build(deps-dev): bump undici from 7.28.0 to 7.29.0 in the npm_and_yarn group across 1 directory - #751
Conversation
Bumps the npm_and_yarn group with 1 update in the / directory: [undici](https://github.com/nodejs/undici). Updates `undici` from 7.28.0 to 7.29.0 - [Release notes](https://github.com/nodejs/undici/releases) - [Commits](nodejs/undici@v7.28.0...v7.29.0) --- updated-dependencies: - dependency-name: undici dependency-version: 7.29.0 dependency-type: indirect dependency-group: npm_and_yarn ... Signed-off-by: dependabot[bot] <support@github.com>
dependabot
Bot
added
dependencies
|
Important Review skippedReview was skipped due to path filters ⛔ Files ignored due to path filters (1)
CodeRabbit blocks several paths by default. You can override this behavior by explicitly including those paths in the path filters. For example, including ⚙️ Run configurationConfiguration used: Organization UI Review profile: CHILL Plan: Pro Plus Run ID: You can disable this status message by setting the Use the checkbox below for a quick retry:
Comment |
![opencode-agent[bot]](https://avatars.githubusercontent.com/in/1549082?s=60&v=4){kind=small}
There was a problem hiding this comment.
Pull request overview
OpenCode cannot approve yet because required coverage evidence did not pass.
Review outcome
1. HIGH .github/workflows/opencode-review.yml:1 - Coverage evidence did not prove required test/docstring evidence
-
Problem: The required coverage-evidence job result was
failure, so OpenCode cannot establish approval sufficiency for this head. -
Root cause: Automated approval is only valid when the same-head coverage-evidence job proves supported repository test suites passed and configured docstring gates passed or were advisory, or reports not applicable because no supported source files or package manifests exist. Missing, failed, skipped, unavailable, or unsupported-tooling test evidence is a blocker.
-
Fix: Install or configure the repository test/docstring evidence tooling when source files or package manifests exist, rerun the current-head coverage-evidence job, and approve only after it reports
successwith required evidence or explicit no-source not-applicable evidence. -
Regression test: Keep the approval branch checking
needs.coverage-evidence.result == successbefore posting APPROVE, and publish REQUEST_CHANGES when coverage-evidence blocker states such as cancelled, skipped, failed, unsupported-tooling, or below-100 evidence are present. -
Result: REQUEST_CHANGES
-
Reason: coverage-evidence result was
failure, so required test/docstring evidence was not proven for current headfa1dc9436a7cc0fc2aa0982159309e4c2b5502f4. -
Head SHA:
fa1dc9436a7cc0fc2aa0982159309e4c2b5502f4 -
Workflow run: 30992866042
-
Workflow attempt: 1
Coverage evidence
Coverage evidence job did not run or did not publish coverage evidence.
Changed-File Evidence Map
flowchart LR
PR["PR changed files"] --> Evidence["OpenCode bounded evidence"]
Evidence --> S1["Changed file: package-lock.json"]
S1 --> I1["repository behavior"]
I1 --> R1["Review risk: Changed file: package-lock.json"]
R1 --> V1["required checks"]
OpenCode Review Overview
Pull request overviewOpenCode cannot approve yet because required coverage evidence did not pass. Review outcome1. HIGH .github/workflows/opencode-review.yml:1 - Coverage evidence did not prove required test/docstring evidence
Coverage evidenceCoverage evidence job did not run or did not publish coverage evidence. Changed-File Evidence Mapflowchart LR
PR["PR changed files"] --> Evidence["OpenCode bounded evidence"]
Evidence --> S1["Changed file: package-lock.json"]
S1 --> I1["repository behavior"]
I1 --> R1["Review risk: Changed file: package-lock.json"]
R1 --> V1["required checks"]
|
|
Exact-head review diagnosis: product CI, security, SAST, and release checks are green at The bounded fix and adversarial test requirements have been recorded on |
|
@opencode-agent review Re-evaluate exact current head |
|
Tip For best results, initiate chat on the files or code changes. 🧩 Analysis chain🏁 Script executed: #!/bin/bash
set -euo pipefail
head='fa1dc9436a7cc0fc2aa0982159309e4c2b5502f4'
echo '== Checked-out commit =='
git rev-parse HEAD
echo '== Requested commit exists =='
git rev-parse "${head}^{commit}"
echo '== Branch and merge base =='
git branch --show-current
git merge-base "$head" develop
echo '== Exact diff stat against develop =='
git diff --stat develop "$head"
echo '== Exact changed files against develop =='
git diff --name-status develop "$head"
echo '== Lockfile changes for undici =='
lockfile="$(fd -a -t f '^package-lock\.json$' . | head -n 1 || true)"
if [ -z "$lockfile" ]; then
echo 'No package-lock.json found.'
exit 1
fi
printf 'Lockfile: %s\n' "$lockfile"
git diff --unified=20 develop "$head" -- "$lockfile" | sed -n '/undici/,+45p'
echo '== Relevant final lockfile entries =='
rg -n -C 3 '"node_modules/undici"|"undici": "7\.(28|29)\.0"|node_modules/@types/react-dom' "$lockfile"
echo '== Pull request checks at requested head =='
gh pr checks 751 --repo ContextualWisdomLab/bandscope --json name,state,link,workflow 2>&1 || true
echo '== Pull request review decision and open review threads =='
gh pr view 751 --repo ContextualWisdomLab/bandscope --json headRefOid,baseRefName,reviewDecision,reviews,comments 2>&1 || trueLength of output: 20193 🏁 Script executed: #!/bin/bash
set -euo pipefail
repo='ContextualWisdomLab/bandscope'
head='fa1dc9436a7cc0fc2aa0982159309e4c2b5502f4'
lockfile='package-lock.json'
run_id='30915346655'
echo '== Complete exact diff =='
git diff --unified=5 develop "$head" -- "$lockfile"
echo '== Lockfile JSON and undici invariants =='
jq -e . "$lockfile" >/dev/null
jq -r '
[
(.packages["node_modules/undici"] // {}),
(.dependencies.undici // {})
]
| to_entries[]
| select(.value != {})
| "\(.key): version=\(.value.version // "MISSING") resolved=\(.value.resolved // "MISSING") integrity=\(.value.integrity // "MISSING")"
' "$lockfile"
printf 'undici 7.28.0 occurrences: '
rg -nF '"version": "7.28.0"' "$lockfile" | wc -l
printf 'undici 7.29.0 occurrences: '
rg -nF '"version": "7.29.0"' "$lockfile" | wc -l
echo '== OpenCode workflow run metadata =='
gh api "repos/$repo/actions/runs/$run_id" \
--jq '{id,head_sha,event,status,conclusion,workflow_id,run_attempt,created_at,updated_at,html_url}'
echo '== OpenCode workflow jobs and steps =='
gh api "repos/$repo/actions/runs/$run_id/jobs?per_page=100" \
--jq '.jobs[] | {
name, status, conclusion, started_at, completed_at,
steps: [.steps[] | {name, status, conclusion, number}]
}'
echo '== Unresolved review threads =='
gh api graphql \
-F owner='ContextualWisdomLab' \
-F name='bandscope' \
-F number=751 \
-f query='
query($owner: String!, $name: String!, $number: Int!) {
repository(owner: $owner, name: $name) {
pullRequest(number: $number) {
reviewThreads(first: 100) {
nodes {
isResolved
isOutdated
comments(first: 1) { nodes { author { login } body path line } }
}
}
}
}
}' \
--jq '.data.repository.pullRequest.reviewThreads.nodes
| map(select(.isResolved == false))
| .[]'Length of output: 11849 🏁 Script executed: #!/bin/bash
set -euo pipefail
repo='ContextualWisdomLab/bandscope'
head='fa1dc9436a7cc0fc2aa0982159309e4c2b5502f4'
lockfile='package-lock.json'
central_run='30992866042'
echo '== Lockfile entries at version 7.28.0 =='
jq -r '
.packages
| to_entries[]
| select(.value.version == "7.28.0")
| "\(.key): resolved=\(.value.resolved // "none") integrity=\(.value.integrity // "none")"
' "$lockfile"
echo '== Changed lockfile package paths =='
git diff --unified=0 develop "$head" -- "$lockfile" \
| awk '
/^@@/ { hunk=$0 }
/^[-+][[:space:]]+"(peer|version|resolved|integrity)"/ { print hunk "\n" $0 }
'
echo '== Later central workflow run =='
gh api "repos/$repo/actions/runs/$central_run" \
--jq '{id,head_sha,event,status,conclusion,workflow_id,run_attempt,created_at,updated_at,html_url}' \
2>&1 || true
echo '== Later central workflow jobs =='
gh api "repos/$repo/actions/runs/$central_run/jobs?per_page=100" \
--jq '.jobs[] | {name,status,conclusion,started_at,completed_at,steps:[.steps[] | {name,conclusion}]}' \
2>&1 || true
echo '== Recent OpenCode workflow runs for the requested head =='
gh api "repos/$repo/actions/workflows/302756704/runs?event=pull_request_target&per_page=100" \
--jq --arg head "$head" '
.workflow_runs[]
| select(.head_sha == $head)
| {id,event,status,conclusion,run_attempt,created_at,updated_at,html_url}
'Length of output: 4121
The The exact diff also removes The successful OpenCode branch-protection workflow is not coverage evidence. Its The existing exact-head OpenCode You are interacting with an AI system. |
|
@opencode-agent @cwl-noema-review Please independently re-review exact current head |
1 participant
Bumps the npm_and_yarn group with 1 update in the / directory: undici.
Updates
undicifrom 7.28.0 to 7.29.0Release notes
Sourced from undici's releases.
Commits
9e38fc1Bumped v7.29.0 (#5590)d887e34fix: validate coerced header values for CRLF (#5579)33928bcfix: validate blob body content type98011a8fix(cache): harden cache directive parsing4a9dafbtest(retry): correct broken content-range fixtures in retry-handler.js1b5a531fix(retry): reject partial content length mismatch466e99dtest: cover crash on mixed unqualified and qualified private cache directives9f10f1efix: handle empty qualified private cache directive3bf91ddfix: harden cookie domain, path, and unparsed attribute validationDependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting
@dependabot rebase.Dependabot commands and options
You can trigger Dependabot actions by commenting on this PR:
@dependabot rebasewill rebase this PR@dependabot recreatewill recreate this PR, overwriting any edits that have been made to it@dependabot show <dependency name> ignore conditionswill show all of the ignore conditions of the specified dependency@dependabot ignore <dependency name> major versionwill close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)@dependabot ignore <dependency name> minor versionwill close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)@dependabot ignore <dependency name>will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)@dependabot unignore <dependency name>will remove all of the ignore conditions of the specified dependency@dependabot unignore <dependency name> <ignore condition>will remove the ignore condition of the specified dependency and ignore conditionsYou can disable automated security fix PRs for this repo from the Security Alerts page.