[DX-1107] Sync fork with upstream shivammathur 2.37.2 - #9
Closed
rokas-reizgys-tg wants to merge 333 commits into
Closed
[DX-1107] Sync fork with upstream shivammathur 2.37.2#9rokas-reizgys-tg wants to merge 333 commits into
rokas-reizgys-tg wants to merge 333 commits into
Conversation
PHP 8.2 is no longer in active support and only receives security fixes, see announcement at <https://news-web.php.net/php.internals/126138>.
README: update list of PHP versions
…or-openswoole-ext Change openswoole priority
…-to-24 Move `ubuntu-latest` to 24.04
switch to launchpadcontent shivammathur#927 close
also add a .node-version file
Change TOOLS_DIR to SETUP_PHP_TOOLS_DIR to prevent regression
Add tool support for pie
Bumps the npm_and_yarn group with 1 update in the / directory: [undici](https://github.com/nodejs/undici). Updates `undici` from 5.28.5 to 5.29.0 - [Release notes](https://github.com/nodejs/undici/releases) - [Commits](nodejs/undici@v5.28.5...v5.29.0) --- updated-dependencies: - dependency-name: undici dependency-version: 5.29.0 dependency-type: indirect dependency-group: npm_and_yarn ... Signed-off-by: dependabot[bot] <support@github.com>
…_and_yarn/npm_and_yarn-66413a1f6e Bump picomatch from 2.3.1 to 2.3.2 in the npm_and_yarn group across 1 directory
Bumps [codecov/codecov-action](https://github.com/codecov/codecov-action) from 5 to 6. - [Release notes](https://github.com/codecov/codecov-action/releases) - [Changelog](https://github.com/codecov/codecov-action/blob/main/CHANGELOG.md) - [Commits](codecov/codecov-action@v5...v6) --- updated-dependencies: - dependency-name: codecov/codecov-action dependency-version: '6' dependency-type: direct:production update-type: version-update:semver-major ... Signed-off-by: dependabot[bot] <support@github.com>
…hub_actions/develop/codecov/codecov-action-6 Bump codecov/codecov-action from 5 to 6
Fix composer v2 version in README
Update Node.js dependencies
Bumps the github-actions group with 2 updates: [github/codeql-action](https://github.com/github/codeql-action) and [codecov/codecov-action](https://github.com/codecov/codecov-action). Updates `github/codeql-action` from 4.35.5 to 4.36.0 - [Release notes](https://github.com/github/codeql-action/releases) - [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md) - [Commits](github/codeql-action@9e0d7b8...7211b7c) Updates `codecov/codecov-action` from 6.0.0 to 6.0.1 - [Release notes](https://github.com/codecov/codecov-action/releases) - [Changelog](https://github.com/codecov/codecov-action/blob/main/CHANGELOG.md) - [Commits](codecov/codecov-action@57e3a13...e79a696) --- updated-dependencies: - dependency-name: github/codeql-action dependency-version: 4.36.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: github-actions - dependency-name: codecov/codecov-action dependency-version: 6.0.1 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: github-actions ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Update Node.js dependencies
Node 20 is removed from GitHub-hosted runners on 2026-09-16. The fork was pinned at 2.30.4, which declares node20. Upstream 2.37.2 declares node24. Merged upstream tag 2.37.2, not upstream main. main sits 29 unreleased commits after that tag, so merging main would ship unreleased code under a version number that does not match upstream. The resulting tree equals upstream 2.37.2 byte for byte, except CODEOWNERS. The fork carried no functional patch. Its 10 commits ahead of upstream were one CODEOWNERS file and five Dependabot lockfile bumps that upstream has long since superseded. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
rokas-reizgys-tg
had a problem deploying
to
codecov
August 27, 2026 09:24 — with 
GitHub Actions
Failure
GitHub Actions
Failure
rokas-reizgys-tg
had a problem deploying
to
codecov
August 27, 2026 09:24 — with
GitHub Actions
Failure
GitHub Actions
Failure
rokas-reizgys-tg
had a problem deploying
to
codecov
August 27, 2026 09:24 — with
GitHub Actions
Failure
GitHub Actions
Failure
Wiz Scan Summary
To detect these findings earlier in the dev lifecycle, try the Wiz Code extension for VS Code, JetBrains, or Visual Studio. |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Task DX-1107
Problem
The fork is pinned at 2.30.4, which declares
node20. Node 20 leaves GitHub-hosted runners on 2026-09-16. 25 repos use this action and none can move until a node24 tag exists here.Solution
Merged upstream tag
2.37.2, which declaresnode24. The tree now equals upstream2.37.2byte for byte, exceptCODEOWNERS.Merged the tag, not upstream
main, becausemainsits 29 unreleased commits after it, including a TypeScript 7 migration.The fork carried no functional patch. Its 10 commits ahead were
CODEOWNERSplus five Dependabot lockfile bumps that upstream superseded.Testing
Main workflow: 65 jobs, all pass. Node workflow: red on
npm auditonly.That failure is inherited, not introduced.
package-lock.jsonis identical to upstream2.37.2. All three advisories are transitive dev-only, sonpm audit --omit=devreports 0 and nothing reaches the bundle consumers run. Upstream fixed the audit after tagging, via anoverridesblock among those 29 unreleased commits.