chore(deps): Bump github/codeql-action from 3 to 4#98
Conversation
dependabot
bot
added
dependencies
|
Review the following changes in direct dependencies. Learn more about Socket for GitHub.
|
|
Warning Review the following alerts detected in dependencies. According to your organization's Security Policy, it is recommended to resolve "Warn" alerts. Learn more about Socket for GitHub.
|
![cubic-dev-ai[bot]](https://avatars.githubusercontent.com/in/1082092?s=60&v=4){kind=small}
There was a problem hiding this comment.
1 issue found across 4 files (changes from recent commits).
Prompt for AI agents (all issues)
Check if these issues are valid — if so, understand the root cause of each and fix them. If appropriate, use sub-agents to investigate and fix each issue separately.
<file name="packages/astudio-make-template/package.json">
<violation number="1" location="packages/astudio-make-template/package.json:14">
P2: Incomplete rename: guideline/template files in this package still reference the old `@design-studio/icons` package name. Since `astudio-make-template` is a template package (its `files` field exports `guidelines/` and `src/`), consumers will receive documentation with stale import paths that don't resolve. Update the references in `guidelines/overview-icons.md` and `guidelines/Guidelines.md` to `@design-studio/astudio-icons`.</violation>
</file>
Reply with feedback, questions, or to request a fix. Tag @cubic-dev-ai to re-run a review.
There was a problem hiding this comment.
1 issue found across 3 files (changes from recent commits).
Prompt for AI agents (all issues)
Check if these issues are valid — if so, understand the root cause of each and fix them. If appropriate, use sub-agents to investigate and fix each issue separately.
<file name="docs/design-system/COVERAGE_MATRIX.md">
<violation number="1" location="docs/design-system/COVERAGE_MATRIX.md:62">
P2: Duplicate component entries caused by case-sensitivity bug in the generator. Components like `accordion` and `Accordion` both appear in the matrix — one as `local_primitive` and one as `radix_fallback` — because `collectFallbackComponents()` indexes by PascalCase filename (e.g., `Accordion`) while `collectComponentNames()` now returns lowercase directory names (e.g., `accordion`). The case-sensitive `Map.get()` lookup misses the match, producing incorrect source classification and duplicate rows.
Fix the generator (`scripts/generate-coverage-matrix.ts`) to use case-insensitive fallback lookups, e.g., normalize both the fallback map keys and the component names to lowercase before matching.</violation>
</file>
Reply with feedback, questions, or to request a fix. Tag @cubic-dev-ai to re-run a review.
There was a problem hiding this comment.
1 issue found across 3 files (changes from recent commits).
Prompt for AI agents (all issues)
Check if these issues are valid — if so, understand the root cause of each and fix them. If appropriate, use sub-agents to investigate and fix each issue separately.
<file name="docs/design-system/COVERAGE_MATRIX.json">
<violation number="1" location="docs/design-system/COVERAGE_MATRIX.json:764">
P2: Invalid `status` value: `"widget_used"` is not a recognized status — every other entry uses `"active"`. This looks like an editing mistake where the field name was accidentally used as the status value. The status should remain `"active"` while only the `widget_used` boolean changes to `true`.</violation>
</file>
Reply with feedback, questions, or to request a fix. Tag @cubic-dev-ai to re-run a review.
|
Automation triage update: resolved actionable review comments and repaired lockfile + matrix generation blockers on this branch. Remaining blocker is CI \ failing in \ with broad repo-baseline errors (TS6307 + missing icon/apps-sdk exports) that are not specific to the CodeQL action bump.\n\nManual next step: merge a baseline typecheck stabilization change to , then update/re-run this Dependabot PR. |
|
Blocker note: build (ubuntu-latest) fails at Type-check packages with broad baseline errors (TS6307 project file-list, missing icon exports, missing integrations/apps-sdk types). These are repo-wide and not isolated to this Dependabot bump. Next step: land a dedicated baseline typecheck stabilization PR on main, then update and rerun PR #98. |
Bumps [github/codeql-action](https://github.com/github/codeql-action) from 3 to 4. - [Release notes](https://github.com/github/codeql-action/releases) - [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md) - [Commits](github/codeql-action@v3...v4) --- updated-dependencies: - dependency-name: github/codeql-action dependency-version: '4' dependency-type: direct:production update-type: version-update:semver-major ... Signed-off-by: dependabot[bot] <support@github.com>
jscraik
force-pushed
the
dependabot/github_actions/github/codeql-action-4
branch
from
b06898b to
c8ef296
Compare
|
The latest updates on your projects. Learn more about Argos notifications ↗︎
|
1 participant
Bumps github/codeql-action from 3 to 4.
Release notes
Sourced from github/codeql-action's releases.
... (truncated)
Changelog
Sourced from github/codeql-action's changelog.
... (truncated)
Commits
5c96b6eAdd JSDoc comments toupload-libtypes44a4beaFixup: add missing.env11c6c18Only run when debugging or test mode is enabled99fcc7bCheck whethervalueis a URL incheckEnvVarand clear credentialsc1d6ee5Fix typosef9cfd9Clear GHAJAVA_HOME_*env vars fordiscoverActionsJdkstestDependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting
@dependabot rebase.Dependabot commands and options
You can trigger Dependabot actions by commenting on this PR:
@dependabot rebasewill rebase this PR@dependabot recreatewill recreate this PR, overwriting any edits that have been made to it@dependabot show <dependency name> ignore conditionswill show all of the ignore conditions of the specified dependency@dependabot ignore this major versionwill close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)@dependabot ignore this minor versionwill close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)@dependabot ignore this dependencywill close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)Summary by cubic
Upgrade the CodeQL workflow to github/codeql-action v4 for init, autobuild, and analyze. Keeps security analysis on the latest CodeQL bundle and fixes.
Written for commit c8ef296. Summary will update on new commits.