/evanw/esbuild/pull/4132">#4132</a>)</p>
<p>This release fixes a memory leak with esbuild when
<code>--watch=true</code> is used instead of <code>--watch</code>.
Previously using <code>--watch=true</code> caused esbuild to continue to
use more and more memory for every rebuild, but
<code>--watch=true</code> should now behave like <code>--watch</code>
and not leak memory.</p>
<p>This bug happened because esbuild disables the garbage collector when
it's not run as a long-lived process for extra speed, but esbuild's
checks for which arguments cause esbuild to be a long-lived process
weren't updated for the new <code>--watch=true</code> style of boolean
command-line flags. This has been an issue since this boolean flag
syntax was added in version 0.14.24 in 2022. These checks are
unfortunately separate from the regular argument parser because of how
esbuild's internals are organized (the command-line interface is exposed
as a separate <a
href="https://pkg.go.dev/github.com/evanw/esbuild/pkg/cli">Go API</a> so
you can build your own custom esbuild CLI).</p>
<p>This fix was contributed by <a
href="https://github.com/mxschmitt"><code>@mxschmitt</code></a>.</p>
</li>
<li>
<p>More concise output for repeated legal comments (<a
href="https://redirect.github.com/evanw/esbuild/issues/4139">#4139</a>)</p>
<p>Some libraries have many files and also use the same legal comment
text in all files. Previously esbuild would copy each legal comment to
the output file. Starting with this release, legal comments duplicated
across separate files will now be grouped in the output file by unique
comment content.</p>
</li>
</ul>
<!-- raw HTML omitted -->
</blockquote>
<p>... (truncated)</p>
</details>
<details>
<summary>Changelog</summary>
<p><em>Sourced from <a
href="https://github.com/evanw/esbuild/blob/main/CHANGELOG.md">esbuild's
changelog</a>.</em></p>
<blockquote>
<h2>0.25.3</h2>
<ul>
<li>
<p>Fix lowered <code>async</code> arrow functions before
<code>super()</code> (<a
href="https://redirect.github.com/evanw/esbuild/issues/4141">#4141</a>,
<a
href="https://redirect.github.com/evanw/esbuild/pull/4142">#4142</a>)</p>
<p>This change makes it possible to call an <code>async</code> arrow
function in a constructor before calling <code>super()</code> when
targeting environments without <code>async</code> support, as long as
the function body doesn't reference <code>this</code>. Here's an example
(notice the change from <code>this</code> to <code>null</code>):</p>
<pre lang="js"><code>// Original code
class Foo extends Object {
constructor() {
(async () => await foo())()
super()
}
}
<p>// Old output (with --target=es2016)<br />
class Foo extends Object {<br />
constructor() {<br />
(() => __async(this, null, function* () {<br />
return yield foo();<br />
}))();<br />
super();<br />
}<br />
}</p>
<p>// New output (with --target=es2016)<br />
class Foo extends Object {<br />
constructor() {<br />
(() => __async(null, null, function* () {<br />
return yield foo();<br />
}))();<br />
super();<br />
}<br />
}<br />
</code></pre></p>
<p>Some background: Arrow functions with the <code>async</code> keyword
are transformed into generator functions for older language targets such
as <code>--target=es2016</code>. Since arrow functions capture
<code>this</code>, the generated code forwards <code>this</code> into
the body of the generator function. However, JavaScript class syntax
forbids using <code>this</code> in a constructor before calling
<code>super()</code>, and this forwarding was problematic since
previously happened even when the function body doesn't use
<code>this</code>. Starting with this release, esbuild will now only
forward <code>this</code> if it's used within the function body.</p>
<p>This fix was contributed by <a
href="https://github.com/magic-akari"><code>@magic-akari</code></a>.</p>
</li>
<li>
<p>Fix memory leak with <code>--watch=true</code> (<a
href="https://redirect.github.com/evanw/esbuild/issues/4131">#4131</a>,
<a
href="https://redirect.github.com/evanw/esbuild/pull/4132">#4132</a>)</p>
<p>This release fixes a memory leak with esbuild when
<code>--watch=true</code> is used instead of <code>--watch</code>.
Previously using <code>--watch=true</code> caused esbuild to continue to
use more and more memory for every rebuild, but
<code>--watch=true</code> should now behave like <code>--watch</code>
and not leak memory.</p>
<p>This bug happened because esbuild disables the garbage collector when
it's not run as a long-lived process for extra speed, but esbuild's
checks for which arguments cause esbuild to be a long-lived process
weren't updated for the new <code>--watch=true</code> style of boolean
command-line flags. This has been an issue since this boolean flag
syntax was added in version 0.14.24 in 2022. These checks are
unfortunately separate from the regular argument parser because of how
esbuild's internals are organized (the command-line interface is exposed
as a separate <a
href="https://pkg.go.dev/github.com/evanw/esbuild/pkg/cli">Go API</a> so
you can build your own custom esbuild CLI).</p>
<p>This fix was contributed by <a
href="https://github.com/mxschmitt"><code>@mxschmitt</code></a>.</p>
</li>
<li>
<p>More concise output for repeated legal comments (<a
href="https://redirect.github.com/evanw/esbuild/issues/4139">#4139</a>)</p>
</li>
</ul>
<!-- raw HTML omitted -->
</blockquote>
<p>... (truncated)</p>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="677910b073"><code>677910b</code></a>
publish 0.25.3 to npm</li>
<li><a
href="a41040efdb"><code>a41040e</code></a>
fix <a
href="https://redirect.github.com/evanw/esbuild/issues/4110">#4110</a>:
support custom non-IP <code>host</code> values</li>
<li><a
href="dfe0e1c632"><code>dfe0e1c</code></a>
fix <a
href="https://redirect.github.com/evanw/esbuild/issues/4114">#4114</a>:
add a limit to css nesting expansion</li>
<li><a
href="a54916b92c"><code>a54916b</code></a>
fix <a
href="https://redirect.github.com/evanw/esbuild/issues/4139">#4139</a>:
deduplicate repeated legal comments</li>
<li><a
href="dc60e6025d"><code>dc60e60</code></a>
run <code>make update-compat-table</code></li>
<li><a
href="d917038c97"><code>d917038</code></a>
fix <a
href="https://redirect.github.com/evanw/esbuild/issues/4144">#4144</a>:
node path resolution edge case</li>
<li><a
href="7ed168403b"><code>7ed1684</code></a>
fix <a
href="https://redirect.github.com/evanw/esbuild/issues/4141">#4141</a>:
Avoid redundant <code>this</code> access during async function lowering
(<a
href="https://redirect.github.com/evanw/esbuild/issues/4142">#4142</a>)</li>
<li><a
href="edc3a23438"><code>edc3a23</code></a>
docs(dev): update alias command for <code>make test-go</code> (<a
href="https://redirect.github.com/evanw/esbuild/issues/4113">#4113</a>)</li>
<li><a
href="1ee8b6717e"><code>1ee8b67</code></a>
workaround <code>process.exit()</code> not exiting in node</li>
<li><a
href="5c56e0737c"><code>5c56e07</code></a>
changelog note with credit for the fix</li>
<li>Additional commits viewable in <a
href="https://github.com/evanw/esbuild/compare/v0.25.2...v0.25.3">compare
view</a></li>
</ul>
</details>
<br />
Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.
[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)
---
<details>
<summary>Dependabot commands and options</summary>
<br />
You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot merge` will merge this PR after your CI passes on it
- `@dependabot squash and merge` will squash and merge this PR after
your CI passes on it
- `@dependabot cancel merge` will cancel a previously requested merge
and block automerging
- `@dependabot reopen` will reopen this PR if it is closed
- `@dependabot close` will close this PR and stop Dependabot recreating
it. You can achieve the same result by closing it manually
- `@dependabot show <dependency name> ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore <dependency name> major version` will close this
group update PR and stop Dependabot creating any more for the specific
dependency's major version (unless you unignore this specific
dependency's major version or upgrade to it yourself)
- `@dependabot ignore <dependency name> minor version` will close this
group update PR and stop Dependabot creating any more for the specific
dependency's minor version (unless you unignore this specific
dependency's minor version or upgrade to it yourself)
- `@dependabot ignore <dependency name>` will close this group update PR
and stop Dependabot creating any more for the specific dependency
(unless you unignore this specific dependency or upgrade to it yourself)
- `@dependabot unignore <dependency name>` will remove all of the ignore
conditions of the specified dependency
- `@dependabot unignore <dependency name> <ignore condition>` will
remove the ignore condition of the specified dependency and ignore
conditions
</details>
Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Bumps [@octokit/openapi](https://github.com/octokit/openapi) from 18.2.0
to 19.0.0.
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/octokit/openapi/releases"><code>@octokit/openapi</code>'s
releases</a>.</em></p>
<blockquote>
<h2>v19.0.0</h2>
<h1><a
href="https://github.com/octokit/openapi/compare/v18.2.0...v19.0.0">19.0.0</a>
(2025-04-09)</h1>
<h3>Features</h3>
<ul>
<li>new <code>/orgs/{org}/campaigns</code>,
<code>/orgs/{org}/campaigns/{campaign_number}</code> endpoints, remove
Copilot usage endpoints, description updates, remove GHES 3.12 (<a
href="https://redirect.github.com/octokit/openapi/issues/491">#491</a>)
(<a
href="709a8f01d5">709a8f0</a>)</li>
</ul>
<h3>BREAKING CHANGES</h3>
<ul>
<li>Drop GHES 3.12</li>
<li>Remove Copilot usage endpoints</li>
</ul>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="709a8f01d5"><code>709a8f0</code></a>
feat: new <code>/orgs/{org}/campaigns</code>,
<code>/orgs/{org}/campaigns/{campaign_number}</code> ...</li>
<li><a
href="329c7ebe37"><code>329c7eb</code></a>
ci(action): update actions/create-github-app-token action to v2 (<a
href="https://redirect.github.com/octokit/openapi/issues/490">#490</a>)</li>
<li><a
href="e2e9e6ede2"><code>e2e9e6e</code></a>
ci: replace <code>OCTOKITBOT_PROJECT_ACTION_TOKEN</code> and
<code>OCTOKITBOT_PAT</code> with a tok...</li>
<li><a
href="d59338c42c"><code>d59338c</code></a>
build(deps): lock file maintenance (<a
href="https://redirect.github.com/octokit/openapi/issues/488">#488</a>)</li>
<li>See full diff in <a
href="https://github.com/octokit/openapi/compare/v18.2.0...v19.0.0">compare
view</a></li>
</ul>
</details>
<br />
[](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)
Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.
[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)
---
<details>
<summary>Dependabot commands and options</summary>
<br />
You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot merge` will merge this PR after your CI passes on it
- `@dependabot squash and merge` will squash and merge this PR after
your CI passes on it
- `@dependabot cancel merge` will cancel a previously requested merge
and block automerging
- `@dependabot reopen` will reopen this PR if it is closed
- `@dependabot close` will close this PR and stop Dependabot recreating
it. You can achieve the same result by closing it manually
- `@dependabot show <dependency name> ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore this major version` will close this PR and stop
Dependabot creating any more for this major version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this minor version` will close this PR and stop
Dependabot creating any more for this minor version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this dependency` will close this PR and stop
Dependabot creating any more for this dependency (unless you reopen the
PR or upgrade to it yourself)
</details>
Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
This pull request fixes the handling of permissions inputs.
- Updated `getPermissionsFromInputs` in
`lib/get-permissions-from-inputs.js` to use hyphens
(`INPUT_PERMISSION-`) instead of underscores (`INPUT_PERMISSION_`) in
input keys, added a check to skip empty values, and clarified behavior
when no permissions are set.
- Added a `shouldRetry` function to retry requests when server errors
(HTTP status 500 or higher) occur in the `main` function in
`lib/main.js` to prevent unnecessary retries.
- Updated test cases in `tests/main-token-permissions-set.test.js` to
match the new input key format with hyphens.
- Added a default empty string for unset inputs (e.g.,
`INPUT_PERMISSION-ADMINISTRATION`) in `tests/main.js` to simulate the
behavior of the Actions runner.
- Updated snapshots in `tests/snapshots/index.js.md` to reflect the
updated hyphenated input keys in permissions.
---------
Co-authored-by: Gregor Martynus <39992+gr2m@users.noreply.github.com>
This PR switches from evaluating values passed to `skip-token-revoke` as
true if they are truthy in JavaScript, to using `getBooleanInput`. This
change ensures that only proper YAML boolean values are recognized,
preventing unintended evaluations to true.
- The definition of `getBooleanInput` is here: definition of
`core#getBooealnInput` is here:
930c890727/packages/core/src/core.ts (L188-L208)
The documentation states, `"If truthy, the token will not be revoked
when the current job is complete"`, so this change could be considered a
breaking change. This means that if there are users who rely on `truthy`
and expect values like whitespace or `"false"` to be evaluated as true
(though this is likely rare), it would be a breaking change.
- `Boolean(" ")` and `Boolean("false")` are both evaluated as true.
Alternatively, it can simply be considered a fix. How to handle this is
up to the maintainer.
Resolves https://github.com/actions/create-github-app-token/issues/216
BREAKING CHANGE: Removed deprecated inputs (`app_id`, `private_key`, `skip_token_revoke`) and made `app-id` and `private-key` required in the action configuration.
This pull request updates the release configuration to include
package-lock.json. This should ensure the action version is update in
package-lock.json when the release workflow runs.
It seems that there is an unused badge in this repository. This badge
was introduced in
https://github.com/actions/create-github-app-token/pull/70, but after
some trial and error, it was removed from the README
(f28f8958a7
in the PR). However, the badge itself was not deleted.
Therefore, this badge appears to be unnecessary. This patch removes it.
- Load `app-permissions` from schema exported by `@octokit/openapi`
- Update documentation in README.md
- Implement the `permissions_*` inputs in the action code
---------
Co-authored-by: Parker Brown <17183625+parkerbxyz@users.noreply.github.com>
dependabot[bot]