Skip to content

Update all non-major dependencies - #1467

Merged
marcleblanc2 merged 1 commit into
mainfrom
renovate/all-minor-patch
Nov 10, 2026
Merged

Update all non-major dependencies#1467
marcleblanc2 merged 1 commit into
mainfrom
renovate/all-minor-patch

Conversation

@renovate

@renovate renovate Bot commented Nov 10, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

Note

This PR body was truncated due to platform limits.

This PR contains the following updates:

Package Change Age Confidence Type Update New value References Sourcegraph
@sourcegraph/prettierrc 3.0.2 → 3.0.3 age confidence devDependencies patch 3.0.3 source code search for "@sourcegraph/prettierrc"
github-cli 2.46.0 → 2.103.3 age confidence minor 2.103.3 source code search for "github-cli"
node (source) 16.7.0 → 16.20.2 age confidence minor 16.20.2 homepage, source code search for "node"

Test plan: CI should pass with updated dependencies. No review required: this is an automated dependency update PR.

Release Notes

sourcegraph/prettierrc (@​sourcegraph/prettierrc)

v3.0.3

Compare Source

cli/cli (github-cli)

v2.103.3: GitHub CLI 2.103.3

Compare Source

What's Changed

🐛 Fixes
  • fix(gh auth status): explain expired expiring tokens with --no-refresh by @​babakks in #​14815

Full Changelog: cli/cli@v2.103.2...v2.103.3

v2.103.2: GitHub CLI 2.103.2

Compare Source

🐛 Fixes

New Contributors

Full Changelog: cli/cli@v2.103.1...v2.103.2

v2.103.1: GitHub CLI 2.103.1

Compare Source

What's Changed

🐛 Fixes
📚 Docs & Chores
:dependabot: Dependencies

Full Changelog: cli/cli@v2.103.0...v2.103.1

v2.103.0: GitHub CLI 2.103.0

Compare Source

Expiring, auto-refreshing OAuth tokens (preview)

gh can now sign in with expiring OAuth credentials that it refreshes automatically. When you opt in, gh stores a short-lived access token alongside a rotating refresh token and refreshes the access token whenever it is needed, so you stay signed in without having to authenticate again.

To opt in for a single sign-in, run:

gh auth login --expiring

To prefer expiring credentials for every sign-in, run:

gh config set expiring_credentials enabled

gh auth status shows whether a credential is refreshable and when the current access token expires. Both gh auth status and gh auth token automatically refresh the access token when needed. Expiring tokens are available on github.com and GHE.com; on hosts that do not issue them, gh falls back to a regular non-expiring token.

If you use HTTPS as your git protocol, we advise using git 2.46 or newer and letting gh act as your git credential helper by running gh auth setup-git. This way gh serves and refreshes the expiring credential for git, and git does not cache it past its lifetime.

[!IMPORTANT]
Expiring access tokens should not be cached. Scripts and extensions that store the output of gh auth token will eventually hold an expired token, so run gh auth token again each time a token is needed. Tokens supplied through GH_TOKEN or GITHUB_TOKEN are never refreshed.

For more information, see Authenticating with GitHub CLI.

Manage issue artifacts with gh issue artifact (private preview)

gh issue artifact brings issue artifacts to the command line. Users and organizations enrolled in the private preview can use the list, view, create, edit, download, and delete commands to manage issue artifacts.

# Create a Markdown document with an attached image
gh issue artifact create 142 signin-plan.md --attach ./signin-flow.png

# Create an HTML document
gh issue artifact create 142 menu-prototype.html

# List or view artifacts
gh issue artifact list 142
gh issue artifact view 142 2

# Update a document or restore an earlier version
gh issue artifact edit 142 2 --body-file signin-plan-v2.md
gh issue artifact edit 142 2 --restore-version 5

Artifacts can also be addressed by their GitHub URLs, and Markdown documents support image and video attachments with --attach.

[!IMPORTANT]
Issue artifacts are in private preview. These commands only work for repositories enrolled in the preview. See the Issue Artifacts private preview announcement and feedback discussion for access instructions and to share feedback.

What's Changed
✨ Features
🐛 Fixes
📚 Docs & Chores
:dependabot: Dependencies
New Contributors

Full Changelog: cli/cli@v2.102.1...v2.103.0

v2.102.1: GitHub CLI 2.102.1

Compare Source

What's Changed

:dependabot: Dependencies

chore(deps): bump Go toolchain from 1.27.1 to 1.27.3 and golang.org/x/net from 0.58.0 to 0.60.0

Full Changelog: cli/cli@v2.102.0...v2.102.1

v2.102.0: GitHub CLI 2.102.0

Compare Source

Security

Four security vulnerabilities have been identified, and fixed, in this release. Users are advised to update gh to version v2.102.0 as soon as possible.

gh release download, gh run download, gh repo read-file --output, and gh attestation download could write remote content to an unintended local file when the destination contained symbolic links.

See GHSA-39wj-f2f4-978v for more information.

gh attestation verify compared the --source-ref value case-insensitively, so an attestation built from a branch whose name differs only in case could satisfy a policy that named a different branch.

See GHSA-4mq3-hpgx-9cx8 for more information.

Interactive gh skill search passed repository paths from search results to gh skill install without an option separator, so a search result could inject installer options and change where skill files were written.

See GHSA-qcwj-mr2r-2cx7 for more information.

gh attestation verify matched the --signer-workflow value against only the start of the signing certificate's identity, so an attestation signed by a different workflow in the pinned repository could pass verification when its path began with the pinned value.

See GHSA-wjmr-j3rp-mh2g for more information.

What's Changed

🐛 Fixes
📚 Docs & Chores
:dependabot: Dependencies

Full Changelog: cli/cli@v2.101.0...v2.102.0

v2.101.0: GitHub CLI 2.101.0

Compare Source

Linux package repository signing key rotation

GitHub CLI's APT and RPM repositories, along with individual RPM packages, are now signed only with the new PGP key (fingerprint: 7F38BBB59D064DBCB3D84D725612B36462313325)

[!IMPORTANT]
Linux users who installed gh from the official APT or RPM repositories before April 8, 2026, and have not refreshed their keyring, may now see package installation or update failures. Follow the PGP signing key rotation guidance to check and update your keyring. Users on Windows or macOS, and users who installed gh through Homebrew, GitHub Releases, another package manager, or from source, are not affected.

Copy authentication codes to the clipboard by default

gh auth login and gh auth refresh now copy OAuth device codes to the clipboard by default, saving a manual copy step during authentication.

To persistently opt out, run:

gh config set clipboard disabled

Explicit clipboard options still take precedence for an individual invocation.

What's Changed

✨ Features
🐛 Fixes
📚 Docs & Chores
:dependabot: Dependencies

New Contributors

Full Changelog: cli/cli@v2.100.0...v2.101.0

v2.100.0: GitHub CLI 2.100.0

Compare Source

Experimental: Route GitHub API traffic through a custom host

Organizations can now route a GitHub host's API traffic through a gateway using the new per-host api_host configuration:

# Route API traffic for github.com through a gateway
gh config set api_host gh-gateway.example.com --host github.com

# Read the configured API host
gh config get api_host --host github.com

The original host remains in use for authentication, Git remotes, and browser URLs.

[!NOTE]
api_host is experimental and is not a security boundary. Requests may still reach the original host.

What's Changed

✨ Features
🐛 Fixes
📚 Docs & Chores
:dependabot: Dependencies

Full Changelog: cli/cli@v2.99.0...v2.100.0

v2.99.0: GitHub CLI 2.99.0

Compare Source

Attach images and videos to issues and pull requests

The repeatable --attach flag uploads local images and videos and adds them to issue, pull request, or comment bodies. If a body already references the local path, gh replaces it with the uploaded URL; otherwise it appends the attachment:

# Attach files when creating or editing an issue
gh issue create --attach './repro.png#The error state'
gh issue edit 123 --attach ./walkthrough.mp4

# Attach files when creating or editing a pull request
gh pr create --attach ./before.png
gh pr edit 456 --attach ./after.png

# Attach files to comments
gh issue comment 123 --attach ./repro.png
gh pr comment 456 --attach ./result.mp4

Repeat the flag to attach multiple files in a single invocation. Attachments are available on GitHub.com and GitHub Enterprise Cloud.

For more information see https://gh.io/gh-attach and https://github.blog/changelog/2026-09-01-github-cli-media-in-issues-pull-requests-and-comments/

Worktree support extended to gh issue develop

gh issue develop can now create a linked branch and check it out in a new Git worktree, leaving your current working copy unchanged:

# Create a linked branch for an issue and check it out in a worktree
gh issue develop 123 --checkout --worktree /path/to/wt-feature

What's Changed

✨ Features
🐛 Fixes
📚 Docs & Chores
:dependabot: Dependencies

New Contributors

Full Changelog: cli/cli@v2.98.0...v2.99.0

v2.98.0: GitHub CLI 2.98.0

Compare Source

Security

A security vulnerability has been identified, and fixed, that binds the local forwarded port to all available network interfaces by default.

Users of gh codespace ports forward are advised to update gh to version v2.98.0 as soon as possible.

For more information see: <https://github.com/cli/cli/secu

[!IMPORTANT]
✂ PR body was truncated to here.

Configuration

📅 Schedule: (in timezone America/Los_Angeles)

  • Branch creation
    • At any time (no schedule defined)
  • Automerge
    • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

  • If you want to rebase/retry this PR, check this box

This PR was generated by Mend Renovate. View the repository job log.

@github-actions

github-actions Bot commented Nov 10, 2026 •
edited
Loading

Copy link
Copy Markdown

Open the Diff Tour for this PR in Sourcegraph

@renovate
renovate Bot force-pushed the renovate/all-minor-patch branch from eda7cec to a219a97 Compare November 10, 2026 20:49
@marcleblanc2
marcleblanc2 enabled auto-merge (squash) November 10, 2026 23:20
@marcleblanc2
marcleblanc2 merged commit e5483a3 into main Nov 10, 2026
4 checks passed
@marcleblanc2
marcleblanc2 deleted the renovate/all-minor-patch branch November 10, 2026 23:21
marcleblanc2 added a commit that referenced this pull request Nov 10, 2026
@marcleblanc2 @ampagent
Merge branch 'main' into marc/consolidate-ci-fixes
41dc95a 
Resolves the .tool-versions conflict with #1467: main's versions, plus shellcheck.

Amp-Thread-ID: https://ampcode.com/threads/T-01a1c7a5-6b65-723b-980c-b85e1e9008b5
Co-authored-by: Amp <amp@ampcode.com>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@marcleblanc2 marcleblanc2 marcleblanc2 approved these changes

Assignees

No one assigned

Labels

bot internal package npm

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

1 participant

@marcleblanc2