Skip to content

build(deps): bump sympress/workflows/.github/workflows/dependency-canary.yml from 1.2.5 to 1.2.6 - #57

Open
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/github_actions/sympress/workflows/dot-github/workflows/dependency-canary.yml-1.2.6
Open

dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/github_actions/sympress/workflows/dot-github/workflows/dependency-canary.yml-1.2.6

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Nov 2, 2026

Copy link
Copy Markdown
Contributor

Bumps sympress/workflows/.github/workflows/dependency-canary.yml from 1.2.5 to 1.2.6.

Release notes

Sourced from sympress/workflows/.github/workflows/dependency-canary.yml's releases.

v1.2.6

Maintenance release for the reviewed Dependabot updates in #41, #43 and #44.

  • Patch Handlebars 4.7.10, Undici 7.30.1 and the Markdown-it 14.3.3 security override.
  • Update the Conventional Commits preset to 10.4.1 and refresh immutable GitHub Action pins.
  • Keep action version comments and the security-action contract aligned with their exact tags.

Validation: repository contracts, generated interfaces, actionlint, documentation, dependency audits, artifact/provenance and credential-isolation tests, private Composer cache round trips and native release-note dry runs. The exact main commit passed all checks. [Starter #54](SymPress/starter#54) passed its complete CI as the real consumer canary. The unchanged private-cache fixture also passed ten runs each with the official Composer 2.10.3 and 2.11.1 binaries following a transient main-run failure.

Commits
  • 9ab936c test(ci): validate the updated workflow security action pin
  • eca21e6 chore(deps): bump the github-actions group across 1 directory with 9 updates
  • cbe9360 chore(deps): bump conventional-changelog-conventionalcommits
  • 94e5da6 fix(ci): use the actual setup-php version tag in comments
  • 2f6531d fix(ci): use the actual setup-php version tag in comments
  • 7331602 fix(deps): patch the release tooling Undici transport
  • 27a230a fix(deps): patch the Markdown parser security override
  • 7b656e4 fix(ci): match package and browser action comments to pinned refs
  • 762e83a fix(ci): match build and deployment action comments to pinned refs
  • 7886c63 chore(deps): bump handlebars
  • See full diff in compare view

Dependabot compatibility score

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.


Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
  • @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
  • @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
  • @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

…ary.yml

Bumps [sympress/workflows/.github/workflows/dependency-canary.yml](https://github.com/sympress/workflows) from 1.2.5 to 1.2.6.
- [Release notes](https://github.com/sympress/workflows/releases)
- [Changelog](https://github.com/SymPress/workflows/blob/main/docs/release.md)
- [Commits](SymPress/workflows@a044303...9ab936c)

---
updated-dependencies:
- dependency-name: sympress/workflows/.github/workflows/dependency-canary.yml
  dependency-version: 1.2.6
  dependency-type: direct:production
  update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot Bot added the dependencies Pull requests that update a dependency file label Nov 2, 2026
@dependabot
dependabot Bot requested a review from brianvarskonst as a code owner November 2, 2026 05:53
@dependabot dependabot Bot added the github_actions Pull requests that update GitHub Actions code label Nov 2, 2026

This branch has not been deployed

No deployments
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

dependencies Pull requests that update a dependency file github_actions Pull requests that update GitHub Actions code

Projects

None yet

Development

Successfully merging this pull request may close these issues.

0 participants