chore(deps-dev): bump eslint from 10.0.3 to 10.1.0 - #68
Merged
petry-projects-dependabot-automrg[bot] merged 1 commit intoMar 23, 2026
Merged
Conversation
Bumps [eslint](https://github.com/eslint/eslint) from 10.0.3 to 10.1.0. - [Release notes](https://github.com/eslint/eslint/releases) - [Commits](eslint/eslint@v10.0.3...v10.1.0) --- updated-dependencies: - dependency-name: eslint dependency-version: 10.1.0 dependency-type: direct:development update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] <support@github.com>
dependabot
Bot
added
dependencies
![petry-projects-dependabot-automrg[bot]](https://avatars.githubusercontent.com/u/258516906?s=60&v=4){kind=small}
petry-projects-dependabot-automrg
Bot
deleted the
dependabot/npm_and_yarn/eslint-10.1.0
branch
March 23, 2026 19:25
don-petry
pushed a commit
that referenced
this pull request
Mar 23, 2026
The ruleset bypass list grants the app admin-level merge permissions, but --auto still respects ruleset rules. Use --admin to bypass the ruleset directly, matching how the app's bypass_mode is configured. Tested: PRs #68 and #69 merged successfully via app token + --admin. Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
petry-projects-dependabot-automrg Bot
pushed a commit
that referenced
this pull request
Mar 23, 2026
* fix(ci): use admin PAT for Dependabot auto-merge to bypass ruleset The GITHUB_TOKEN runs as github-actions[bot] (integration 15368) which is not in the repository ruleset bypass list. Auto-merge silently stalls because the merge actor cannot bypass the protect-branches ruleset. Switch to GH_ADMIN_PAT so merges execute as a repo admin with bypass permissions, and add a PR approval step. Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com> * fix(ci): use GitHub App for Dependabot auto-merge to bypass ruleset The GITHUB_TOKEN runs as github-actions[bot] (integration 15368) which is not in the repository ruleset bypass list. Auto-merge silently stalls because the merge actor cannot bypass the protect-branches ruleset. Create a dedicated GitHub App with contents:write and pull_requests:write permissions. The workflow generates short-lived tokens via actions/create-github-app-token, and the app is added to the ruleset bypass list so auto-merge can execute. Includes setup script: scripts/setup-dependabot-app.sh Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com> * fix(ci): replace manifest-flow script with per-repo setup script The GitHub App manifest flow had HTML encoding issues, so the app was created manually. Replace the setup script with a practical per-repo version that stores secrets and updates the ruleset bypass list for any repo in the org where the app is already installed. Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com> * fix(ci): use --admin merge instead of --auto for ruleset bypass The ruleset bypass list grants the app admin-level merge permissions, but --auto still respects ruleset rules. Use --admin to bypass the ruleset directly, matching how the app's bypass_mode is configured. Tested: PRs #68 and #69 merged successfully via app token + --admin. Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com> * fix(ci): use pull_request_target for Dependabot secret access Dependabot-triggered pull_request events do not have access to repository secrets. Switch to pull_request_target which runs in the context of the base branch and can access APP_ID and APP_PRIVATE_KEY. This is safe because the workflow only targets dependabot[bot] PRs and does not checkout any PR code. Addresses Copilot review comment on PR #71. Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com> --------- Co-authored-by: Don Petry <don.petry@gmail.com> Co-authored-by: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
don-petry
added a commit
that referenced
this pull request
Mar 28, 2026
* fix(ci): use admin PAT for Dependabot auto-merge to bypass ruleset The GITHUB_TOKEN runs as github-actions[bot] (integration 15368) which is not in the repository ruleset bypass list. Auto-merge silently stalls because the merge actor cannot bypass the protect-branches ruleset. Switch to GH_ADMIN_PAT so merges execute as a repo admin with bypass permissions, and add a PR approval step. Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com> * fix(ci): use GitHub App for Dependabot auto-merge to bypass ruleset The GITHUB_TOKEN runs as github-actions[bot] (integration 15368) which is not in the repository ruleset bypass list. Auto-merge silently stalls because the merge actor cannot bypass the protect-branches ruleset. Create a dedicated GitHub App with contents:write and pull_requests:write permissions. The workflow generates short-lived tokens via actions/create-github-app-token, and the app is added to the ruleset bypass list so auto-merge can execute. Includes setup script: scripts/setup-dependabot-app.sh Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com> * fix(ci): replace manifest-flow script with per-repo setup script The GitHub App manifest flow had HTML encoding issues, so the app was created manually. Replace the setup script with a practical per-repo version that stores secrets and updates the ruleset bypass list for any repo in the org where the app is already installed. Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com> * fix(ci): use --admin merge instead of --auto for ruleset bypass The ruleset bypass list grants the app admin-level merge permissions, but --auto still respects ruleset rules. Use --admin to bypass the ruleset directly, matching how the app's bypass_mode is configured. Tested: PRs #68 and #69 merged successfully via app token + --admin. Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com> * fix(ci): use pull_request_target for Dependabot secret access Dependabot-triggered pull_request events do not have access to repository secrets. Switch to pull_request_target which runs in the context of the base branch and can access APP_ID and APP_PRIVATE_KEY. This is safe because the workflow only targets dependabot[bot] PRs and does not checkout any PR code. Addresses Copilot review comment on PR #71. Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com> * feat(deploy): create Gmail labels from Step 3 Config UI Allow users to create new Gmail labels directly from the configuration form instead of switching to Gmail. Adds "+ New Label" button next to both trigger and processed label dropdowns with inline input, API creation via gmail.labels scope, automatic list refresh, and auto-selection of the newly created label. Closes #78 * chore(ci): apply prettier/eslint auto-fixes * fix(deploy): surface sign-in error and remove redundant catch-rethrow Address PR review feedback: throw a user-friendly error when accessToken is missing instead of silently returning null, and remove the no-op catch-rethrow wrapper. * chore(ci): apply prettier/eslint auto-fixes * fix(deploy): address PR review comments - Fix JSDoc to match actual throw behavior (no longer returns null) - Throw on missing labelName instead of returning null silently - Escape IDs via escapeHtml() in inline onclick handlers for defense in depth - Expose showNewLabelInput, hideNewLabelInput, handleCreateLabel on window for consistency with browseForFile and confirmSetupDone - Consolidate createGmailLabel import to top of test file * fix(deploy): show New Label button in text-input fallback mode The + New Label button was only shown when Gmail labels were loaded (select dropdown mode). Now it also appears in the text-input fallback that renders when labels haven't loaded yet or when the user has no existing labels. Also handles auto-filling text inputs after creation. * chore(ci): apply prettier/eslint auto-fixes * feat(deploy): replace inline label buttons with New Label modal Redesign the label creation UX per user feedback: - Single "New Label" button at the top of the Gmail to Drive config section - Modal popup that creates both the trigger label and its -archived counterpart in one action - Live preview showing both labels as user types - Auto-selects both labels in the config dropdowns after creation - Supports Enter key, Escape to close, and overlay click to dismiss * chore(ci): apply prettier/eslint auto-fixes * fix(deploy): address CodeRabbit review — modal close helper, idempotent label creation - Remove escapeHtml from thrown error messages (rendered via textContent) - Add shared closeModal helper with isCreating guard to prevent closing during label creation and fix leaked keydown listener - Make two-label creation idempotent: treat 409/duplicate as success, add labels to userGmailLabels on each step, so retries after partial failure work correctly - Surface isDuplicate and status on error objects for caller detection Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com> --------- Co-authored-by: Don Petry <don.petry@gmail.com> Co-authored-by: Claude Opus 4.6 (1M context) <noreply@anthropic.com> Co-authored-by: github-actions[bot] <github-actions[bot]@users.noreply.github.com> Co-authored-by: DJ <dj@Rachels-Air.localdomain>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Bumps eslint from 10.0.3 to 10.1.0.
Release notes
Sourced from eslint's releases.
Commits
8351ec710.1.03270bc1Build: changelog update for 10.1.0a9f9ccechore: update dependency eslint-plugin-unicorn to ^63.0.0 (#20584)1f42bd7chore: updateprettierto 3.8.1 (#20651)c0a6f4achore: update dependency@eslint/jsonto ^1.2.0 (#20652)cc43f79chore: update dependency c8 to v11 (#20650)2ce4635chore: update dependency@eslint/jsonto v1 (#20649)f0406eechore: update dependency markdownlint-cli2 to ^0.21.0 (#20646)dbb4c95chore: remove trunk (#20478)ff4382bfeat: apply fix forno-varinTSModuleBlock(#20638)Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting
@dependabot rebase.Dependabot commands and options
You can trigger Dependabot actions by commenting on this PR:
@dependabot rebasewill rebase this PR@dependabot recreatewill recreate this PR, overwriting any edits that have been made to it@dependabot show <dependency name> ignore conditionswill show all of the ignore conditions of the specified dependency@dependabot ignore this major versionwill close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)@dependabot ignore this minor versionwill close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)@dependabot ignore this dependencywill close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)