mirror of
https://github.com/gesellix/Bose-SoundTouch.git
synced 2026-08-19 09:06:14 +00:00
9244c00cffa073d7bb7c292dcac43e2744dbf31b
1099
Commits
| Author | SHA1 | Message | Date | |
|---|---|---|---|---|
  dependabot[bot]andTobias Gesellchen
|
9244c00cff |
deps(deps): bump the golang group with 4 updates
Bumps the golang group with 4 updates: [golang.org/x/crypto](https://github.com/golang/crypto), [golang.org/x/mod](https://github.com/golang/mod), [golang.org/x/image](https://github.com/golang/image) and [golang.org/x/text](https://github.com/golang/text). Updates `golang.org/x/crypto` from 0.54.0 to 0.55.0 - [Commits](https://github.com/golang/crypto/compare/v0.54.0...v0.55.0) Updates `golang.org/x/mod` from 0.38.0 to 0.39.0 - [Commits](https://github.com/golang/mod/compare/v0.38.0...v0.39.0) Updates `golang.org/x/image` from 0.44.0 to 0.45.0 - [Commits](https://github.com/golang/image/compare/v0.44.0...v0.45.0) Updates `golang.org/x/text` from 0.40.0 to 0.41.0 - [Release notes](https://github.com/golang/text/releases) - [Commits](https://github.com/golang/text/compare/v0.40.0...v0.41.0) --- updated-dependencies: - dependency-name: golang.org/x/crypto dependency-version: 0.55.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: golang - dependency-name: golang.org/x/mod dependency-version: 0.39.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: golang - dependency-name: golang.org/x/image dependency-version: 0.45.0 dependency-type: indirect update-type: version-update:semver-minor dependency-group: golang - dependency-name: golang.org/x/text dependency-version: 0.41.0 dependency-type: indirect update-type: version-update:semver-minor dependency-group: golang ... Signed-off-by: dependabot[bot] <support@github.com>v0.124.0 |
||
|
Tobias Gesellchen
|
b0b8b9a475 |
feat(health): offer a sourcesUpdated pull alongside the presets push
Adds a second QuickFix to the speaker_presets_count warning, reusing the existing postSourcesUpdated fix (checks_refresh_sources.go). It nudges the speaker to re-fetch /full, which is confirmed (both from marge.AccountFullToXML and a genuine captured Bose-cloud response) to carry presets alongside sources. Whether firmware actually re-applies /full's preset section back onto its own local table is unconfirmed — issue253_regression_test.go already flags that exact link as untested. So this is offered as a free, non-destructive thing to try first, with the guaranteed restore_presets_to_speaker push as the fallback. Gives both directions (pull-style nudge, direct push) rather than only the one. Refs #614 |
||
|
Tobias Gesellchen
|
0f452357e2 |
feat(health): add "Restore presets to speaker" QuickFix
When the speaker shows 0 preset slots while the service's Presets.xml has entries (the #614 pattern), replays each stored preset onto the speaker via :8090/storePreset (client.StorePreset), one slot at a time. Doesn't require a reboot and doesn't need the content playing first, unlike a physical preset-button save. Sync only ever reads from the speaker; this is the missing write direction, and lets a reporter try recovering presets without re-entering all 6 by hand. Refs #614 |
||
|
Tobias Gesellchen
|
bcb819dccd |
fix(health): correct preset-count guidance, drop wrong citation
The speaker_presets_count check told users a power-cycle "usually
re-syncs" missing presets. #614 shows a power-cycle is itself one of
the two reported triggers for the speaker wiping its own presets, so
that advice was actively harmful for this failure mode.
Also fixes the comment's citation: it claimed this was a known pattern
from discussion #295 and #235, but neither actually discusses preset
loss (#295 is a cloud-hosting question, #235 a closed Spotify
preset-save bug). That reference was wrong from the original commit
(
|
||
|
Tobias Gesellchen
|
888348ac55 |
chore: bump Go to 1.26.6, refresh example go.mod pins
Bumps the go directive to 1.26.6 across the main module and both standalone example modules (preset-management, navigation-station-demo), plus the builder image in Dockerfile and the three mock-service images in docker-compose.ci.yml. Also refreshes the examples' require github.com/gesellix/bose-soundtouch pin from the stale v0.118.0 to the current v0.123.0 release tag (the replace directive means they build against local source regardless, but the pin should still track reality). go mod tidy run in all three modules; no other dependency changes. |
||
|
dependabot[bot]andTobias Gesellchen
|
998054e993 |
ci(deps): bump the codeql-action group with 3 updates
Bumps the codeql-action group with 3 updates: [github/codeql-action/init](https://github.com/github/codeql-action), [github/codeql-action/analyze](https://github.com/github/codeql-action) and [github/codeql-action/upload-sarif](https://github.com/github/codeql-action). Updates `github/codeql-action/init` from 4.37.4 to 4.37.6 - [Release notes](https://github.com/github/codeql-action/releases) - [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md) - [Commits](https://github.com/github/codeql-action/compare/f205ea1c3313d32999d8d6a48b4f6530d4437b38...5595ccaf912efad79be6eef63a5619ff05969be3) Updates `github/codeql-action/analyze` from 4.37.4 to 4.37.6 - [Release notes](https://github.com/github/codeql-action/releases) - [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md) - [Commits](https://github.com/github/codeql-action/compare/f205ea1c3313d32999d8d6a48b4f6530d4437b38...5595ccaf912efad79be6eef63a5619ff05969be3) Updates `github/codeql-action/upload-sarif` from 4.37.4 to 4.37.6 - [Release notes](https://github.com/github/codeql-action/releases) - [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md) - [Commits](https://github.com/github/codeql-action/compare/f205ea1c3313d32999d8d6a48b4f6530d4437b38...5595ccaf912efad79be6eef63a5619ff05969be3) --- updated-dependencies: - dependency-name: github/codeql-action/init dependency-version: 4.37.6 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: codeql-action - dependency-name: github/codeql-action/analyze dependency-version: 4.37.6 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: codeql-action - dependency-name: github/codeql-action/upload-sarif dependency-version: 4.37.6 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: codeql-action ... Signed-off-by: dependabot[bot] <support@github.com> |
||
|
Tobias Gesellchen
|
68c2f6400e |
docs(cli): document the update-check command in CLI-REFERENCE.md
#591 added `soundtouch-cli update-check` / `soundtouch-backup update-check` (PR #611) but the CLI command reference never got the matching entry. |
||
|
Tobias Gesellchen
|
97caea112f |
feat(cli): add on-demand update-check command to soundtouch-cli and soundtouch-backup
Answers #591's open question 2: CLI-only users get no update notice from soundtouch-service's periodic background check. Both binaries gain a soundtouch-cli/soundtouch-backup update-check command that does a single, on-demand GitHub Releases check via the existing pkg/service/updatecheck package. Running the command is itself the opt-in, so unlike the service there's no config flag or persisted state. pkg/service/updatecheck.Checker was already designed decoupled from handlers.Server/main.go specifically so other binaries could import it directly; this is that follow-through. |
||
|
Tobias Gesellchen
|
4b245d264e | chore v0.123.0 | ||
|
Tobias Gesellchen
|
df5eb1af01 |
fix(admin): add matching syntax help to the Discovery Interval field
The update-check interval field just got an info-toggle explaining Go duration syntax; Discovery Interval takes the exact same syntax and had no such help, which would read as inconsistent on the same Settings page. Pre-existing gap, unrelated to #591 itself, but small enough to fix alongside it while the pattern is fresh. |
||
|
Tobias Gesellchen
|
b138892c2a |
fix(admin): add syntax help for the update-check interval field
Reuses the existing info-toggle/info-details pattern (already used for the HTTPS override, TLS extra hosts, and DNS upstream fields) rather than inventing a new affordance, so users aren't left guessing at Go's duration syntax when typing a custom interval. |
||
|
Tobias Gesellchen
|
9f61d00b2d |
feat(admin): live Settings-page toggle for the opt-in update check
Follow-up to #591: UpdateCheckEnabled/UpdateCheckInterval are now persisted, live-reloaded Settings fields (mirroring the discovery enabled/interval pattern), editable from the admin Settings page without a restart. The env var/CLI flag remains the seed value for a fresh install with no settings.json yet. The background goroutine now always runs and polls the live settings every minute (updateCheckPollTick), instead of being started only if enabled at process launch, so flipping the toggle takes effect within a minute rather than requiring a restart. |
||
|
Tobias Gesellchen
|
e6cd031ea4 |
fix(player): render literal x instead of HTML entity for dismiss button
htm/Preact template literals insert text as a DOM text node rather than parsing it as HTML, so the × entity was never decoded and showed up literally in the player UI's announcement banner. The admin UI's equivalent button is unaffected because it's built as an HTML string inserted via innerHTML, where the browser does decode entities. Fixes the player-UI regression noted in #591. |
||
 Tobias GesellchenandClaude Sonnet 5
|
f899dbaa89 |
test(marge): guard source XML shape; feat(library): merge speaker-side media server discovery
Comparing against JRpersonal/streborn#587 surfaced two gaps: no test pinned that a newly added source type renders the same element shape as a known-good default (the firmware rejects the whole account document if one source entry omits an expected element), and our DLNA discovery only swept SSDP from the service host, missing servers only visible from a paired speaker's own LAN segment. Adds TestSourceXMLShapeConsistencyAcrossTypes in pkg/service/marge, and has HandleDiscoverLibraryServers merge results from each paired speaker's own /listMediaServers alongside the existing SSDP sweep, deduped by UDN, with unreachable speakers skipped silently. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com> |
||
|
Tobias GesellchenandClaude Sonnet 5
|
401a546482 |
docs+fix(telnet): label getpdo output as runtime-layer-only, not proof of persistence
Addresses recommendations 4 and 7 from #515 comment 5231931569: a green-looking getpdo readback only confirms the sys configuration writes were accepted, not that they'll survive a reboot (that's what the envswitch-persisted layer decides). Labels the getpdo line in both migrateViaTelnet and runTelnetInjection's CLI/log output accordingly, softens migrateViaTelnet's "succeeded" wording to "accepted", and adds the same one-line caveat to TELNET-MIGRATION-METHOD.md #2.3 (previously only in TELNET-COMMAND-REFERENCE.md). Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>v0.122.1 |
||
|
Tobias GesellchenandClaude Sonnet 5
|
b7a2a7bdb1 |
docs(telnet): document per-port reboot readiness for enable-ssh retries
Confirmed on hardware (#471 comments 5231997551, 5232046477): after a reboot, HTTP :8090 and the diagnostic telnet :17000 shell become ready at very different times, up to ~92s. Our own enable-ssh retry guidance tells users to power-cycle and re-run immediately, which can hit the device mid-boot and surface as a raw connection-refused error. Adds a troubleshooting entry plus the underlying measurement in TELNET-COMMAND-REFERENCE.md; no code change. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com> |
||
|
Tobias GesellchenandClaude Sonnet 5
|
d36cd75d26 |
docs(telnet): correct envswitch/getpdo claims from #515/#471 measurements
Community hardware testing (bitranox, JRpersonal) on 2026-08-09 retracted the earlier "inter-command delay is necessary" theory and established that envswitch boseurls set commits the whole runtime layer (not just its two arguments), has no read form, and doesn't ack with "OK". Corrects TELNET-MIGRATION-METHOD.md and TELNET-COMMAND-REFERENCE.md accordingly, retracts the stale "confirmed necessary" command-delay claim in enable_ssh.go/cmd_setup.go, and lowers DefaultTelnetCommandDelay 5s -> 3s as a smaller hedge now that the delay itself is known not to be the mechanism. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com> |
||
|
Tobias GesellchenandClaude Sonnet 5
|
27da179082 |
fix(models): surface DeviceError's name attribute, not just its message
ErrorsResponse.Error() only returned the <error> element's text body, dropping the name attribute entirely. Some speaker error responses have a Message that just restates Value as text (e.g. a bare "1047" for SOURCE_ALREADY_REMOVED), so callers only ever saw the useless numeric string. Found while live-debugging a Deezer account add/remove cycle on real hardware, where the raw XML (<error value="1047" name="SOURCE_ALREADY_REMOVED">1047</error>) carried real information only in the name attribute. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com> |
||
|
Tobias GesellchenandClaude Sonnet 5
|
aae1673451 |
fix(service): trim whitespace from TuneIn path/query params
Guards against whitespace-only stationID/podcastID/encodedName path segments and tightens the existing empty-string checks on the search q/cursor query params. Spotted while reviewing stalkerquatre-oss's fork diff for TuneIn handling improvements; their s0/Radio fallback defaults were skipped as unprecedented invented values that would mask malformed requests instead of erroring. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com> |
||
|
Tobias GesellchenandClaude Sonnet 5
|
3cfbd05d99 |
fix(cli): bump default enable-ssh --full-config command delay to 5s
Follow-up to the 3s default from earlier in #515: the reporter agreed 5s is a better trade-off (issue comment 5230881285) — more headroom than the original guess, still comfortably under the ~7s gap their manual A/B test used. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>v0.122.0 |
||
|
Tobias GesellchenandClaude Sonnet 5
|
3b7ba8bd2f |
feat(cli): auto-pair unpaired devices before the enable-ssh injection
#515 comment 5230833551: on a genuinely unpaired (factory-reset) device, margeServerUrl is reportedly never polled at all, so the boseurls SSH-enable injection has no read cycle to fire on regardless of any command delay. enable-ssh now checks /info first and, if margeAccountUUID is empty, pairs the device via the existing PairAccount helper (HTTP /setMargeAccount, telnet fallback) before running the injection. Adds setup.Manager.EnsureMargeAccountPaired plus --no-auto-pair (skip entirely) and --account (use a specific 7-digit ID instead of a generated one, e.g. to match one already in the datastore) flags on enable-ssh. Pairing failure is a warning, not fatal, since the claim is unconfirmed on this specific hardware and existing working flows must not regress. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com> |
||
|
Tobias Gesellchen
|
73c0dfe88b |
ci(docs): treat non-404 4xx link-check failures as warnings, not errors
markdown-link-check has no concept of "warning" vs "error" — it's a binary alive/dead per link, so a transient 429 from a rate-limiting site we don't control (recently: blogspot.com, izndgroup.com) fails the whole CI job exactly like a genuine dead link, with no way to tell them apart from the job's exit code. New scripts/check-doc-links.sh wraps the tool per file, parses its "[✖] <url> → Status: <code>" output, and re-decides pass/fail per link: 404 still fails the build (a real dead link, worth fixing), other 4xx (429, 401, 403, ...) become a GitHub Actions ::warning:: annotation instead, and anything else (5xx, timeouts, DNS failures) still fails the build same as before. De-dupes markdown-link-check's own doubled -v output. Written for bash 3.2 (macOS's default /bin/bash) so it's testable locally, not just on the ubuntu-latest runner. Existing retry config in .github/markdown-link-check.json (retryOn429, 3 retries, 30s backoff) is untouched; this only changes what happens once retries are exhausted. Verified locally: 6 synthetic scenarios (404/429/500/mixed/clean/ duplicate-line) via a stubbed markdown-link-check, plus a real run against the docs tree with the actual tool. |
||
|
Tobias Gesellchen
|
69a21cdda7 |
feat(cli): configurable pause between enable-ssh --full-config commands
Per #515 comment 5228449448: on a real Lifestyle console, the same 6 commands (5 sys configuration/envswitch + reboot) sent back-to-back left sshd down after reboot, but succeeded sent one at a time with ~7s gaps — same commands, same order, same device, minutes apart. Sending fast may not let the device fully process one command before the next arrives. Adds --command-delay (setup.DefaultTelnetCommandDelay, 3s), threaded through EnableSSHViaTelnetFullConfig/runTelnetInjection (pause after each of the 5 commands) and runEnableSSHInjection (one more pause before the reboot). 0 restores the old back-to-back behavior. The reporter didn't try to find the true minimum, just confirmed ~7s works and speculated "a second or two may well be enough" — 3s is a middle ground, tunable via the flag if a specific device needs more. Also prints an approximate total for the injection phase up front (6 steps x delay, ~18s at the default) so the command doesn't look hung — separate from the existing --wait message for sshd coming up after reboot, which can take much longer. Refs #515 |
||
|
Tobias Gesellchen
|
06ad41412f |
fix(cli): stop ssh-check telling users telnet SSH-enable is impossible
setup ssh-check's failure message claimed "those commands were removed" on FW 27.x and jumped straight to the USB-stick fallback — flatly contradicted by setup enable-ssh, which exists specifically to bootstrap SSH over telnet via the port-17000 envswitch trick (#471), and by TELNET-COMMAND-REFERENCE.md's own notes that the injection is field-confirmed on several FW 27.x models. Success is model/build- dependent, not universally impossible — some devices (ST Portable, some CineMate 520 units) need --full-config instead of the default injection. Reordered the message to point at `setup enable-ssh` (with the --full-config caveat) first, USB stick as the fallback if that doesn't work on a given device — this was the exact point where a user hitting a closed port 22 would previously be told to go find a USB stick without ever learning the telnet route exists. Refs #598 |
||
|
Tobias Gesellchen
|
69010f766e |
docs: document Lifestyle/console POWER-key behavior and input isolation
On Bose Lifestyle/CineMate consoles, the SoundTouch module is one input among several, and #160 already established the input can't be switched from the SoundTouch side. This adds a troubleshooting section covering: - source="LOCAL" in /now_playing with LOCAL absent from /sources means the console is on a different input, not that the content is invalid. - POST /key POWER is not a harmless "stop playback" on these devices like it is on a plain speaker — it puts the console into standby, and on waking it returns to the console's OWN input, not back to SoundTouch. A test loop that uses POWER between trials silently drops off SoundTouch after the first trial, so every later station reports INVALID_SOURCE regardless of whether it would actually play fine. Also adds a cross-reference caveat to the `key power` row in TELNET-COMMAND-REFERENCE.md, whose existing "no observable effect on FW 27.x" note is speaker-only phrasing that doesn't hold for these consoles. Refs #597 |
||
|
Tobias Gesellchen
|
59a881e667 |
feat(announcements): support a proper link, not a raw URL in the message text
Follow-up to #591, prompted by the update-check notice showing a raw https:// URL as plain text instead of a clickable link. Made it general rather than a one-off fix, since future announcements may also want to link to docs. Added Announcement.LinkText/LinkURL (+ LinkURLFunc, the dynamic counterpart, for the update-check entry's per-release URL) alongside the existing Message/MessageFunc pair. Both frontends render it as a real <a> element now: the admin UI (innerHTML) escapes Message/LinkText/LinkURL via the existing escapeHtml() before composing the markup — previously Message went into innerHTML unescaped, which this incidentally hardens; the player (Preact/htm) templates an actual <a> rather than interpolating a string, since Preact escapes string children by default and a raw <a href=...> string would otherwise render as literal text, not a link. Rephrased the #419 admin-gate announcement to use the new field too (was a plain "See issue #419 for details." text mention). Bug found while wiring this up: UpdateCheckState never persisted the release URL, only the version — so after a restart, the announcement would show a correct message but a broken/empty link until the next live check completed (which can be up to a full interval away, since a fresh check is skipped when the persisted last-check is still recent). Fixed by adding UpdateCheckState.LastReleaseURL and threading it through Checker.persist/NewChecker's seeding path, with a test (TestNewChecker_SeedsFromPersistedState) that would have caught it. Also fixed two gocritic rangeValCopy findings in handlers_announcements.go (switched to index-based iteration) surfaced by the Announcement struct growing with the new fields. Refs #591 |
||
|
Tobias Gesellchen
|
f33a306c47 |
chore: suppress math/rand Semgrep finding on two non-security use sites
Addresses the Semgrep finding on PR #599 (go.lang.security.audit.crypto.math_random.math-random-used) on the update-check jitter delay, and applies the same treatment to the #419 activity-log filename suffix, which has the same non-security shape but predates this PR's diff so it wasn't flagged. Neither value is ever compared, kept secret, or otherwise security- sensitive (a sleep duration and a filename-uniqueness suffix), so crypto/rand would only add error-handling overhead for no real benefit. Suppressed with the same // nosemgrep: <rule-id> pattern already used in the mock-amazon/mock-spotify/mock-tunein servers, mirroring the existing //nolint:gosec on the same lines. Refs #591 |
||
|
Tobias Gesellchen
|
afaa00e483 |
feat(version-info): expose update-check state; docs
Fifth and final piece of #591's initial implementation. Extends /api/setup/version with update_available/latest_version/ latest_release_url (nil-safe via Server.UpdateCheckResult, defaults to Available: false when the check was never enabled). Response switched from map[string]string to map[string]interface{} to carry the new bool field; updated the one existing test that decoded into the old stricter type. Documents UPDATE_CHECK_ENABLED/UPDATE_CHECK_INTERVAL in the Configuration Options reference table, explicit that this is the only network call AfterTouch makes beyond speaker/provider traffic when enabled, and that it defaults off. This closes out the initial #591 implementation per the design doc (_/i591/design-update-check.md): UpdateCheckState persistence, the updatecheck.Checker package, background goroutine wiring with jitter/ backoff, reusing #419's Announcements mechanism instead of a second notice UI, and this version-info exposure. `make check` passes end to end (including the Docker HTTP integration suite). Refs #591 |
||
|
Tobias Gesellchen
|
0c343f85c7 |
feat(announcements): reuse #419's mechanism for the update-check notice
Fourth piece of #591 — the "minimal and future-proof at once" move from the design doc: no new notice UI, just one new entry in the #419 announcements list, which is already rendered in both the admin UI and the player and already has per-ID dismissal. Added Announcement.MessageFunc/DismissKeyFunc (nil = use the static Message/ID, as before, so the existing #419 entry is unaffected) since this entry's text names a specific version and its dismissal must be per-version — dismissing the notice for v1.2.0 must not suppress a later notice for v1.3.0. HandleListAnnouncements/HandleDismissAnnouncement now compute the effective key through Announcement.dismissKey(s) rather than reading the static ID field directly. Refs #591 |
||
|
Tobias Gesellchen
|
1248a0bd1c |
feat(update-check): wire the Checker into the service, opt-in via env flags
Third piece of #591. --update-check-enabled/--update-check-interval (UPDATE_CHECK_ENABLED/UPDATE_CHECK_INTERVAL), default off/24h, following the same local main.go flag pattern as discovery-enabled — not pkg/config, which soundtouch-service doesn't import at all (correction to the issue's proposed location, see the design doc). Background goroutine modeled on startDeviceDiscovery: startup jitter (0-5min), skips the immediate check if the persisted last-check is still fresh, backs off retries to no sooner than 1h after a failure, logs once per newly-detected version. The decision logic (shouldCheckImmediately, shouldSkipDueToBackoff, logUpdateIfNewlyAvailable) is split into pure, directly-testable functions rather than living inline in the goroutine. Server gets a SetUpdateChecker/UpdateCheckResult pair (nil-safe) so the next two pieces (announcement, /api/setup/version) can read the current state without importing updatecheck's construction details. Manually verified against a running instance: enabled via flags, no panic, service stays responsive (jitter means the actual first check can take up to 5 minutes to fire, so this only confirms the wiring, not a live GitHub response — that's covered by the previous commit's httptest-backed unit tests). Refs #591 |
||
|
Tobias Gesellchen
|
c71f0623fb |
feat(updatecheck): add Checker package for GitHub release comparison
Second piece of #591. Standalone package (pkg/service/updatecheck): GitHub releases API client, golang.org/x/mod/semver comparison (promoted from indirect to direct dependency), persisted state via datastore's UpdateCheckState. Dev/(devel)/dirty current versions skip the comparison entirely rather than guessing; prereleases are excluded even though GitHub's /releases/latest endpoint shouldn't return one anyway (defensive). Deliberately decoupled from handlers.Server/main.go: repo and current version are constructor arguments, not hardcoded, so a future CLI-side check could reuse this as a plain import rather than a rewrite (open question 2 in the design doc). Not wired into the service yet — nothing calls NewChecker/CheckNow outside tests. Refs #591 |
||
|
Tobias Gesellchen
|
500f7850be |
feat(datastore): add UpdateCheckState persistence
First piece of #591 (opt-in periodic update check). A small persisted state (last_checked_at, last_seen_version) under update-check.json, mirroring Settings' Get/Save shape — separate from Settings itself since this is runtime state, not operator-editable config. Not wired to anything yet. Refs #591 |
||
|
Tobias Gesellchen
|
29463fac98 |
feat(admin): show the resolved data directory in Settings
Prompted by not being able to tell where a locally-run instance's data dir actually was without inspecting the running process (ps/lsof). Adds data_dir to /api/setup/version's response, resolved to an absolute path so it's unambiguous regardless of whether --data-dir/DATA_DIR was relative or left at the default. Shown as a read-only line at the top of the Settings tab, not the always- visible footer — the footer is prime real estate seen on every tab/every page load, and this is a rarely-needed piece of diagnostic info that belongs alongside the rest of System Settings instead. Also filled in a test-helper gap: the pkg/service/handlers package's internal test router (main_test.go) never registered /setup/version at all, unlike the real production router — added it so the new test (and any future one exercising this endpoint) can actually run. Unrelated to #419, but found while verifying that work against a running instance.v0.121.0 |
||
|
Tobias Gesellchen
|
bdcbd29e3b |
fix(admin): add the actual Settings control for admin_area_auth
The backend (field, validation, guard rail, live-reload middleware) has worked since the first #419 commit, and the announcement banner correctly told people "you can opt in now in Settings" — but there was never actually a control in Settings to do that with. Caught by manual testing against a running instance: the banner rendered fine, proving chunks 1-6 worked, but Settings had nothing to act on. Adds a select (mirroring default_landing's pattern) with the tri-state choices spelled out in plain language, wired into updateSettings()/ fetchSettings() alongside the other fields. Verified end-to-end against a running instance: setting it to "enabled" (with non-default credentials) persists, and immediately gates /admin (401 without credentials, 200 with) without a restart. Refs #419 |
||
|
Tobias Gesellchen
|
d2ba3d757d |
feat(player): render announcement banners in soundtouch-player too
The design's three-area target model (chooser/app/admin) and the backend (HandleListAnnouncements' target=app filtering) already supported this, but nothing in soundtouch-player's frontend called it — chunk 5 only wired the admin UI. New Announcements Preact component (static/js/components/), mounted in App() above the main content so it's visible across every page, styled with the app's existing CSS variables (dark-mode-aware, unlike the admin UI's hardcoded inline colors). Currently renders nothing, since no announcement in the list targets "app" yet (only the admin-gate notice, targeting "admin") — this is just closing the parity gap so a future app-targeted announcement has somewhere to show up. Verified end-to-end against a running instance: the component is served under /app/static/js/components/, app.js references it, and /api/announcements?target=app responds correctly (empty today). Refs #419 |
||
|
Tobias Gesellchen
|
50509ef729 |
feat(export): bundle the local activity log into diagnostic exports; docs
Seventh and final piece of #419's initial rollout. Adds addActivityLog to buildDiagnosticArchive, walking stats/activity/ and bundling every event file verbatim (same idea as the per-device XML bundling, mirroring addSettingsJSON's placement). Without this, the privacy guarantee discussed during design ("local-only, but included in an explicit diagnostic export") would have been aspirational rather than true — caught before documenting it as fact. Documents the activity log in DIAGNOSTIC-EXPORT.md, anchored to the existing "all data stays on your network" language in SOUNDTOUCH-SERVICE-ANNOUNCEMENT.md. This closes out the initial #419 implementation: AdminAreaAuth setting + guard rail, BasicAuthAdmin gate, activity log + dismissal cache, announcements + dismiss endpoint, admin UI banner, health check nudge, and now diagnostic-export coverage + docs. Still opt-in only (AdminAreaAuth defaults to unset) — flipping the default is a separate, later change per the design doc's rollout plan. Refs #419 |
||
|
Tobias Gesellchen
|
4bbcd4d178 |
feat(health): add admin_area_auth_available check
Sixth piece of #419. Visibility-only nudge, same spirit as mgmt_default_credentials: surfaces on the Health tab that the admin-area gate exists and is unset, for operators who dismissed the announcement banner or never saw it on an older release. Does not gate anything. Refs #419 |
||
|
Tobias Gesellchen
|
232adeb23f |
feat(admin): render dismissible announcement banners in the admin UI
Fifth piece of #419: wires up the announcements endpoint added in the previous commit. A banner container sits outside the tab-content divs (index.html) so it stays visible across all tabs, not just one. Fetched once on page load alongside settings/version/devices; dismissing calls the server-side dismiss endpoint (not a client-only localStorage flag, so it stays dismissed across sessions/devices) and removes it from the DOM immediately. Manually verified end-to-end against a running instance: the banner container renders, the admin-gate notice appears by default, dismissing it removes it from subsequent /api/announcements responses. No Go test coverage — this is frontend-only wiring of already-tested endpoints. Refs #419 |
||
|
Tobias Gesellchen
|
8a4e4191a9 |
feat(admin): add announcements list + dismiss endpoint
Fourth piece of #419: a small in-code (not admin-authored) announcement list, target-scoped ("app"/"admin", "chooser" reserved but not wired since the landing page has no JS yet) and filterable by live server state via ShowWhile. First entry: the admin-area-gate heads-up, shown on the admin target while AdminAreaAuth is unset. GET /api/announcements?target=... and POST /api/announcements/{id}/dismiss are deliberately NOT behind BasicAuthAdmin — the whole point of the gate notice is to reach operators who haven't set up credentials yet, the exact audience an admin-only endpoint would exclude. The dismiss endpoint validates id against the known announcement list before it reaches RecordActivity, since this is the one call site where an id comes from an HTTP request rather than a compile-time constant. Updated the router snapshot (testdata/router_routes.txt) for the two new routes. Not wired into any UI yet — nothing calls these endpoints. Refs #419 |
||
|
Tobias Gesellchen
|
d930886f07 |
feat(admin): gate /admin + /api/setup behind BasicAuthAdmin when enabled
Third piece of #419. BasicAuthAdmin() mirrors BasicAuthMgmt but reads the live AdminAreaAuth mode and credentials on every request instead of capturing them once at router-setup time, so toggling the Settings-UI switch takes effect immediately. Split mountSetupAPI into mountSetupAPIShared (ca.crt, tts/speak, tts/config — used directly by soundtouch-cli and soundtouch-player, must stay reachable regardless of the gate) and mountSetupAPIAdmin (everything else). Wired the gate around /admin and both mountSetupAPIAdmin mounts (/setup, /api/setup). Stockholm's optional legacy setup wizard is intentionally left out of scope. Also fixes two lint issues introduced in the prior commit (unchecked json.Marshal in tests, HandleUpdateSettings over the cyclomatic complexity threshold) since `make lint` wasn't run before that commit landed. Refs #419 |
||
|
Tobias Gesellchen
|
5d12e7fac9 |
feat(admin): add local activity log + in-memory dismissal cache
Second piece of #419: a generic, local-only, append-only activity log (datastore.RecordActivity/GetActivityRecords, one file per event under stats/activity/<kind>/, same shape as SaveUsageStats) meant to back the upcoming announcement-banner dismissals and be reusable for other admin-UI action kinds later. The read path never touches disk: a scoped startup scan folds prior dismissals into an in-memory map once, RecordDismissal updates it write-through. Same id can recur with a new timestamp (re-shown, dismissed again) — it's a log, not a keyed store. Not wired to anything user-facing yet — no announcements exist to dismiss. Refs #419 |
||
|
Tobias Gesellchen
|
9090fad563 |
feat(admin): add tri-state AdminAreaAuth setting with default-creds guard rail
First piece of the #419 admin-area gate: a persisted, live-reloadable tri-state setting ("" unset / "enabled" / "disabled") so a later release can flip the default from open to gated without breaking an explicit opt-out. Rejects enabling while MGMT_USERNAME/MGMT_PASSWORD are still the published default, since that would give a false sense of security. No behavior change yet — nothing reads this field to actually gate anything. That's the next chunk. Refs #419 |
||
|
Tobias Gesellchen
|
bee0d25747 |
fix(admin): soften missing-account.json placeholder notice
The placeholder state is expected and harmless (every code path already treats it safely, and it self-heals once language/provider settings are saved), but the old wording read like a file-corruption error and leaked the internal account.json filename to users. Reword it to explain the actual (benign) state instead. Refs #360 |
||
 github-actions[bot]andTobias Gesellchen
|
811ce67972 | chore: sync static dependencies with package.json | ||
|
dependabot[bot]andTobias Gesellchen
|
abd20f8c22 |
deps(deps): bump preact from 10.29.7 to 10.29.8
Bumps [preact](https://github.com/preactjs/preact) from 10.29.7 to 10.29.8. - [Release notes](https://github.com/preactjs/preact/releases) - [Commits](https://github.com/preactjs/preact/compare/10.29.7...10.29.8) --- updated-dependencies: - dependency-name: preact dependency-version: 10.29.8 dependency-type: direct:production update-type: version-update:semver-patch ... Signed-off-by: dependabot[bot] <support@github.com> |
||
|
dependabot[bot]andTobias Gesellchen
|
5f64e4a185 |
ci(deps): bump docker/login-action from 4.5.2 to 4.6.0
Bumps [docker/login-action](https://github.com/docker/login-action) from 4.5.2 to 4.6.0. - [Release notes](https://github.com/docker/login-action/releases) - [Commits](https://github.com/docker/login-action/compare/371161bbe7024a29a25c5e19bfcbc0804fe9ad2c...dbcb813823bdd20940b903addbd779551569679f) --- updated-dependencies: - dependency-name: docker/login-action dependency-version: 4.6.0 dependency-type: direct:production update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] <support@github.com> |
||
|
dependabot[bot]andTobias Gesellchen
|
028ad57ba8 |
ci(deps): bump the codeql-action group with 3 updates
Bumps the codeql-action group with 3 updates: [github/codeql-action/init](https://github.com/github/codeql-action), [github/codeql-action/analyze](https://github.com/github/codeql-action) and [github/codeql-action/upload-sarif](https://github.com/github/codeql-action). Updates `github/codeql-action/init` from 4.37.3 to 4.37.4 - [Release notes](https://github.com/github/codeql-action/releases) - [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md) - [Commits](https://github.com/github/codeql-action/compare/e4fba868fa4b1b91e1fdab776edc8cfbe6e9fb81...f205ea1c3313d32999d8d6a48b4f6530d4437b38) Updates `github/codeql-action/analyze` from 4.37.3 to 4.37.4 - [Release notes](https://github.com/github/codeql-action/releases) - [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md) - [Commits](https://github.com/github/codeql-action/compare/e4fba868fa4b1b91e1fdab776edc8cfbe6e9fb81...f205ea1c3313d32999d8d6a48b4f6530d4437b38) Updates `github/codeql-action/upload-sarif` from 4.37.3 to 4.37.4 - [Release notes](https://github.com/github/codeql-action/releases) - [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md) - [Commits](https://github.com/github/codeql-action/compare/e4fba868fa4b1b91e1fdab776edc8cfbe6e9fb81...f205ea1c3313d32999d8d6a48b4f6530d4437b38) --- updated-dependencies: - dependency-name: github/codeql-action/init dependency-version: 4.37.4 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: codeql-action - dependency-name: github/codeql-action/analyze dependency-version: 4.37.4 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: codeql-action - dependency-name: github/codeql-action/upload-sarif dependency-version: 4.37.4 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: codeql-action ... Signed-off-by: dependabot[bot] <support@github.com> |
||
|
Tobias GesellchenandClaude Sonnet 5
|
0489dd39cb |
fix(admin): stop Save Settings from dropping fields the UI doesn't manage
HandleUpdateSettings and HandleUpdateLoggingSettings each built a fresh
datastore.Settings{} from scratch before saving, so any field not covered
by that handler's own DTO (e.g. hand-edited trust_forwarded_headers /
trusted_proxy_cidrs) was silently reset to its zero value on every save.
Load the persisted settings first and overlay only the fields each
handler actually owns, matching the pattern already used elsewhere
(addMargeHostToTLSFix).
Fixes #589
Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
v0.120.0
|
||
 
|
44e364d33f |
ci(deps): bump docker/login-action from 4.4.0 to 4.5.2 (#588)
Bumps [docker/login-action](https://github.com/docker/login-action) from 4.4.0 to 4.5.2. <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/docker/login-action/releases">docker/login-action's releases</a>.</em></p> <blockquote> <h2>v4.5.2</h2> <ul> <li>Surface Docker Hub OIDC error responses by <a href="https://github.com/crazy-max"><code>@crazy-max</code></a> in <a href="https://redirect.github.com/docker/login-action/pull/1058">docker/login-action#1058</a></li> </ul> <p><strong>Full Changelog</strong>: <a href="https://github.com/docker/login-action/compare/v4.5.1...v4.5.2">https://github.com/docker/login-action/compare/v4.5.1...v4.5.2</a></p> <h2>v4.5.1</h2> <ul> <li>Support <code>dhi.io</code> as Docker Hub OIDC registry by <a href="https://github.com/crazy-max"><code>@crazy-max</code></a> in <a href="https://redirect.github.com/docker/login-action/pull/1054">docker/login-action#1054</a></li> </ul> <p><strong>Full Changelog</strong>: <a href="https://github.com/docker/login-action/compare/v4.5.0...v4.5.1">https://github.com/docker/login-action/compare/v4.5.0...v4.5.1</a></p> <h2>v4.5.0</h2> <ul> <li><a href="https://github.com/docker/login-action#docker-hub">Docker Hub OIDC</a> login support by <a href="https://github.com/crazy-max"><code>@crazy-max</code></a> in <a href="https://redirect.github.com/docker/login-action/pull/1048">docker/login-action#1048</a></li> <li>Bump <code>@aws-sdk/client-ecr</code> and <code>@aws-sdk/client-ecr-public</code> to 3.1091.0 in <a href="https://redirect.github.com/docker/login-action/pull/1037">docker/login-action#1037</a></li> <li>Bump <code>@docker/actions-toolkit</code> from 0.92.0 to 0.94.0 in <a href="https://redirect.github.com/docker/login-action/pull/1044">docker/login-action#1044</a> <a href="https://redirect.github.com/docker/login-action/pull/1050">docker/login-action#1050</a></li> <li>Bump brace-expansion from 1.1.13 to 1.1.16 in <a href="https://redirect.github.com/docker/login-action/pull/1046">docker/login-action#1046</a></li> <li>Bump js-yaml from 5.2.0 to 5.2.1 in <a href="https://redirect.github.com/docker/login-action/pull/1038">docker/login-action#1038</a></li> </ul> <p><strong>Full Changelog</strong>: <a href="https://github.com/docker/login-action/compare/v4.4.0...v4.5.0">https://github.com/docker/login-action/compare/v4.4.0...v4.5.0</a></p> </blockquote> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/docker/login-action/commit/371161bbe7024a29a25c5e19bfcbc0804fe9ad2c"><code>371161b</code></a> Merge pull request <a href="https://redirect.github.com/docker/login-action/issues/1058">#1058</a> from crazy-max/fix-dockerhub-oidc-error-handling</li> <li><a href="https://github.com/docker/login-action/commit/5dc73df38ebcfa6f96479901e253d172c3e35849"><code>5dc73df</code></a> chore: update generated content</li> <li><a href="https://github.com/docker/login-action/commit/2aa1edee0b06c23880529064a4f7d7d3d2f9bc87"><code>2aa1ede</code></a> surface Docker Hub OIDC error responses</li> <li><a href="https://github.com/docker/login-action/commit/abd2ef45e78c5afb21d64d4ca52ee8550d9572c7"><code>abd2ef4</code></a> Merge pull request <a href="https://redirect.github.com/docker/login-action/issues/1055">#1055</a> from crazy-max/test-registry-auth-oidc</li> <li><a href="https://github.com/docker/login-action/commit/d49d3a9839fef51322fa44989a44fdc43fccfc22"><code>d49d3a9</code></a> Merge pull request <a href="https://redirect.github.com/docker/login-action/issues/1054">#1054</a> from crazy-max/oidc-missing-dhi</li> <li><a href="https://github.com/docker/login-action/commit/b58b17c30b4db92a4ed049b213cae512b12e460b"><code>b58b17c</code></a> test: cover Docker Hub OIDC with registry-auth</li> <li><a href="https://github.com/docker/login-action/commit/be646c21cec26cea303e29290d5f6ba6fde8e606"><code>be646c2</code></a> chore: update generated content</li> <li><a href="https://github.com/docker/login-action/commit/d77c059cb9956cedaa427dc022d89f39acba678f"><code>d77c059</code></a> support dhi.io as Docker Hub OIDC registry</li> <li><a href="https://github.com/docker/login-action/commit/06fb636fac595d6fb4b28a5dfcb21a6f5091859c"><code>06fb636</code></a> Merge pull request <a href="https://redirect.github.com/docker/login-action/issues/1037">#1037</a> from docker/dependabot/npm_and_yarn/aws-sdk-dependen...</li> <li><a href="https://github.com/docker/login-action/commit/a8bc9539118a762b0e5788b53a50907977cc1b8d"><code>a8bc953</code></a> [dependabot skip] chore: update generated content</li> <li>Additional commits viewable in <a href="https://github.com/docker/login-action/compare/af1e73f918a031802d376d3c8bbc3fe56130a9b0...371161bbe7024a29a25c5e19bfcbc0804fe9ad2c">compare view</a></li> </ul> </details> <br /> [](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself) </details> Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> |
||
|
|
1721f46f9f |
ci(deps): bump the codeql-action group with 3 updates (#587)
Bumps the codeql-action group with 3 updates: [github/codeql-action/init](https://github.com/github/codeql-action), [github/codeql-action/analyze](https://github.com/github/codeql-action) and [github/codeql-action/upload-sarif](https://github.com/github/codeql-action). Updates `github/codeql-action/init` from 4.37.1 to 4.37.3 <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/github/codeql-action/releases">github/codeql-action/init's releases</a>.</em></p> <blockquote> <h2>v4.37.3</h2> <p>No user facing changes.</p> <h2>v4.37.2</h2> <ul> <li>The new address format for the <code>config-file</code> input that was introduced in CodeQL Action 4.37.0 is now enabled by default. In addition to the format described there, the <code>remote=</code> prefix can now be used to explicitly indicate that the input refers to a remote file. All previous input formats continue to be accepted as well. <a href="https://redirect.github.com/github/codeql-action/pull/4023">#4023</a></li> <li>The CodeQL Action can now make use of <a href="https://docs.github.com/en/code-security/how-tos/secure-at-scale/configure-organization-security/manage-usage-and-access/giving-org-access-private-registries">configured private registries</a> in Default Setup to retrieve CodeQL configuration files from remote repositories that require authentication. This will allow customers to store their CodeQL configuration in a single repository that can then be referenced by Default Setup workflows in other repositories. We expect to roll this and other, related changes out to everyone in July. <a href="https://redirect.github.com/github/codeql-action/pull/4007">#4007</a></li> </ul> </blockquote> </details> <details> <summary>Changelog</summary> <p><em>Sourced from <a href="https://github.com/github/codeql-action/blob/main/CHANGELOG.md">github/codeql-action/init's changelog</a>.</em></p> <blockquote> <h1>CodeQL Action Changelog</h1> <p>See the <a href="https://github.com/github/codeql-action/releases">releases page</a> for the relevant changes to the CodeQL CLI and language packs.</p> <h2>[UNRELEASED]</h2> <ul> <li>This version of the CodeQL Action adds support for the <code>tools</code> input for the <code>codeql-action/init</code> step to be specified using a <code>github-codeql-tools</code> <a href="https://docs.github.com/en/organizations/managing-organization-settings/managing-custom-properties-for-repositories-in-your-organization">repository property</a>. This feature will gradually be rolled out following the release of this version. Once rolled out, this allows for the CodeQL CLI version that is used in GitHub-managed workflows, such as Default Setup, to be set to a custom value. For example, customers who run into issues with rate limits when a new CodeQL CLI version is released can set the value to <code>toolcache</code> to always use the CodeQL CLI version that is available in the runner toolcache. For Advanced Setup workflows, the value provided for <code>tools</code> in the workflow definition always takes precedence unless the value of the repository property starts with <code>!</code>. <a href="https://redirect.github.com/github/codeql-action/pull/4037">#4037</a></li> </ul> <h2>4.37.3 - 22 Jul 2026</h2> <p>No user facing changes.</p> <h2>4.37.2 - 21 Jul 2026</h2> <ul> <li>The new address format for the <code>config-file</code> input that was introduced in CodeQL Action 4.37.0 is now enabled by default. In addition to the format described there, the <code>remote=</code> prefix can now be used to explicitly indicate that the input refers to a remote file. All previous input formats continue to be accepted as well. <a href="https://redirect.github.com/github/codeql-action/pull/4023">#4023</a></li> <li>The CodeQL Action can now make use of <a href="https://docs.github.com/en/code-security/how-tos/secure-at-scale/configure-organization-security/manage-usage-and-access/giving-org-access-private-registries">configured private registries</a> in Default Setup to retrieve CodeQL configuration files from remote repositories that require authentication. This will allow customers to store their CodeQL configuration in a single repository that can then be referenced by Default Setup workflows in other repositories. We expect to roll this and other, related changes out to everyone in July. <a href="https://redirect.github.com/github/codeql-action/pull/4007">#4007</a></li> </ul> <h2>4.37.1 - 16 Jul 2026</h2> <ul> <li><em>Upcoming breaking change</em>: Add a deprecation warning for customers using CodeQL version 2.20.6 and earlier. These versions of CodeQL were discontinued on 1 July 2026 alongside GitHub Enterprise Server 3.16, and will be unsupported by the next minor release of the CodeQL Action. <a href="https://redirect.github.com/github/codeql-action/pull/3956">#3956</a></li> <li>Update default CodeQL bundle version to <a href="https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.26.1">2.26.1</a>. <a href="https://redirect.github.com/github/codeql-action/pull/4019">#4019</a></li> </ul> <h2>4.37.0 - 08 Jul 2026</h2> <ul> <li>Update default CodeQL bundle version to <a href="https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.26.0">2.26.0</a>. <a href="https://redirect.github.com/github/codeql-action/pull/3995">#3995</a></li> <li>In addition to the existing input format, the <code>config-file</code> input for the <code>codeql-action/init</code> step will soon support a new <code>[owner/]repo[@ref][:path]</code> format. All components except the repository name are optional. If omitted, <code>owner</code> defaults to the same owner as the repository the analysis is running for, <code>ref</code> to <code>main</code>, and <code>path</code> to <code>.github/codeql-action.yaml</code>. Support for this format ships in this version of the CodeQL Action, but will only be enabled over the coming weeks. <a href="https://redirect.github.com/github/codeql-action/pull/3973">#3973</a></li> </ul> <h2>4.36.3 - 01 Jul 2026</h2> <p>No user facing changes.</p> <h2>4.36.2 - 04 Jun 2026</h2> <ul> <li>Cache CodeQL CLI version information across Actions steps. <a href="https://redirect.github.com/github/codeql-action/pull/3943">#3943</a></li> <li>Reduce requests while waiting for analysis processing by using exponential backoff when polling SARIF processing status. <a href="https://redirect.github.com/github/codeql-action/pull/3937">#3937</a></li> <li>Update default CodeQL bundle version to <a href="https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.25.6">2.25.6</a>. <a href="https://redirect.github.com/github/codeql-action/pull/3948">#3948</a></li> </ul> <h2>4.36.1 - 02 Jun 2026</h2> <p>No user facing changes.</p> <h2>4.36.0 - 22 May 2026</h2> <ul> <li><em>Breaking change</em>: Bump the minimum required CodeQL bundle version to 2.19.4. <a href="https://redirect.github.com/github/codeql-action/pull/3894">#3894</a></li> <li>Add support for SHA-256 Git object IDs. <a href="https://redirect.github.com/github/codeql-action/pull/3893">#3893</a></li> <li>Update default CodeQL bundle version to <a href="https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.25.5">2.25.5</a>. <a href="https://redirect.github.com/github/codeql-action/pull/3926">#3926</a></li> </ul> <h2>4.35.5 - 15 May 2026</h2> <ul> <li>We have improved how the JavaScript bundles for the CodeQL Action are generated to avoid duplication across bundles and reduce the size of the repository by around 70%. This should have no effect on the runtime behaviour of the CodeQL Action. <a href="https://redirect.github.com/github/codeql-action/pull/3899">#3899</a></li> </ul> <!-- raw HTML omitted --> </blockquote> <p>... (truncated)</p> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/github/codeql-action/commit/e4fba868fa4b1b91e1fdab776edc8cfbe6e9fb81"><code>e4fba86</code></a> Merge pull request <a href="https://redirect.github.com/github/codeql-action/issues/4031">#4031</a> from github/update-v4.37.3-72f6a9da0</li> <li><a href="https://github.com/github/codeql-action/commit/fb50ab5d62a274adf3ef3e22cfe750ae87a0ede7"><code>fb50ab5</code></a> Update changelog for v4.37.3</li> <li><a href="https://github.com/github/codeql-action/commit/72f6a9da0def52d9193d6a758f0378b65091f8d1"><code>72f6a9d</code></a> Merge pull request <a href="https://redirect.github.com/github/codeql-action/issues/4030">#4030</a> from github/mbg/fix/no-proxy</li> <li><a href="https://github.com/github/codeql-action/commit/3b5ee58597653d9cc6785f3f1277f796d81f3646"><code>3b5ee58</code></a> Use default <code>request</code> options instead of <code>undefined</code></li> <li><a href="https://github.com/github/codeql-action/commit/bfb6be4b5ecd3650f02f530571453e8c64ef0778"><code>bfb6be4</code></a> Merge pull request <a href="https://redirect.github.com/github/codeql-action/issues/4028">#4028</a> from github/mergeback/v4.37.2-to-main-e0647621</li> <li><a href="https://github.com/github/codeql-action/commit/526ab84f9858816d9cf5f7b9df4dd5e2235f0eba"><code>526ab84</code></a> Rebuild</li> <li><a href="https://github.com/github/codeql-action/commit/d6217b9b8c14166e4851db94c11155d03bd13c07"><code>d6217b9</code></a> Update changelog and version after v4.37.2</li> <li><a href="https://github.com/github/codeql-action/commit/e0647621c2984b5ed2f768cb892365bf2a616ad1"><code>e064762</code></a> Merge pull request <a href="https://redirect.github.com/github/codeql-action/issues/4027">#4027</a> from github/update-v4.37.2-385bcdc5a</li> <li><a href="https://github.com/github/codeql-action/commit/e0faed839190caa67a5cd42f1cc16246028ca3df"><code>e0faed8</code></a> Add a couple of change notes</li> <li><a href="https://github.com/github/codeql-action/commit/73aad0eaa9df172668665a150d17b8bc5a650c20"><code>73aad0e</code></a> Update changelog for v4.37.2</li> <li>Additional commits viewable in <a href="https://github.com/github/codeql-action/compare/7188fc363630916deb702c7fdcf4e481b751f97a...e4fba868fa4b1b91e1fdab776edc8cfbe6e9fb81">compare view</a></li> </ul> </details> <br /> Updates `github/codeql-action/analyze` from 4.37.1 to 4.37.3 <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/github/codeql-action/releases">github/codeql-action/analyze's releases</a>.</em></p> <blockquote> <h2>v4.37.3</h2> <p>No user facing changes.</p> <h2>v4.37.2</h2> <ul> <li>The new address format for the <code>config-file</code> input that was introduced in CodeQL Action 4.37.0 is now enabled by default. In addition to the format described there, the <code>remote=</code> prefix can now be used to explicitly indicate that the input refers to a remote file. All previous input formats continue to be accepted as well. <a href="https://redirect.github.com/github/codeql-action/pull/4023">#4023</a></li> <li>The CodeQL Action can now make use of <a href="https://docs.github.com/en/code-security/how-tos/secure-at-scale/configure-organization-security/manage-usage-and-access/giving-org-access-private-registries">configured private registries</a> in Default Setup to retrieve CodeQL configuration files from remote repositories that require authentication. This will allow customers to store their CodeQL configuration in a single repository that can then be referenced by Default Setup workflows in other repositories. We expect to roll this and other, related changes out to everyone in July. <a href="https://redirect.github.com/github/codeql-action/pull/4007">#4007</a></li> </ul> </blockquote> </details> <details> <summary>Changelog</summary> <p><em>Sourced from <a href="https://github.com/github/codeql-action/blob/main/CHANGELOG.md">github/codeql-action/analyze's changelog</a>.</em></p> <blockquote> <h1>CodeQL Action Changelog</h1> <p>See the <a href="https://github.com/github/codeql-action/releases">releases page</a> for the relevant changes to the CodeQL CLI and language packs.</p> <h2>[UNRELEASED]</h2> <ul> <li>This version of the CodeQL Action adds support for the <code>tools</code> input for the <code>codeql-action/init</code> step to be specified using a <code>github-codeql-tools</code> <a href="https://docs.github.com/en/organizations/managing-organization-settings/managing-custom-properties-for-repositories-in-your-organization">repository property</a>. This feature will gradually be rolled out following the release of this version. Once rolled out, this allows for the CodeQL CLI version that is used in GitHub-managed workflows, such as Default Setup, to be set to a custom value. For example, customers who run into issues with rate limits when a new CodeQL CLI version is released can set the value to <code>toolcache</code> to always use the CodeQL CLI version that is available in the runner toolcache. For Advanced Setup workflows, the value provided for <code>tools</code> in the workflow definition always takes precedence unless the value of the repository property starts with <code>!</code>. <a href="https://redirect.github.com/github/codeql-action/pull/4037">#4037</a></li> </ul> <h2>4.37.3 - 22 Jul 2026</h2> <p>No user facing changes.</p> <h2>4.37.2 - 21 Jul 2026</h2> <ul> <li>The new address format for the <code>config-file</code> input that was introduced in CodeQL Action 4.37.0 is now enabled by default. In addition to the format described there, the <code>remote=</code> prefix can now be used to explicitly indicate that the input refers to a remote file. All previous input formats continue to be accepted as well. <a href="https://redirect.github.com/github/codeql-action/pull/4023">#4023</a></li> <li>The CodeQL Action can now make use of <a href="https://docs.github.com/en/code-security/how-tos/secure-at-scale/configure-organization-security/manage-usage-and-access/giving-org-access-private-registries">configured private registries</a> in Default Setup to retrieve CodeQL configuration files from remote repositories that require authentication. This will allow customers to store their CodeQL configuration in a single repository that can then be referenced by Default Setup workflows in other repositories. We expect to roll this and other, related changes out to everyone in July. <a href="https://redirect.github.com/github/codeql-action/pull/4007">#4007</a></li> </ul> <h2>4.37.1 - 16 Jul 2026</h2> <ul> <li><em>Upcoming breaking change</em>: Add a deprecation warning for customers using CodeQL version 2.20.6 and earlier. These versions of CodeQL were discontinued on 1 July 2026 alongside GitHub Enterprise Server 3.16, and will be unsupported by the next minor release of the CodeQL Action. <a href="https://redirect.github.com/github/codeql-action/pull/3956">#3956</a></li> <li>Update default CodeQL bundle version to <a href="https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.26.1">2.26.1</a>. <a href="https://redirect.github.com/github/codeql-action/pull/4019">#4019</a></li> </ul> <h2>4.37.0 - 08 Jul 2026</h2> <ul> <li>Update default CodeQL bundle version to <a href="https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.26.0">2.26.0</a>. <a href="https://redirect.github.com/github/codeql-action/pull/3995">#3995</a></li> <li>In addition to the existing input format, the <code>config-file</code> input for the <code>codeql-action/init</code> step will soon support a new <code>[owner/]repo[@ref][:path]</code> format. All components except the repository name are optional. If omitted, <code>owner</code> defaults to the same owner as the repository the analysis is running for, <code>ref</code> to <code>main</code>, and <code>path</code> to <code>.github/codeql-action.yaml</code>. Support for this format ships in this version of the CodeQL Action, but will only be enabled over the coming weeks. <a href="https://redirect.github.com/github/codeql-action/pull/3973">#3973</a></li> </ul> <h2>4.36.3 - 01 Jul 2026</h2> <p>No user facing changes.</p> <h2>4.36.2 - 04 Jun 2026</h2> <ul> <li>Cache CodeQL CLI version information across Actions steps. <a href="https://redirect.github.com/github/codeql-action/pull/3943">#3943</a></li> <li>Reduce requests while waiting for analysis processing by using exponential backoff when polling SARIF processing status. <a href="https://redirect.github.com/github/codeql-action/pull/3937">#3937</a></li> <li>Update default CodeQL bundle version to <a href="https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.25.6">2.25.6</a>. <a href="https://redirect.github.com/github/codeql-action/pull/3948">#3948</a></li> </ul> <h2>4.36.1 - 02 Jun 2026</h2> <p>No user facing changes.</p> <h2>4.36.0 - 22 May 2026</h2> <ul> <li><em>Breaking change</em>: Bump the minimum required CodeQL bundle version to 2.19.4. <a href="https://redirect.github.com/github/codeql-action/pull/3894">#3894</a></li> <li>Add support for SHA-256 Git object IDs. <a href="https://redirect.github.com/github/codeql-action/pull/3893">#3893</a></li> <li>Update default CodeQL bundle version to <a href="https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.25.5">2.25.5</a>. <a href="https://redirect.github.com/github/codeql-action/pull/3926">#3926</a></li> </ul> <h2>4.35.5 - 15 May 2026</h2> <ul> <li>We have improved how the JavaScript bundles for the CodeQL Action are generated to avoid duplication across bundles and reduce the size of the repository by around 70%. This should have no effect on the runtime behaviour of the CodeQL Action. <a href="https://redirect.github.com/github/codeql-action/pull/3899">#3899</a></li> </ul> <!-- raw HTML omitted --> </blockquote> <p>... (truncated)</p> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/github/codeql-action/commit/e4fba868fa4b1b91e1fdab776edc8cfbe6e9fb81"><code>e4fba86</code></a> Merge pull request <a href="https://redirect.github.com/github/codeql-action/issues/4031">#4031</a> from github/update-v4.37.3-72f6a9da0</li> <li><a href="https://github.com/github/codeql-action/commit/fb50ab5d62a274adf3ef3e22cfe750ae87a0ede7"><code>fb50ab5</code></a> Update changelog for v4.37.3</li> <li><a href="https://github.com/github/codeql-action/commit/72f6a9da0def52d9193d6a758f0378b65091f8d1"><code>72f6a9d</code></a> Merge pull request <a href="https://redirect.github.com/github/codeql-action/issues/4030">#4030</a> from github/mbg/fix/no-proxy</li> <li><a href="https://github.com/github/codeql-action/commit/3b5ee58597653d9cc6785f3f1277f796d81f3646"><code>3b5ee58</code></a> Use default <code>request</code> options instead of <code>undefined</code></li> <li><a href="https://github.com/github/codeql-action/commit/bfb6be4b5ecd3650f02f530571453e8c64ef0778"><code>bfb6be4</code></a> Merge pull request <a href="https://redirect.github.com/github/codeql-action/issues/4028">#4028</a> from github/mergeback/v4.37.2-to-main-e0647621</li> <li><a href="https://github.com/github/codeql-action/commit/526ab84f9858816d9cf5f7b9df4dd5e2235f0eba"><code>526ab84</code></a> Rebuild</li> <li><a href="https://github.com/github/codeql-action/commit/d6217b9b8c14166e4851db94c11155d03bd13c07"><code>d6217b9</code></a> Update changelog and version after v4.37.2</li> <li><a href="https://github.com/github/codeql-action/commit/e0647621c2984b5ed2f768cb892365bf2a616ad1"><code>e064762</code></a> Merge pull request <a href="https://redirect.github.com/github/codeql-action/issues/4027">#4027</a> from github/update-v4.37.2-385bcdc5a</li> <li><a href="https://github.com/github/codeql-action/commit/e0faed839190caa67a5cd42f1cc16246028ca3df"><code>e0faed8</code></a> Add a couple of change notes</li> <li><a href="https://github.com/github/codeql-action/commit/73aad0eaa9df172668665a150d17b8bc5a650c20"><code>73aad0e</code></a> Update changelog for v4.37.2</li> <li>Additional commits viewable in <a href="https://github.com/github/codeql-action/compare/7188fc363630916deb702c7fdcf4e481b751f97a...e4fba868fa4b1b91e1fdab776edc8cfbe6e9fb81">compare view</a></li> </ul> </details> <br /> Updates `github/codeql-action/upload-sarif` from 4.37.1 to 4.37.3 <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/github/codeql-action/releases">github/codeql-action/upload-sarif's releases</a>.</em></p> <blockquote> <h2>v4.37.3</h2> <p>No user facing changes.</p> <h2>v4.37.2</h2> <ul> <li>The new address format for the <code>config-file</code> input that was introduced in CodeQL Action 4.37.0 is now enabled by default. In addition to the format described there, the <code>remote=</code> prefix can now be used to explicitly indicate that the input refers to a remote file. All previous input formats continue to be accepted as well. <a href="https://redirect.github.com/github/codeql-action/pull/4023">#4023</a></li> <li>The CodeQL Action can now make use of <a href="https://docs.github.com/en/code-security/how-tos/secure-at-scale/configure-organization-security/manage-usage-and-access/giving-org-access-private-registries">configured private registries</a> in Default Setup to retrieve CodeQL configuration files from remote repositories that require authentication. This will allow customers to store their CodeQL configuration in a single repository that can then be referenced by Default Setup workflows in other repositories. We expect to roll this and other, related changes out to everyone in July. <a href="https://redirect.github.com/github/codeql-action/pull/4007">#4007</a></li> </ul> </blockquote> </details> <details> <summary>Changelog</summary> <p><em>Sourced from <a href="https://github.com/github/codeql-action/blob/main/CHANGELOG.md">github/codeql-action/upload-sarif's changelog</a>.</em></p> <blockquote> <h1>CodeQL Action Changelog</h1> <p>See the <a href="https://github.com/github/codeql-action/releases">releases page</a> for the relevant changes to the CodeQL CLI and language packs.</p> <h2>[UNRELEASED]</h2> <ul> <li>This version of the CodeQL Action adds support for the <code>tools</code> input for the <code>codeql-action/init</code> step to be specified using a <code>github-codeql-tools</code> <a href="https://docs.github.com/en/organizations/managing-organization-settings/managing-custom-properties-for-repositories-in-your-organization">repository property</a>. This feature will gradually be rolled out following the release of this version. Once rolled out, this allows for the CodeQL CLI version that is used in GitHub-managed workflows, such as Default Setup, to be set to a custom value. For example, customers who run into issues with rate limits when a new CodeQL CLI version is released can set the value to <code>toolcache</code> to always use the CodeQL CLI version that is available in the runner toolcache. For Advanced Setup workflows, the value provided for <code>tools</code> in the workflow definition always takes precedence unless the value of the repository property starts with <code>!</code>. <a href="https://redirect.github.com/github/codeql-action/pull/4037">#4037</a></li> </ul> <h2>4.37.3 - 22 Jul 2026</h2> <p>No user facing changes.</p> <h2>4.37.2 - 21 Jul 2026</h2> <ul> <li>The new address format for the <code>config-file</code> input that was introduced in CodeQL Action 4.37.0 is now enabled by default. In addition to the format described there, the <code>remote=</code> prefix can now be used to explicitly indicate that the input refers to a remote file. All previous input formats continue to be accepted as well. <a href="https://redirect.github.com/github/codeql-action/pull/4023">#4023</a></li> <li>The CodeQL Action can now make use of <a href="https://docs.github.com/en/code-security/how-tos/secure-at-scale/configure-organization-security/manage-usage-and-access/giving-org-access-private-registries">configured private registries</a> in Default Setup to retrieve CodeQL configuration files from remote repositories that require authentication. This will allow customers to store their CodeQL configuration in a single repository that can then be referenced by Default Setup workflows in other repositories. We expect to roll this and other, related changes out to everyone in July. <a href="https://redirect.github.com/github/codeql-action/pull/4007">#4007</a></li> </ul> <h2>4.37.1 - 16 Jul 2026</h2> <ul> <li><em>Upcoming breaking change</em>: Add a deprecation warning for customers using CodeQL version 2.20.6 and earlier. These versions of CodeQL were discontinued on 1 July 2026 alongside GitHub Enterprise Server 3.16, and will be unsupported by the next minor release of the CodeQL Action. <a href="https://redirect.github.com/github/codeql-action/pull/3956">#3956</a></li> <li>Update default CodeQL bundle version to <a href="https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.26.1">2.26.1</a>. <a href="https://redirect.github.com/github/codeql-action/pull/4019">#4019</a></li> </ul> <h2>4.37.0 - 08 Jul 2026</h2> <ul> <li>Update default CodeQL bundle version to <a href="https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.26.0">2.26.0</a>. <a href="https://redirect.github.com/github/codeql-action/pull/3995">#3995</a></li> <li>In addition to the existing input format, the <code>config-file</code> input for the <code>codeql-action/init</code> step will soon support a new <code>[owner/]repo[@ref][:path]</code> format. All components except the repository name are optional. If omitted, <code>owner</code> defaults to the same owner as the repository the analysis is running for, <code>ref</code> to <code>main</code>, and <code>path</code> to <code>.github/codeql-action.yaml</code>. Support for this format ships in this version of the CodeQL Action, but will only be enabled over the coming weeks. <a href="https://redirect.github.com/github/codeql-action/pull/3973">#3973</a></li> </ul> <h2>4.36.3 - 01 Jul 2026</h2> <p>No user facing changes.</p> <h2>4.36.2 - 04 Jun 2026</h2> <ul> <li>Cache CodeQL CLI version information across Actions steps. <a href="https://redirect.github.com/github/codeql-action/pull/3943">#3943</a></li> <li>Reduce requests while waiting for analysis processing by using exponential backoff when polling SARIF processing status. <a href="https://redirect.github.com/github/codeql-action/pull/3937">#3937</a></li> <li>Update default CodeQL bundle version to <a href="https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.25.6">2.25.6</a>. <a href="https://redirect.github.com/github/codeql-action/pull/3948">#3948</a></li> </ul> <h2>4.36.1 - 02 Jun 2026</h2> <p>No user facing changes.</p> <h2>4.36.0 - 22 May 2026</h2> <ul> <li><em>Breaking change</em>: Bump the minimum required CodeQL bundle version to 2.19.4. <a href="https://redirect.github.com/github/codeql-action/pull/3894">#3894</a></li> <li>Add support for SHA-256 Git object IDs. <a href="https://redirect.github.com/github/codeql-action/pull/3893">#3893</a></li> <li>Update default CodeQL bundle version to <a href="https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.25.5">2.25.5</a>. <a href="https://redirect.github.com/github/codeql-action/pull/3926">#3926</a></li> </ul> <h2>4.35.5 - 15 May 2026</h2> <ul> <li>We have improved how the JavaScript bundles for the CodeQL Action are generated to avoid duplication across bundles and reduce the size of the repository by around 70%. This should have no effect on the runtime behaviour of the CodeQL Action. <a href="https://redirect.github.com/github/codeql-action/pull/3899">#3899</a></li> </ul> <!-- raw HTML omitted --> </blockquote> <p>... (truncated)</p> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/github/codeql-action/commit/e4fba868fa4b1b91e1fdab776edc8cfbe6e9fb81"><code>e4fba86</code></a> Merge pull request <a href="https://redirect.github.com/github/codeql-action/issues/4031">#4031</a> from github/update-v4.37.3-72f6a9da0</li> <li><a href="https://github.com/github/codeql-action/commit/fb50ab5d62a274adf3ef3e22cfe750ae87a0ede7"><code>fb50ab5</code></a> Update changelog for v4.37.3</li> <li><a href="https://github.com/github/codeql-action/commit/72f6a9da0def52d9193d6a758f0378b65091f8d1"><code>72f6a9d</code></a> Merge pull request <a href="https://redirect.github.com/github/codeql-action/issues/4030">#4030</a> from github/mbg/fix/no-proxy</li> <li><a href="https://github.com/github/codeql-action/commit/3b5ee58597653d9cc6785f3f1277f796d81f3646"><code>3b5ee58</code></a> Use default <code>request</code> options instead of <code>undefined</code></li> <li><a href="https://github.com/github/codeql-action/commit/bfb6be4b5ecd3650f02f530571453e8c64ef0778"><code>bfb6be4</code></a> Merge pull request <a href="https://redirect.github.com/github/codeql-action/issues/4028">#4028</a> from github/mergeback/v4.37.2-to-main-e0647621</li> <li><a href="https://github.com/github/codeql-action/commit/526ab84f9858816d9cf5f7b9df4dd5e2235f0eba"><code>526ab84</code></a> Rebuild</li> <li><a href="https://github.com/github/codeql-action/commit/d6217b9b8c14166e4851db94c11155d03bd13c07"><code>d6217b9</code></a> Update changelog and version after v4.37.2</li> <li><a href="https://github.com/github/codeql-action/commit/e0647621c2984b5ed2f768cb892365bf2a616ad1"><code>e064762</code></a> Merge pull request <a href="https://redirect.github.com/github/codeql-action/issues/4027">#4027</a> from github/update-v4.37.2-385bcdc5a</li> <li><a href="https://github.com/github/codeql-action/commit/e0faed839190caa67a5cd42f1cc16246028ca3df"><code>e0faed8</code></a> Add a couple of change notes</li> <li><a href="https://github.com/github/codeql-action/commit/73aad0eaa9df172668665a150d17b8bc5a650c20"><code>73aad0e</code></a> Update changelog for v4.37.2</li> <li>Additional commits viewable in <a href="https://github.com/github/codeql-action/compare/7188fc363630916deb702c7fdcf4e481b751f97a...e4fba868fa4b1b91e1fdab776edc8cfbe6e9fb81">compare view</a></li> </ul> </details> <br /> Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore <dependency name> major version` will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself) - `@dependabot ignore <dependency name> minor version` will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself) - `@dependabot ignore <dependency name>` will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself) - `@dependabot unignore <dependency name>` will remove all of the ignore conditions of the specified dependency - `@dependabot unignore <dependency name> <ignore condition>` will remove the ignore condition of the specified dependency and ignore conditions </details> Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> |