From 14199590d7b7663c637ee7e5287a6ce708e6d9be Mon Sep 17 00:00:00 2001 From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com> Date: Mon, 3 Aug 2026 21:49:37 +0000 Subject: [PATCH 1/4] chore(deps-dev): Bump undici Bumps the npm_and_yarn group with 1 update in the / directory: [undici](https://github.com/nodejs/undici). Updates `undici` from 8.5.0 to 8.9.0 - [Release notes](https://github.com/nodejs/undici/releases) - [Commits](https://github.com/nodejs/undici/compare/v8.5.0...v8.9.0) --- updated-dependencies: - dependency-name: undici dependency-version: 8.9.0 dependency-type: direct:development dependency-group: npm_and_yarn ... Signed-off-by: dependabot[bot] --- package-lock.json | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) diff --git a/package-lock.json b/package-lock.json index e8648dc..b111fc7 100644 --- a/package-lock.json +++ b/package-lock.json @@ -39,7 +39,7 @@ "node-fetch": "^3.0.0", "superagent": "^8.0.0 || ^9.0.0 || ^10.0.0", "typed-rest-client": "^2.0.0", - "undici": "^5.0.0 || ^6.0.0 || ^7.0.0", + "undici": "^8.0.2", "wretch": "^2.0.0 || ^3.0.0" }, "peerDependenciesMeta": { @@ -2920,9 +2920,9 @@ "license": "MIT" }, "node_modules/undici": { - "version": "8.5.0", - "resolved": "https://registry.npmjs.org/undici/-/undici-8.5.0.tgz", - "integrity": "sha512-xamtWoB1EshgjpmlXd7GGm2VfdDtw1+rD8uhry8pSNW3If6S8E0m2T2+orSKeZXEn/aPJMviCpDBA65WJt8zhg==", + "version": "8.9.0", + "resolved": "https://registry.npmjs.org/undici/-/undici-8.9.0.tgz", + "integrity": "sha512-aWZpUj7XoGonMClx4gdDRfgBjqeA+F473aDmROQQbM9n6PRfK/u1q/a0X4wMTgcHfT8H6fpbt98PFuDUwFg2YA==", "dev": true, "license": "MIT", "engines": { From 7989f7ca602822e9fa268a7d145e84c1c7e43376 Mon Sep 17 00:00:00 2001 From: Cursor Agent Date: Tue, 4 Aug 2026 01:48:21 +0000 Subject: [PATCH 2/4] ci: bump checkout and setup-node to v6 for Node 24 Clear the Node.js 20 deprecation warning in the proxy integration tests workflow by matching the action majors used elsewhere. Co-authored-by: ProxyMesh AI --- .github/workflows/proxy_integration_tests.yml | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/.github/workflows/proxy_integration_tests.yml b/.github/workflows/proxy_integration_tests.yml index 60b9acb..c15f336 100644 --- a/.github/workflows/proxy_integration_tests.yml +++ b/.github/workflows/proxy_integration_tests.yml @@ -16,12 +16,12 @@ jobs: runs-on: ubuntu-latest steps: - - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2 + - uses: actions/checkout@v6 with: persist-credentials: false - name: Set up Node - uses: actions/setup-node@v4 + uses: actions/setup-node@v6 with: node-version: "22" cache: npm From 1304d337b19f74162af30bfd32166895acc0354e Mon Sep 17 00:00:00 2001 From: ProxyMesh AI Date: Tue, 4 Aug 2026 01:53:58 +0000 Subject: [PATCH 3/4] ci: pin GitHub Actions to commit SHAs Use immutable SHAs with version comments instead of floating major tags. Co-authored-by: Cursor --- .github/workflows/proxy_integration_tests.yml | 4 ++-- .github/workflows/publish.yml | 4 ++-- .github/workflows/release-on-merge.yml | 2 +- 3 files changed, 5 insertions(+), 5 deletions(-) diff --git a/.github/workflows/proxy_integration_tests.yml b/.github/workflows/proxy_integration_tests.yml index c15f336..9dac3a7 100644 --- a/.github/workflows/proxy_integration_tests.yml +++ b/.github/workflows/proxy_integration_tests.yml @@ -16,12 +16,12 @@ jobs: runs-on: ubuntu-latest steps: - - uses: actions/checkout@v6 + - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3 with: persist-credentials: false - name: Set up Node - uses: actions/setup-node@v6 + uses: actions/setup-node@249970729cb0ef3589644e2896645e5dc5ba9c38 # v6.5.0 with: node-version: "22" cache: npm diff --git a/.github/workflows/publish.yml b/.github/workflows/publish.yml index 2fcd234..2a71f70 100644 --- a/.github/workflows/publish.yml +++ b/.github/workflows/publish.yml @@ -22,7 +22,7 @@ jobs: contents: read id-token: write steps: - - uses: actions/checkout@v6 + - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3 with: ref: ${{ github.event_name == 'workflow_run' && 'main' || github.event_name == 'release' && github.ref || 'main' }} @@ -50,7 +50,7 @@ jobs: # the toolcache `npm` binary on GitHub-hosted runners, so `npm publish` stayed on 10.x and OIDC trusted publishing never ran. - name: Setup Node if: steps.gate.outputs.publish == 'true' - uses: actions/setup-node@v6 + uses: actions/setup-node@249970729cb0ef3589644e2896645e5dc5ba9c38 # v6.5.0 with: node-version: 24 cache: npm diff --git a/.github/workflows/release-on-merge.yml b/.github/workflows/release-on-merge.yml index 7c06786..6487546 100644 --- a/.github/workflows/release-on-merge.yml +++ b/.github/workflows/release-on-merge.yml @@ -26,7 +26,7 @@ jobs: runs-on: ubuntu-latest steps: - name: Checkout merge commit - uses: actions/checkout@v6 + uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3 with: ref: ${{ github.event.pull_request.merge_commit_sha }} From 9c1e65579109e3233a61d8ab8af1e5c61ba82543 Mon Sep 17 00:00:00 2001 From: ProxyMesh AI Date: Tue, 4 Aug 2026 01:54:54 +0000 Subject: [PATCH 4/4] chore: add Cursor rule for Actions SHA pinning Keep workflow edits on Node 24-compatible majors pinned to commit SHAs. Co-authored-by: Cursor --- .cursor/rules/github-actions.mdc | 72 ++++++++++++++++++++++++++++++++ 1 file changed, 72 insertions(+) create mode 100644 .cursor/rules/github-actions.mdc diff --git a/.cursor/rules/github-actions.mdc b/.cursor/rules/github-actions.mdc new file mode 100644 index 0000000..0557203 --- /dev/null +++ b/.cursor/rules/github-actions.mdc @@ -0,0 +1,72 @@ +--- +description: Pin GitHub Actions to Node 24-compatible commit SHAs (not version tags) +globs: .github/workflows/**/*.{yml,yaml} +alwaysApply: false +--- + +# GitHub Actions — Node 24 and SHA pinning + +When you **create or change** any file under `.github/workflows/` (or composite/reusable actions under `.github/actions/`): + +## 1. Use Node 24–compatible action majors + +GitHub deprecated Node 20 for JavaScript actions. Do **not** use older majors that still target Node 20: + +| Action | Do not use | Use instead | +|--------|------------|-------------| +| `actions/checkout` | v4 and below | **v6** | +| `actions/setup-node` | v4 and below | **v6** | +| `actions/setup-python` | v5 and below | **v6** | +| `actions/upload-artifact` | v4 and below | **v7** | +| `actions/download-artifact` | v4 and below | **v8** | +| `actions/cache` | v4 and below | **v5** | + +Apply the same rule to other official `actions/*` helpers: pick the current major whose `action.yml` declares `using: node24`. + +## 2. Pin every `uses:` to a commit SHA + +- **Never** leave floating refs: `@v6`, `@v4`, `@main`, branch names, or tags alone. +- **Always** use the 40-character commit SHA, with the human-readable version in a trailing comment. + +```yaml +# Bad +uses: actions/checkout@v6 + +# Good +uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3 +``` + +Preferred SHAs for common official actions (update when bumping): + +```yaml +uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3 +uses: actions/setup-node@249970729cb0ef3589644e2896645e5dc5ba9c38 # v6.5.0 +uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6.2.0 +uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1 +uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1 +uses: actions/cache@27d5ce7f107fe9357f9df03efb73ab90386fccae # v5.0.5 +``` + +Resolve newer SHAs from the latest patch tag on the major line: + +```bash +gh api "repos/actions/checkout/git/ref/tags/v6.0.3" -q '.object.sha' +# If type is "tag", dereference: gh api "repos/actions/checkout/git/tags/SHA" -q '.object.sha' +``` + +Apply the same SHA-pinning rule to third-party actions (`uses: org/action@sha # vX.Y.Z`). + +## 3. Run actionlint before finishing + +```bash +actionlint .github/workflows/*.yml +``` + +Fix all errors and warnings; re-run until exit code 0. + +## 4. Completion checklist + +- [ ] Official actions use Node 24–compatible majors (v6/v7/v8/v5 as above) +- [ ] Every `uses:` references a full commit SHA (not a tag/branch) +- [ ] Version comments match the resolved release (e.g. `# v6.0.3`) +- [ ] `actionlint` passes on changed workflows