Skip to content

chore(deps): bump the patch-minor group with 2 updates - #64

Merged
edbfi merged 1 commit into
mainfrom
dependabot/github_actions/patch-minor-7235f15be6
Oct 21, 2026
Merged

edbfi merged 1 commit into
mainfrom
dependabot/github_actions/patch-minor-7235f15be6

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Oct 21, 2026

Copy link
Copy Markdown
Contributor

Bumps the patch-minor group with 2 updates: j178/prek-action and pullfrog/pullfrog.

Updates j178/prek-action from 3.0.1 to 3.1.0

Release notes

Sourced from j178/prek-action's releases.

v3.1.0

What's Changed

Full Changelog: j178/prek-action@v3.0.2...v3.1.0

v3.0.2

What's Changed

New Contributors

Full Changelog: j178/prek-action@v3.0.1...v3.0.2

Commits

Updates pullfrog/pullfrog from 0.1.98 to 0.1.101

Release notes

Sourced from pullfrog/pullfrog's releases.

v0.1.101

  • The free trial covers up to $10 of model usage per account, on GPT-6 Luna instead of DeepSeek Flash. Each trial-funded run's comment shows how much is left, and a plain message says when it has run out.
  • Every failure comment is rewritten. Each one has a sentence-case headline naming the cause, the provider's own output collapsed underneath, and at most two links to fix it. A bare "Run failed." no longer appears.
  • The gh tool can read a PR's check runs (checks: read); it still can't create them.

v0.1.100

  • Gemini Pro now runs Gemini 4 Argon. google/gemini-pro, opencode/gemini-pro and vercel/gemini-pro resolve to gemini-4-argon, Google's new flagship reasoning model, in place of Gemini 3.1 Pro Preview. The Vercel route gains the medium effort level. openrouter/gemini-pro keeps following OpenRouter's Gemini Pro pointer.
  • Kimi Code effort ladders match the published catalog. kimi-for-coding/kimi-k3, kimi-k3-256k and kimi-k2 list none as Kimi now publishes it; no run's effort changes.

v0.1.99

What's changed

Reviews

  • Re-approval after a dismissed approval. When a push dismisses Pullfrog's approval (for example under "Dismiss stale pull request approvals when new commits are pushed") and no Pullfrog finding is open, the re-review approves again instead of skipping, even when the new commits need no review, such as a base-branch merge that resolved a conflict.

CLI

  • pullfrog auth reports what each sign-in did, shows the health of every stored connection, and signs in to Codex and Claude through the browser.

Security

  • Sandbox hardening. Restricted mode drains every /proc layer and runs restricted commands, gh and lifecycle hooks under no_new_privs, so sudo cannot regain root inside the sandbox. The agent's hook scripts are now immutable.
  • Run API token. It is issued only with the runner's OIDC proof, and a run without one is not offered the tools that need it.
  • Vercel bypass secret. VERCEL_AUTOMATION_BYPASS_SECRET is sent only to Pullfrog's own preview deployments, never to another host.

Models

  • Zen's retired free models (Muse Spark Contributor, Step 5 Preview, Exo, Space Bunny) fall back to opencode/big-pickle, so runs configured with them keep working.
  • opencode-go/minimax-m2.5 falls back to opencode-go/minimax-m3.
  • Effort ladders follow the providers' published catalogs: vercel/mistral-large offers none/high, and xai/grok-4.3 adds xhigh on the direct xAI route.
Commits
  • ae4145b release: bump action to 0.1.101
  • 795228a Cap the funded trial at $10 of credits on GPT-6 Luna, and rewrite every failu...
  • a68236b Re-review when Pullfrog's own push dismisses its approval; let the gh token r...
  • 9a8e9d4 release: bump action to 0.1.100
  • 2e7d84e models: gemini-pro moves to Gemini 4 Argon (#1543)
  • b0204bc models: kimi-for-coding ladders publish none, matching models.dev; no run's e...
  • 396673e test: the Vertex opencode smoke pins gemini-3.8-flash; Google retires gemini-...
  • 8bfc7ee release: bump action to 0.1.99
  • 5909963 models: xai/grok-4.3 offers xhigh on the direct route, matching models.dev; O...
  • 1748a24 release: the approval summary tells the maintainer to run stager, not stager ...
  • Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.


Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
  • @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
  • @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
  • @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
  • @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
  • @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

Bumps the patch-minor group with 2 updates: [j178/prek-action](https://github.com/j178/prek-action) and [pullfrog/pullfrog](https://github.com/pullfrog/pullfrog).


Updates `j178/prek-action` from 3.0.1 to 3.1.0
- [Release notes](https://github.com/j178/prek-action/releases)
- [Commits](j178/prek-action@1382ad7...44924fe)

Updates `pullfrog/pullfrog` from 0.1.98 to 0.1.101
- [Release notes](https://github.com/pullfrog/pullfrog/releases)
- [Commits](pullfrog/pullfrog@ad4283a...ae4145b)

---
updated-dependencies:
- dependency-name: j178/prek-action
  dependency-version: 3.1.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: patch-minor
- dependency-name: pullfrog/pullfrog
  dependency-version: 0.1.101
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: patch-minor
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot Bot added dependencies Pull requests that update a dependency file github_actions Pull requests that update GitHub Actions code labels Oct 21, 2026
@edbfi
edbfi enabled auto-merge (squash) October 21, 2026 14:39

@pullfrog pullfrog Bot left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

✅ No new issues found.

Reviewed changes

Reviewed the full diff of this Dependabot patch/minor bump of two GitHub Actions.

  • j178/prek-action 3.0.1 → 3.1.0 (.github/workflows/ci.yml): adds an optional sha256 input and latest-known prek version support. The existing extra-args usage is unaffected.
  • pullfrog/pullfrog 0.1.98 → 0.1.101 (.github/workflows/pullfrog.yml): the release notes cover trial credit changes, rewritten failure comments, sandbox hardening and model mapping updates. None change the workflow's prompt or model inputs.

Both actions stay pinned to full commit SHAs with matching version comments. The new SHAs correspond to the commits shown in the Dependabot compare views.

Pullfrog  | View workflow run | Using claude-sonnet-5-5 | 𝕏

@edbfi
edbfi merged commit 69be385 into main Oct 21, 2026
6 checks passed
@edbfi
edbfi deleted the dependabot/github_actions/patch-minor-7235f15be6 branch October 21, 2026 14:50
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

dependencies Pull requests that update a dependency file github_actions Pull requests that update GitHub Actions code

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant