Skip to content

chore(deps): bump softprops/action-gh-release from 2.6.2 to 3.0.0#2

Open
dependabot[bot] wants to merge 10 commits into
mainfrom
dependabot/github_actions/softprops/action-gh-release-3
Open

chore(deps): bump softprops/action-gh-release from 2.6.2 to 3.0.0#2
dependabot[bot] wants to merge 10 commits into
mainfrom
dependabot/github_actions/softprops/action-gh-release-3

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Jun 2, 2026 •
edited
Loading

Copy link
Copy Markdown

Bumps softprops/action-gh-release from 2.6.2 to 3.0.0.

Release notes

Sourced from softprops/action-gh-release's releases.

v3.0.0

3.0.0 is a major release that moves the action runtime from Node 20 to Node 24. Use v3 on GitHub-hosted runners and self-hosted fleets that already support the Node 24 Actions runtime. If you still need the last Node 20-compatible line, stay on v2.6.2.

What's Changed

Other Changes 🔄

  • Move the action runtime and bundle target to Node 24
  • Update @types/node to the Node 24 line and allow future Dependabot updates
  • Keep the floating major tag on v3; v2 remains pinned to the latest 2.x release
Changelog

Sourced from softprops/action-gh-release's changelog.

3.0.0

3.0.0 is a major release that moves the action runtime from Node 20 to Node 24. Use v3 on GitHub-hosted runners and self-hosted fleets that already support the Node 24 Actions runtime. If you still need the last Node 20-compatible line, stay on v2.6.2.

What's Changed

Other Changes 🔄

  • Move the action runtime and bundle target to Node 24
  • Update @types/node to the Node 24 line and allow future Dependabot updates
  • Keep the floating major tag on v3; v2 remains pinned to the latest 2.x release

2.6.2

What's Changed

Other Changes 🔄

2.6.1

2.6.1 is a patch release focused on restoring linked discussion thread creation when discussion_category_name is set. It fixes [#764](https://github.com/softprops/action-gh-release/issues/764), where the draft-first publish flow stopped carrying the discussion category through the final publish step.

If you still hit an issue after upgrading, please open a report with the bug template and include a minimal repro or sanitized workflow snippet where possible.

What's Changed

Bug fixes 🐛

2.6.0

2.6.0 is a minor release centered on previous_tag support for generate_release_notes, which lets workflows pin GitHub's comparison base explicitly instead of relying on the default range. It also includes the recent concurrent asset upload recovery fix, a working_directory docs sync, a checked-bundle freshness guard for maintainers, and clearer immutable-prerelease guidance where GitHub platform behavior imposes constraints on how prerelease asset uploads can be published.

If you still hit an issue after upgrading, please open a report with the bug template and include a minimal repro or sanitized workflow snippet where possible.

What's Changed

... (truncated)

Commits

@aedneth
feat: agent-native monorepo foundation (core, cli, open sources)
efa3300 
feat: agent-native monorepo foundation (core, cli, open sources)
@dependabot dependabot Bot added dependencies Pull requests that update a dependency file github_actions Pull requests that update GitHub Actions code labels Jun 2, 2026
aedneth and others added 9 commits June 2, 2026 13:14
@aedneth @claude
docs: apply GitHub Repo Growth Standard
5a5442f 
- README: add CI/release/license badges to header
- README: add Demo section with sample terminal output
- README: add Roadmap table (v0.1.0→v1.0.0)
- README: add Contributing section linking CONTRIBUTING.md
- README: expand nav links to include Roadmap and Contributing
- CHANGELOG: restructure to proper Keep a Changelog format —
  move scaffold additions to [0.1.0] 2026-06-02, add CI fix entry,
  add empty [Unreleased], fix footer links (sapientia → aedneth org)

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
@aedneth @claude
fix: apply Opus architecture audit findings (P0 + P1)
55a2942 
P0 — Critical:
- download: validate URL scheme (https/http only) and reject private/loopback
  hosts before fetching to prevent SSRF from malicious adapter responses
- download: detect 206-not-honored resume corruption — truncate bad file and
  surface a clear FilesystemError rather than silently leaving corrupt data
- execute + registry/types: add setExitCode() to CommandContext so handlers
  can signal partial success; search now emits exit 8 when any source fails
- mcp/server: exclude 'config' from MCP tool surface — exposes mutating set
  action; read-only config access via manifest/file path is the safe path

P1 — Important:
- registry: remove --ndjson from GLOBAL_FLAGS (advertised but unimplemented;
  re-add when streaming output is built)
- sources: throw UsageError (exit 2) for enable/disable instead of silently
  returning ok:true — agents branching on exit code were misled
- catalog: quote FTS5 MATCH term to prevent SQLite parse error on user input
  containing operators (parentheses, colons, etc.)

All changes: build ✓ typecheck ✓ lint ✓ 8/8 tests ✓

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
@aedneth @claude
chore(brain): add per-project second brain layer (.brain/ + hooks)
b7cb57a 
Portable three-layer knowledge graph integration: SessionStart/PostToolUse/
UserPromptSubmit/Stop/PreToolUse hooks, graphify graph (auto-updates on commit),
decisions + bugs ADRs committed, runtime artifacts gitignored. No-ops gracefully
without local CKIS vault — external contributors unaffected.

Registered in Dev Brain (~/Documents/Dev Brain/); graph-report auto-synced to CKIS
02-projects/<slug>/graph-report.md on each commit.

Co-Authored-By: Claude Sonnet 4.6 (1M context) <noreply@anthropic.com>
@aedneth
chore: merge brain-layer — per-project .brain/ CKIS integration
e688e90
@aedneth @claude
chore(security): zero-trust npm hardening + CVE patches
6138cb8 
- Add .npmrc: ignore-scripts=true, registry pin, save-exact=true
- Patch GHSA-5xrq-8626-4rwp: vitest → ^4.1.8 (critical — arbitrary file read/exec)
- Pin all GitHub Actions to commit SHAs (not mutable tags)
- Add --ignore-scripts to all npm ci / pnpm install steps in CI
- Add explicit native module whitelist with npm_config_ignore_scripts=false rebuild
- Add npm audit --audit-level=high gate to all CI and release workflows
- Add permissions: {} (deny-all default) with per-job minimum grants
- Add persist-credentials: false to all checkout steps
- Add weekly security-audit.yml workflow (runs every Monday 09:00 UTC)
- Add SECURITY.md with supply chain security policy and vulnerability disclosure

Co-Authored-By: Claude Sonnet 4.6 (1M context) <noreply@anthropic.com>
@aedneth @claude
chore(security): add .npmrc security lockdown (pnpm)
f53300e 
Co-Authored-By: Claude Sonnet 4.6 (1M context) <noreply@anthropic.com>
@aedneth @claude
fix(security): patch vitest GHSA-5xrq-8626-4rwp + pin CodeQL SHA + es…
a55ce74 
…build override

- vitest → ^4.1.8 (critical GHSA-5xrq-8626-4rwp: arbitrary file read/exec)
- pnpm.overrides: esbuild >=0.25.0 (clears esbuild moderate)
- Remaining moderate: vite path traversal (dev-server only, not triggered in CI or
  published package; vite override deferred — would break tsup which requires vite 5)
- CodeQL workflow: pinned to SHA d77b13a0, permissions: {}, persist-credentials: false

Co-Authored-By: Claude Sonnet 4.6 (1M context) <noreply@anthropic.com>
@aedneth @claude
feat: sapientia-cli v1.0.0 — Gutenberg + Standard Ebooks, local catal…
d215462 
…og, import pipeline

Take the monorepo from architecture-only v0.1.0 to a working v1.0.0:

- Standard Ebooks adapter rewritten: OPDS (now 401-gated) → anonymous HTML
  catalog scrape; EPUB download requires ?source=download to get the binary
  instead of the interstitial page.
- Gutenberg + Standard Ebooks throttle to >=1 req/sec (module-level).
- library --import <dir>: recursive scan, filename+dir-as-category metadata,
  SHA-256 dedup, skips unsupported/unreadable, stderr progress.
- Catalog now returns authors (group_concat in list/search; rowToBook no longer
  hardcodes []). First catalog + import unit tests added.
- CLI flag fix: normalizeFlags() aliases Commander's camelCased keys back to the
  declared hyphenated names (--to-catalog / --output-dir were silently no-ops).
- doctor self-heals (mkdir) and checks writability; search ranks standard-ebooks
  above Gutenberg.
- Build/security: typescript devDep added per-package (.npmrc no-hoist); vite
  pinned ^6.4.2 (devDep + override) for vitest 4 + path-traversal CVE.

Verified: build (4 pkgs), 24 tests, typecheck 0 errors, audit clean,
real EPUB downloads from both sources land + catalog.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
@dependabot
chore(deps): bump softprops/action-gh-release from 2.6.2 to 3.0.0
4b3a24f 
Bumps [softprops/action-gh-release](https://github.com/softprops/action-gh-release) from 2.6.2 to 3.0.0.
- [Release notes](https://github.com/softprops/action-gh-release/releases)
- [Changelog](https://github.com/softprops/action-gh-release/blob/master/CHANGELOG.md)
- [Commits](softprops/action-gh-release@3bb1273...b430933)

---
updated-dependencies:
- dependency-name: softprops/action-gh-release
  dependency-version: '3'
  dependency-type: direct:production
  update-type: version-update:semver-major
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot Bot changed the title chore(deps): bump softprops/action-gh-release from 2 to 3 chore(deps): bump softprops/action-gh-release from 2.6.2 to 3.0.0 Jun 4, 2026
@dependabot dependabot Bot force-pushed the dependabot/github_actions/softprops/action-gh-release-3 branch from a71055c to 4b3a24f Compare June 4, 2026 09:24
@dependabot @github

dependabot Bot commented on behalf of github Jun 9, 2026

Copy link
Copy Markdown
Author

A newer version of softprops/action-gh-release exists, but since this PR has been edited by someone other than Dependabot I haven't updated it. You'll get a PR for the updated version as normal once this PR is merged.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

dependencies Pull requests that update a dependency file github_actions Pull requests that update GitHub Actions code

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

1 participant

@aedneth