Skip to content

⬆️ Updates eslint-plugin-github to v6#885

Open
renovate[bot] wants to merge 1 commit intomasterfrom
renovate/eslint-plugin-github-6.x
Open

⬆️ Updates eslint-plugin-github to v6#885
renovate[bot] wants to merge 1 commit intomasterfrom
renovate/eslint-plugin-github-6.x

Conversation

@renovate
Copy link
Copy Markdown

@renovate renovate Bot commented Mar 22, 2025 •
edited
Loading

Note: This PR body was truncated due to platform limits.

This PR contains the following updates:

Package Change Age Confidence
eslint-plugin-github ^4.1.3 → ^6.0.0 age confidence

Release Notes

github/eslint-plugin-github (eslint-plugin-github)

v6.0.0

Compare Source

What's Changed

BREAKING CHANGE: This project is now ESM. Users of Node < 20.x will need to upgrade their version of Node, or continue to use v5.x of this library.

New Contributors

Full Changelog: github/eslint-plugin-github@v5.1.8...v6.0.0

v5.1.8

Compare Source

What's Changed

Full Changelog: github/eslint-plugin-github@v5.1.7...v5.1.8

v5.1.7

Compare Source

What's Changed

New Contributors

Full Changelog: github/eslint-plugin-github@v5.1.6...v5.1.7

v5.1.6

Compare Source

What's Changed

New Contributors

Full Changelog: github/eslint-plugin-github@v5.1.5...v.5.1.6

v5.1.5

Compare Source

What's Changed
New Contributors

Full Changelog: github/eslint-plugin-github@v5.1.4...v5.1.5

v5.1.4

Compare Source

What's Changed

Full Changelog: github/eslint-plugin-github@v5.1.3...v5.1.4

v5.1.3

Compare Source

What's Changed
  • ESLint <v9 will maintain backwards compatibility by using the original eslint-filenames-plugin by @​gracepark in #​579
  • For ESLint v9+, if you configured the filenames/match-regex rule, please note we have adapted the match regex rule into eslint-plugin-github as the original eslint-filenames-plugin is no longer maintained and needed an ESLint v9 update. Please update the rule name to github/filenames-match-regex and keep the same configuration.

Full Changelog: github/eslint-plugin-github@v5.1.2...v5.1.3

v5.1.2

Compare Source

What's Changed

Full Changelog: github/eslint-plugin-github@v5.1.1...v5.1.2

v5.1.1

Compare Source

What's Changed

Full Changelog: github/eslint-plugin-github@v5.1.0...v5.1.1

v5.1.0

Compare Source

In this release we're supporting ESLint's new flat config and still maintaining legacy configs for backwards compatibility. We've created flat configs via getFlatConfigs():

Usage
import github from 'eslint-plugin-github'

export default [
  github.getFlatConfigs().browser,
  github.getFlatConfigs().recommended,
  github.getFlatConfigs().react,
  ...github.getFlatConfigs().typescript,
  {
    files: ['**/*.{js,mjs,cjs,jsx,mjsx,ts,tsx,mtsx}'],
    ignores: ['eslint.config.mjs'],
    rules: {
      'github/array-foreach': 'error',
      'github/async-preventdefault': 'warn',
      'github/no-then': 'error',
      'github/no-blur': 'error',
    },
  },
]

What's Changed

New Contributors

Full Changelog: github/eslint-plugin-github@v5.0.2...v5.1.0

v5.0.2

Compare Source

What's Changed

Full Changelog: github/eslint-plugin-github@v5.0.1...v5.0.2

v5.0.1

Compare Source

What's Changed

Full Changelog: github/eslint-plugin-github@v5.0.0...v5.0.1

v5.0.0

Compare Source

Formally releasing v5.0.0!

This release includes everything in pre-release v5.0.0-2!

We notably dropped support for node 14 and node 16 in favor of node 18.

What's Changed

v4.10.2

Compare Source

What's Changed

Functionality
Dependancy updates

New Contributors

Full Changelog: github/eslint-plugin-github@v4.10.1...v4.10.2

v4.10.1

Compare Source

What's Changed

Full Changelog: github/eslint-plugin-github@v4.10.0...v4.10.1

v4.10.0

Compare Source

What's Changed

Full Changelog: github/eslint-plugin-github@v4.9.2...v4.10.0

v4.9.2

Compare Source

What's Changed

Full Changelog: github/eslint-plugin-github@v4.9.1...v4.9.2

v4.9.1

Compare Source

Bug fixes

This release includes bug fixes for a few accessibility rules including: a11y-aria-role-supports-props, a11y-no-title-attribute, and
jsx-a11y/no-interactive-element-to-noninteractive-role.

What's Changed

New Contributors

Full Changelog: github/eslint-plugin-github@v4.9.0...v4.9.1

v4.9.0

Compare Source

What's Changed

New Contributors

Full Changelog: github/eslint-plugin-github@v4.8.0...v4.9.0

v4.8.0

Compare Source

What's Changed

Full Changelog: github/eslint-plugin-github@v4.7.0...v4.8.0

v4.7.0

Compare Source

What's Changed

New Contributors

Full Changelog: github/eslint-plugin-github@v4.6.1...v4.7.0

v4.6.1

Compare Source

What's Changed
  • Update events handled by no-useless-passive and require-passive-events by @​boris-petrov in #​354
  • feat: role-supports-aria-props rule (no aria-label-misuse) by @​smockle in #​362
  • Updated dependencies
New Contributors

Full Changelog: github/eslint-plugin-github@v4.6.0...v4.6.1

v4.6.0

Compare Source

What's Changed

Full Changelog: github/eslint-plugin-github@v4.5.0...v4.6.0

v4.5.0

Compare Source

What's Changed
New Contributors

Full Changelog: github/eslint-plugin-github@v4.4.1...v4.5.0

v4.4.1

Compare Source

What's Changed

New Contributors

Full Changelog: github/eslint-plugin-github@v4.4.0...v4.4.1

v4.4.0

Compare Source

What's Changed

Configuration

📅 Schedule: Branch creation - "after 10pm every weekday,before 5am every weekday,every weekend" in timezone Europe/Moscow, Automerge - At any time (no schedule defined).

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

  • If you want to rebase/retry this PR, check this box

This PR was generated by Mend Renovate. View the repository job log.

@auto-assign auto-assign Bot requested a review from AlexRogalskiy March 22, 2025 08:12
@github-actions
Copy link
Copy Markdown

github-actions Bot commented Mar 22, 2025

Thanks for the PR!

This section of the codebase is owner by https://github.com/AlexRogalskiy/ - if they write a comment saying "LGTM" then it will be merged.

@github-actions
Copy link
Copy Markdown

github-actions Bot commented Mar 22, 2025

Thanks for opening an issue! Make sure you've followed CONTRIBUTING.md.

@github-actions
Copy link
Copy Markdown

github-actions Bot commented Mar 22, 2025

Hello from PR Helper

Is your PR ready for review and processing? Mark the PR ready by including #pr-ready in a comment.

If you still have work to do, even after marking this ready. Put the PR on hold by including #pr-onhold in a comment.

@renovate renovate Bot force-pushed the renovate/eslint-plugin-github-6.x branch 2 times, most recently from 4acdbc6 to 758b385 Compare August 15, 2025 12:10
@renovate renovate Bot force-pushed the renovate/eslint-plugin-github-6.x branch from 758b385 to 46a91ca Compare August 23, 2025 06:53
@renovate renovate Bot force-pushed the renovate/eslint-plugin-github-6.x branch from 46a91ca to d500c55 Compare September 1, 2025 04:28
@renovate renovate Bot force-pushed the renovate/eslint-plugin-github-6.x branch from d500c55 to f30afed Compare September 26, 2025 07:11
@renovate renovate Bot force-pushed the renovate/eslint-plugin-github-6.x branch from f30afed to f299b1c Compare October 23, 2025 08:17
@renovate renovate Bot force-pushed the renovate/eslint-plugin-github-6.x branch 2 times, most recently from 69ad8bc to d9f2c7a Compare November 19, 2025 03:53
@renovate renovate Bot force-pushed the renovate/eslint-plugin-github-6.x branch from d9f2c7a to 797a83b Compare December 5, 2025 00:13
@socket-security
Copy link
Copy Markdown

socket-security Bot commented Dec 5, 2025 •
edited
Loading

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff Package Supply Chain
Security		 Vulnerability Quality Maintenance License
Addedlodash@​4.17.2075758788100
Addedjsonpath@​1.1.01008310084100
Addedjsonlint@​1.6.31001009075100
Addedlicense-checker@​25.0.19910010075100
Addedremark-preset-davidtheclark@​0.12.0761008078100
Addedmarkdown-link-check@​3.8.79910010082100
Addedremark-lint-code-block-style@​2.0.110010010083100
Addedremark-lint-ordered-list-marker-value@​2.0.110010010083100
Addedremark-cli@​9.0.01001009883100
Addedremark-validate-links@​10.0.49910010083100
Updatedeslint-plugin-github@​4.1.3 ⏵ 6.0.098 -1100100 +1886 -1100
Addedpretty-quick@​3.1.09910010086100
Addedsemantic-release@​17.3.9969910091100
Addedprettier@​2.2.1921009897100
Addedlint-staged@​10.5.49810010093100

View full report

@renovate renovate Bot force-pushed the renovate/eslint-plugin-github-6.x branch from 797a83b to 39173d3 Compare December 31, 2025 23:52
@renovate renovate Bot force-pushed the renovate/eslint-plugin-github-6.x branch from 39173d3 to 3d4a10f Compare January 9, 2026 15:43
@renovate renovate Bot force-pushed the renovate/eslint-plugin-github-6.x branch 2 times, most recently from cdeca50 to 87d1859 Compare January 24, 2026 04:00
@renovate renovate Bot force-pushed the renovate/eslint-plugin-github-6.x branch from 87d1859 to 39344b5 Compare February 3, 2026 06:56
@renovate renovate Bot force-pushed the renovate/eslint-plugin-github-6.x branch 2 times, most recently from 14fba04 to 09d6846 Compare February 18, 2026 07:39
@renovate renovate Bot force-pushed the renovate/eslint-plugin-github-6.x branch 2 times, most recently from 5a0fdba to 0fd7194 Compare March 14, 2026 09:16
@renovate
⬆️ Updates eslint-plugin-github to v6
398cc1a 
Signed-off-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>
@renovate renovate Bot force-pushed the renovate/eslint-plugin-github-6.x branch from 0fd7194 to 398cc1a Compare April 15, 2026 15:26
@socket-security
Copy link
Copy Markdown

socket-security Bot commented Apr 15, 2026

Warning

Review the following alerts detected in dependencies.

According to your organization's Security Policy, it is recommended to resolve "Warn" alerts. Learn more about Socket for GitHub.

Action Severity Alert  (click "▶" to expand/collapse)
Warn Critical
Critical CVE: npm json-schema is vulnerable to Prototype Pollution

CVE: GHSA-896r-f27r-55mw json-schema is vulnerable to Prototype Pollution (CRITICAL)

Affected versions: < 0.4.0

Patched version: 0.4.0

From: package-lock.json → npm/@semantic-release/npm@7.0.10 → npm/jest-circus@26.6.3 → npm/coveralls@3.1.0 → npm/jest@26.6.3 → npm/markdown-link-check@3.8.7 → npm/json-schema@0.2.3

ℹ Read more on: This package | This alert | What is a critical CVE?

Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev.

Suggestion: Remove or replace dependencies that include known critical CVEs. Consumers can use dependency overrides or npm audit fix --force to remove vulnerable dependencies.

Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/json-schema@0.2.3. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

Warn Critical
Critical CVE: Prototype Pollution in npm minimist

CVE: GHSA-xvch-5gv4-984h Prototype Pollution in minimist (CRITICAL)

Affected versions: >= 1.0.0 < 1.2.6; < 0.2.4

Patched version: 1.2.6

From: package-lock.json → npm/folio@0.3.18 → npm/conventional-changelog-cli@2.1.1 → npm/@semantic-release/npm@7.0.10 → npm/license-checker@25.0.1 → npm/jest-circus@26.6.3 → npm/coveralls@3.1.0 → npm/jest@26.6.3 → npm/@semantic-release/release-notes-generator@9.0.1 → npm/minimist@1.2.5

ℹ Read more on: This package | This alert | What is a critical CVE?

Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev.

Suggestion: Remove or replace dependencies that include known critical CVEs. Consumers can use dependency overrides or npm audit fix --force to remove vulnerable dependencies.

Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/minimist@1.2.5. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

Warn High
Obfuscated code: npm npm is 94.0% likely obfuscated

Confidence: 0.94

Location: Package overview

From: package-lock.json → npm/@semantic-release/npm@7.0.10 → npm/npm@6.14.11

ℹ Read more on: This package | This alert | What is obfuscated code?

Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev.

Suggestion: Packages should not obfuscate their code. Consider not using packages with obfuscated code.

Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/npm@6.14.11. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

View full report

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@AlexRogalskiy AlexRogalskiy Awaiting requested review from AlexRogalskiy

Assignees

No one assigned

Labels

npm dependencies review-required

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

0 participants