Skip to content

fix(deps): update external major (major) - #2483

Open
renovate[bot] wants to merge 1 commit into
mainfrom
renovate-major-external-major
Open

fix(deps): update external major (major)#2483
renovate[bot] wants to merge 1 commit into
mainfrom
renovate-major-external-major

Conversation

@renovate

@renovate renovate Bot commented May 25, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

ℹ️ Note

This PR body was truncated due to platform limits.

This PR contains the following updates:

Package Change Age Confidence Type Update
@semantic-release/changelog 6.0.3 → 7.0.0 age confidence devDependencies major
@semantic-release/git 10.0.1 → 11.0.1 age confidence devDependencies major
@slack/bolt (source) 4.7.2 → 5.1.0 age confidence dependencies major
@slack/web-api (source) 7.15.2 → 8.1.1 age confidence dependencies major
actions/checkout v4 → v7 age confidence action major
actions/checkout v6 → v7 age confidence action major
actions/setup-node v6 → v7 age confidence action major
adobe/mysticat-ci v1 → v3 age confidence action major
c8 ^11.0.0 → ^12.0.0 age confidence devDependencies major
dotenv 17.4.2 → 18.0.1 age confidence devDependencies major
dynamo-db-local ^10.3.0 → ^11.0.0 age confidence devDependencies major
mocha (source) 11.7.5 → 12.0.2 age confidence devDependencies major
node-html-parser 7.1.0 → 9.0.4 age confidence dependencies major
typescript (source) 6.0.3 → 7.0.2 age confidence devDependencies major

Release Notes

semantic-release/changelog (@​semantic-release/changelog)

v7.0.0

Compare Source

Features
BREAKING CHANGES
  • @semantic-release/changelog is now a native ES
    Module. It has named exports for each plugin hook (verifyConditions,
    prepare)
  • the minimum required version of semantic-release to use
    @semantic-release/changelog is now
    v20.1.0
Other Notable Changes
  • Replaced xo with prettier with default configuration; following
    newly established convention
  • Replaced nyc with c8 for code coverage
  • Replaced lodash with lodash-es for proper esm support
Related Issue
semantic-release/git (@​semantic-release/git)

v11.0.1

Compare Source

Bug Fixes

v11.0.0

Compare Source

Features
BREAKING CHANGES
  • @semantic-release/git is now a native ES Module. It
    has named exports for each plugin hook (verifyConditions, prepare)
  • the minimum required version of semantic-release to use
    @semantic-release/git is now v20.1.0
Other Notable Changes
  • @semantic-release/error ^3 → ^4 (ESM-only)
  • aggregate-error ^3 → ^5 (ESM-only, uses native AggregateError)
  • execa ^5 → ^9 (ESM-only, named export)
  • p-reduce ^2 → ^3 (ESM-only)
  • Removed CJS-only devDeps: clear-module, file-url, fs-extra,
    get-stream, nyc
  • Added c8 for coverage; bumped ava, sinon, tempy,
    semantic-release, prettier
  • Engine: ^22.22.2 || >= 24.15;
  • Scripts: nyc → c8, added pretest, removed test:ci
Related Issue
slackapi/bolt-js (@​slack/bolt)

v5.1.0

Compare Source

Minor Changes

  • 6cf7b0c: Enforce a configurable request body size limit in HTTPReceiver and ExpressReceiver to prevent unauthenticated large-body denial-of-service attempts. Both receivers previously buffered the entire request body into memory before signature verification, so a flood of large invalid requests could exhaust memory and crash a publicly exposed app.

    Both receivers now reject request bodies larger than a new bodyLimit option with an HTTP 413 response before the whole body is buffered. The limit is enforced on the bytes actually received (not the Content-Length header, which a client controls) and applies even when signatureVerification is false. It defaults to 4194304 (4 MB); pass a different number of bytes, a bytes-style string like '4mb', or Infinity to disable it (not recommended in production).

    This is a security fix with a minor behavioral change: requests with bodies larger than 4 MB are now rejected with 413 by default (previously unbounded). Apps that legitimately receive larger payloads can raise bodyLimit on the receiver.

Patch Changes
  • b9acd4f: Fix AwsEventV1.multiValueQueryStringParameters to allow null, matching the actual AWS API Gateway payload and the @types/aws-lambda APIGatewayProxyEvent type. This resolves the type error when passing an APIGatewayProxyEvent directly to the handler returned by AwsLambdaReceiver.

v5.0.0

Compare Source

Major Changes

  • d284e69: Drop Node.js 18 support. The minimum required runtime is now Node.js 20 (npm >=9.6.4).

  • d284e69: Remove deprecated WorkflowStep class and all associated types, middleware, and utilities. Use CustomFunction and app.function() instead.

  • d284e69: Replace axios with native fetch for response_url calls. Remove agent and clientTls options from AppOptions — use clientOptions.fetch to provide a custom fetch implementation for proxy/TLS needs. Add a dispatcher option to SocketModeReceiver for proxy/TLS configuration in socket mode.

    respond() now throws a RespondError when the response_url request returns a non-2xx status (restoring the throw-on-failure behavior that axios provided) and resolves to a Response on success rather than an axios response object.

Minor Changes
  • d284e69: Improve error handling by leveraging @slack/web-api v8 error classes. Authorization errors are now properly wrapped in an AuthorizationError, preserving the original thrown value (non-Error rejections are retained via the cause of the wrapped original). Default error handlers log richer details for web-api errors (API error codes, rate limit durations, HTTP status codes) alongside the full error object, so stack traces and causes remain available. The @slack/web-api error classes (SlackError, WebAPIPlatformError, WebAPIRequestError, WebAPIHTTPError, WebAPIRateLimitedError) can be imported from @slack/web-api for instanceof checks.
Patch Changes

  • 9839a50: Pass the App's named bolt-app ConsoleLogger to the default receivers when no logger option is provided. Previously the App constructor built a named logger on this.logger but threaded the raw (potentially undefined) constructor argument into initReceiver, so HTTPReceiver / SocketModeReceiver each built their own anonymous logger and receiver-side log lines (e.g. unhandled HTTP requests on custom routes) appeared without the bolt-app prefix.

    Behaviour change for the no-logger case: the default receiver now shares the same Logger instance as app.logger, so a downstream app.logger.setLevel(...) after construction will affect receiver-side logging too. This is consistent with the existing behaviour that already mutates this.logger's level via the logLevel constructor option. Apps that supplied their own logger are unaffected; apps that relied on the receiver's logger being independent of app.logger will need to pass a separate logger into the receiver explicitly.

  • e1c21d7: Fix AwsLambdaReceiver.toHandler() so Bolt apps on the AWS Lambda Node.js 24+ runtime no longer fail at startup with Runtime.CallbackHandlerDeprecated. The returned handler is now a 2-arg promise-based function; the unused trailing callback parameter has been removed from the AwsHandler type. The legacy AwsCallback export is retained and marked @deprecated.

  • f2de079: Add context_team_id and context_enterprise_id as optional fields on the EnvelopedEvent type. Slack's Events API delivers these on the envelope for Slack Connect channels and Enterprise Grid org-wide apps, where team_id may refer to a workspace different from the one the bot is installed in. Without the typed fields, downstream code had to reach for @ts-expect-error or unsafe casts to route by the correct workspace.

v4.7.3

Compare Source

Patch Changes
  • 341b60e: Reject empty signingSecret at initialization to prevent accidental HMAC signature forgery.
slackapi/node-slack-sdk (@​slack/web-api)

v8.1.1

Compare Source

Patch Changes
  • 0ee1d99: fix: revert internal packages requiring esm loading for backward compatible support (#​2711)

v8.1.0

Compare Source

Minor Changes

  • 955e6b9: feat(web-api): add support for admin.users.getExpiration

  • 4322e14: feat(web-api): add agents.sessions.rename and agents.sessions.setStatus

  • 4ba30a1: feat(web-api): add session_status to chat.stopStream arguments

  • bff3398: feat(web-api): add webapi response changes as of 2026-08-21

    Regenerate response types with new stable response properties (e.g. agent_session on message-bearing responses, ListView grouping/sort/filter fields, bots.info connector/workflow flags).

    Two fields are removed from UsersListResponse, neither of which is a real success-response property:

    • Member.is_connector_bot — not returned by users.list; this flag is surfaced on bots.info (added here to BotsInfoResponse).
    • arg — an error-response echo field, not part of a successful users.list body.

  • f5fd35a: feat(web-api): add blocks.validate method

Patch Changes

v8.0.0

Compare Source

Major Changes

  • fc98c8c: Drop Node.js 18 support. The minimum supported Node.js version is now 20.

  • fc98c8c: Redesigned error handling to use proper Error subclasses instead of plain objects with a code property.

    Migration: Replace if (error.code === ErrorCode.PlatformError) with if (error instanceof WebAPIPlatformError). All error classes extend a common SlackError base class (which extends Error), so you can also catch all SDK errors with if (error instanceof SlackError).

    New error class hierarchy:

    • SlackError (abstract base)
      • WebAPIPlatformError — Slack API returned ok: false
      • WebAPIRequestError — Network/transport failure (original error in cause)
      • WebAPIHTTPError — Non-200 HTTP status from Slack
      • WebAPIRateLimitedError — HTTP 429 with retryAfter seconds
      • WebAPIFileUploadInvalidArgumentsError — Invalid file upload arguments
      • WebAPIFileUploadReadFileDataError — Failed to read file data for upload

    Removed factory functions (these were internal but exported — use new with the corresponding class instead):

    • errorWithCode()
    • platformErrorFromResult() → new WebAPIPlatformError(...)
    • requestErrorWithOriginal() → new WebAPIRequestError(...)
    • httpErrorFromResponse() → new WebAPIHTTPError(...)
    • rateLimitedErrorWithDelay() → new WebAPIRateLimitedError(...)

    Other breaking type changes:

    • WebAPIHTTPError.headers type changed from IncomingHttpHeaders to Record<string, string>.
    • The CodedError interface is deprecated — use instanceof checks with specific error classes instead.
    • Error .name values changed from generic 'Error' to descriptive class names (e.g., 'WebAPIPlatformError').

  • fc98c8c: Replaced axios with the standard Fetch API for all HTTP transport. The following options and types have been removed from WebClientOptions:

    • agent — Use the new fetch option to provide a custom fetch implementation with proxy or keep-alive support. For proxies, prefer the built-in http.setGlobalProxyFromEnv() or NODE_USE_ENV_PROXY=1 (Node.js 24+). For advanced use cases: 
      import { fetch, Agent } from "undici";
const client = new WebClient(token, {
  fetch: (url, init) =>
    fetch(url, {
      ...init,
      dispatcher: new Agent({ keepAliveTimeout: 60_000 }),
    }),
});
    • tls and TLSOptions — Configure TLS via a custom fetch implementation with an undici Agent, or use the NODE_EXTRA_CA_CERTS environment variable.
    • requestInterceptor and RequestInterceptor type — Wrap the fetch function to intercept or modify requests before they are sent.
    • adapter and AdapterConfig type — Use the fetch option instead.
    • RequestConfig type (was an alias for Axios' InternalAxiosRequestConfig) — Removed entirely.
    • attachOriginalToWebAPIRequestError option — Removed. The original error is now always available via the standard cause property on WebAPIRequestError.

    The dependencies axios, form-data, is-electron, and is-stream have been removed. The default fetch implementation is globalThis.fetch (available in Node.js 20+).

    New exported types for custom fetch implementations: FetchFunction, FetchResponse, FetchRequestInit, FetchHeaders.

  • fc98c8c: Removed previously-deprecated API methods and their associated request/response types:

    • files.upload — Use filesUploadV2 instead (available since v6.7). The filesUploadV2 method handles the multi-step upload process automatically.
    • rtm.start — Use rtm.connect instead. The rtm.start method was deprecated by Slack in favor of the lighter-weight rtm.connect.
    • workflows.stepCompleted, workflows.stepFailed, workflows.updateStep — These methods supported the retired Steps from Apps feature (deprecated August 2023, retired September 2024). The workflows.featured.* and admin.workflows.* methods for the current Workflow Builder remain available.
Minor Changes
  • fc98c8c: feat: expand app manifest types — add agent_view and assistant_view features, recent agent events (app_context_changed, assistant_thread_started, assistant_thread_context_changed), optional OAuth scopes (bot_optional/user_optional), and event metadata_subscriptions
Patch Changes
  • bb49d99: fix: apply redact() to API response bodies in debug logs and recurse into nested objects, preventing tokens from leaking into logs when debug logging is enabled
  • Updated dependencies [fc98c8c]
  • Updated dependencies [fc98c8c]

v7.19.0

Compare Source

Minor Changes
  • a795b86: feat: expand app manifest types — add agent_view and assistant_view features, recent agent events (app_context_changed, assistant_thread_started, assistant_thread_context_changed), optional OAuth scopes (bot_optional/user_optional), and event metadata_subscriptions

v7.18.0

Compare Source

Minor Changes
  • 07744de: feat: make thread_ts optional for assistant.threads.setSuggestedPrompts

v7.17.0

Compare Source

Minor Changes

  • 2085900: feat: expose public read-only ts getter on ChatStreamer for fallback to chat.update when a stream expires server-side

    import { WebClient } from "@slack/web-api";

const client = new WebClient(process.env.SLACK_BOT_TOKEN);

const streamer = client.chatStream({
  channel: "C0123456789",
  thread_ts: "1700000001.123456",
  recipient_team_id: "T0123456789",
  recipient_user_id: "U0123456789",
});

await streamer.append({ markdown_text: "hello!" });
// streamer.ts is now set after the first flush
console.log(streamer.ts);

await streamer.stop();

v7.16.0

Compare Source

Minor Changes

  • 2814969: feat: add highlight_type to files.completeUploadExternal and filesUploadV2 for optimistic rendering

    import { WebClient } from "@slack/web-api";

const client = new WebClient(process.env.SLACK_BOT_TOKEN);

await client.filesUploadV2({
  channel_id: "C0123456789",
  file: "./image.png",
  filename: "image.png",
  title: "Image Upload",
  highlight_type: "png",
});
actions/checkout (actions/checkout)

v7.0.1

Compare Source

v7.0.0

Compare Source

v6.1.0

Compare Source

v6.0.3

Compare Source

v6.0.2

Compare Source

v6.0.1

Compare Source

v6.0.0

Compare Source

v5.1.0

Compare Source

v5.0.1

Compare Source

v5.0.0

Compare Source

actions/setup-node (actions/setup-node)

v7.0.0

Compare Source

What's Changed
Enhancements:
Bug fixes:
Documentation updates:
Dependency update:
New Contributors

Full Changelog: actions/setup-node@v6...v7.0.0

adobe/mysticat-ci (adobe/mysticat-ci)

v3.4.0

Compare Source

What's Changed

  • refactor(ci-context): rehome out of actions/ and add dedup-notice breadcrumb by @​solaris007 in #​27

Full Changelog: adobe/mysticat-ci@v3.3.0...v3.4.0

v3.3.0

Compare Source

What's Changed

Full Changelog: adobe/mysticat-ci@v3.2.0...v3.3.0

v3.2.0

Compare Source

v3.2.0 — Change Management shared actions

feat(release-cm): adds three composite actions for the ServiceNow CMR change-trail (Phase 1), merged in #​24:

  • release-cm — decorate a published GitHub release with a cm-attributes block (changeApprovedBy, changeType/impact/risk, backout plan)
  • release-cm-audit — report / backfill CM blocks across a repo's releases
  • cm-assess-pr — write a cm-assessment block into a PR description

Consumers pin these at the major: adobe/mysticat-ci/.github/actions/<name>@v3. Publishing this release advances the floating v3 tag onto these actions, unblocking CM onboarding across the fleet.

v3.1.3

Compare Source

v3.1.2

Compare Source

v3.1.1

Compare Source

v3.1.0

Compare Source

v3.0.0

Compare Source

v2.2.0

Compare Source

Feature: new opt-in bundle-build input on service-ci.yaml. When set to true, the build job runs npm run build (= helix-deploy --test-bundle) as a Lambda bundle smoke check that bundles, zips, and invokes the bundled lambda() against a synthetic healthcheck event, exiting non-zero on any non-2xx response. Defaults to false; existing callers are unaffected. See docs/bundle-build-gate.md. Lifts the repo-local gate first shipped in adobe/spacecat-api-service#2466 (SITES-45260).

v2.1.5

Compare Source

v2.1.4

Compare Source

v2.1.3

Compare Source

Fix: use status field instead of ahead_by for behind-main detection — ahead_by can return 0 even when behind.

v2.1.2

Compare Source

Fix: add pull-requests: read to branch-deploy job permissions so the sticky comment step can find the PR.

v2.1.1

Compare Source

Hotfix: removes pull-requests: write from reusable workflow permissions that caused startup_failure for callers granting pull-requests: read.

v2.1.0

Compare Source

What's new
Conditional DEV deploy for feature branches

The branch-deploy job now checks whether the feature branch is up to date with main before deploying to DEV. If the branch is behind, the deploy is skipped to prevent outdated code from landing on DEV.

A sticky PR comment is posted (or updated) with the deploy status:

  • ⚠️ Skipped — branch is behind main, with a nudge to click "Update branch"
  • ✅ Deployed — successfully deployed to DEV
  • ❌ Failed — deploy failed, with link to workflow run
Caller requirements

For the PR comment to work, callers should grant pull-requests: write:

permissions:
  pull-requests: write  # was: read

The comment step uses continue-on-error, so existing callers with read are unaffected — they just won't see the comment until they update.

v2.0.0

Compare Source

bcoe/c8 (c8)

v12.0.0

Compare Source

⚠ BREAKING CHANGES
  • yargs enforces a stricter range of Node versions ^20.19.0 || ^22.12.0 || >=23
Features
motdotla/dotenv (dotenv)

v18.0.1

Compare Source

Changed
  • Handle file urls in config logging (#​1054)

v18.0.0

Compare Source

Added
$ dotenv run -- node index.js
◇ injected env (2) from .env
Hello Dotenv
  • NEW: Dotenv now has a fast parser thanks to @​homanp of superagent.sh. Pass config({ fast: true }), flag --fast, or set DOTENV_FAST=true to opt-in to ~2x faster character-scanner parser. (#​1010)
$ dotenv run --fast -- node index.js
◇ injected env (2) from .env
Hello Dotenv
Changed
  • Injecting message sent to stderr rather than stdout and tips removed (#​1037)
Removed
chrisguttandin/dynamo-db-local (dynamo-db-local)

v11.1.0

Compare Source

all commits

v11.0.0

Compare Source

all commits

mochajs/mocha (mocha)

v12.0.2

Compare Source

🩹 Fixes
📚 Documentation
🧹 Chores

v12.0.1

Compare Source

🩹 Fixes
📚 Documentation
🧹 Chores

❗ Important

✂ PR body was truncated to here.

Configuration

📅 Schedule: (in timezone Europe/Zurich)

  • Branch creation
    • "after 2pm on Monday"
  • Automerge
    • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

  • If you want to rebase/retry this PR, check this box

This PR was generated by Mend Renovate. View the repository job log.

@renovate

renovate Bot commented May 25, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor Author

⚠️ Artifact update problem

Renovate failed to update an artifact related to this branch. You probably do not want to merge this PR as-is.

♻ Renovate will retry this branch, including artifacts, only when one of the following happens:

  • any of the package files in this branch needs updating, or
  • the branch becomes conflicted, or
  • you click the rebase/retry checkbox if found above, or
  • you rename this PR's title to start with "rebase!" to trigger it manually

The artifact failure details are included below:

File name: package-lock.json
npm warn Unknown env config "store". This will stop working in the next major version of npm. See `npm help npmrc` for supported config options.
npm error code 128
npm error An unknown git error occurred
npm error command git --no-replace-objects ls-remote ssh://git@github.com/adobe/mysticat-data-service.git
npm error Warning: Permanently added 'github.com' (ED25519) to the list of known hosts.
npm error git@github.com: Permission denied (publickey).
npm error fatal: Could not read from remote repository.
npm error
npm error Please make sure you have the correct access rights
npm error and the repository exists.
npm error A complete log of this run can be found in: /runner/cache/others/npm/_logs/2026-09-19T01_27_20_891Z-debug-0.log

@github-actions

github-actions Bot commented May 25, 2026 •
edited
Loading

Copy link
Copy Markdown

This PR will trigger a patch release when merged.

@renovate
renovate Bot force-pushed the renovate-major-external-major branch 3 times, most recently from 6c6c05c to 77404bd Compare May 29, 2026 07:38
@renovate renovate Bot changed the title chore(deps): update external major (major) chore(deps): update dependency dynamo-db-local to v11 May 29, 2026
@renovate
renovate Bot force-pushed the renovate-major-external-major branch from 77404bd to 1968f99 Compare June 1, 2026 11:49
@renovate renovate Bot changed the title chore(deps): update dependency dynamo-db-local to v11 chore(deps): update external major to v11 Jun 2, 2026
@renovate
renovate Bot force-pushed the renovate-major-external-major branch 2 times, most recently from 084d579 to e8c45b1 Compare June 16, 2026 13:10
@renovate
renovate Bot force-pushed the renovate-major-external-major branch from e8c45b1 to caef555 Compare June 18, 2026 14:13
@renovate renovate Bot changed the title chore(deps): update external major to v11 chore(deps): update external major (major) Jun 18, 2026
@renovate
renovate Bot force-pushed the renovate-major-external-major branch 2 times, most recently from d89dc3a to c5e2fe3 Compare June 20, 2026 14:18
@renovate renovate Bot changed the title chore(deps): update external major (major) fix(deps): update external major (major) Jun 20, 2026
@renovate
renovate Bot force-pushed the renovate-major-external-major branch 8 times, most recently from dd22f4c to f07d7e3 Compare June 26, 2026 20:34
@renovate
renovate Bot force-pushed the renovate-major-external-major branch 4 times, most recently from 23d8a77 to 37c74d1 Compare July 6, 2026 08:33
@renovate
renovate Bot force-pushed the renovate-major-external-major branch 3 times, most recently from 68537d0 to 662c85b Compare July 14, 2026 03:44
@renovate
renovate Bot force-pushed the renovate-major-external-major branch 4 times, most recently from e4e744e to 07da9a0 Compare July 30, 2026 15:46
@renovate
renovate Bot force-pushed the renovate-major-external-major branch from 07da9a0 to a38e67d Compare August 1, 2026 11:10
@rpapani rpapani mentioned this pull request Aug 5, 2026
Open
@renovate
renovate Bot force-pushed the renovate-major-external-major branch 4 times, most recently from 9cf0560 to 4b06865 Compare August 14, 2026 11:02
@renovate
renovate Bot force-pushed the renovate-major-external-major branch 3 times, most recently from f0f3ac8 to 71a88bf Compare August 25, 2026 09:25
@renovate
renovate Bot force-pushed the renovate-major-external-major branch 7 times, most recently from 65b5ed0 to 41e12b4 Compare August 31, 2026 20:43
@renovate
renovate Bot force-pushed the renovate-major-external-major branch 9 times, most recently from 4d228c0 to 66daeea Compare September 4, 2026 14:15
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

0 participants