pnpm/.changeset/github-actions-safe-updates.md at pnpr@0.1.0-alpha.12

mirror/pnpm

0 Fork 0

mirror of https://github.com/pnpm/pnpm.git synced 2026-10-11 18:14:18 -04:00

Files

T

Zoltan Kochan 8d4b588669 refactor: share wildcard matching and harden github actions updates (#14807 )

Give wildcard matching and GitHub Actions dependency handling independent
crate boundaries. Preserve config's matcher reexport and keep CLI opt-in
policy separate from workflow processing.

Replace duplicate literal-star matchers in global listing and versioning
with the shared compiled matcher, preserving each caller's negation and
empty-selector behavior. Remove configuration from workspace filtering's
production dependency graph and move YAML dependencies out of the CLI.

Validate planned workflow edits against freshly read action text after
asynchronous Git lookups. Reject stale ranges without overwriting the
changed workflow. Redact homepage credentials and restrict GitHub server
URLs to HTTPS or loopback HTTP in both CLI versions, with regression tests
and a shared release note.

Follow-up to pnpm/pnpm#14804.

2026-09-10 21:51:04 +02:00

366 B

Raw Permalink Blame History

@pnpm/deps.github-actions, pnpm, pacquet

@pnpm/deps.github-actions	pnpm	pacquet
patch	patch	patch

GitHub Actions updates now stop if an action reference changes while its versions are being resolved. Unrelated workflow edits are preserved.

GitHub Actions homepage links no longer expose server credentials. GitHub server URLs now require HTTPS, with HTTP allowed only for loopback hosts.

366 B Raw Permalink Blame History

366 B

Raw Permalink Blame History