Skip to content

chore(ci): bump the all-actions group across 1 directory with 9 updates - #1391

Open
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/github_actions/main/all-actions-336e1aad07
Open

dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/github_actions/main/all-actions-336e1aad07

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Aug 30, 2026

Copy link
Copy Markdown
Contributor

Bumps the all-actions group with 9 updates in the / directory:

Package From To
actions/checkout 7.0.0 7.0.1
pnpm/action-setup 6.0.9 6.1.0
actions/setup-node 6.0.0 7.0.0
actions/upload-artifact 4.6.2 7.0.1
fallow-rs/fallow 3.17.0 3.25.0
actions/github-script 7.0.1 9.0.0
actions/labeler 6.2.0 7.0.0
anthropics/claude-code-action 1.0.185 1.0.222
changesets/action 1.9.0 2.1.2

Updates actions/checkout from 7.0.0 to 7.0.1

Release notes

Sourced from actions/checkout's releases.

v7.0.1

What's Changed

Full Changelog: actions/checkout@v7...v7.0.1

Changelog

Sourced from actions/checkout's changelog.

Changelog

v7.0.1

v7.0.0

v6.0.3

v6.0.2

v6.0.1

v6.0.0

v5.0.1

v5.0.0

v4.3.1

v4.3.0

v4.2.2

v4.2.1

... (truncated)

Commits

Updates pnpm/action-setup from 6.0.9 to 6.1.0

Release notes

Sourced from pnpm/action-setup's releases.

v6.1.0

What's Changed

Full Changelog: pnpm/action-setup@v6.0.10...v6.1.0

v6.0.10

What's Changed

New Contributors

Full Changelog: pnpm/action-setup@v6...v6.0.10

Commits

Updates actions/setup-node from 6.0.0 to 7.0.0

Release notes

Sourced from actions/setup-node's releases.

v7.0.0

What's Changed

Enhancements:

Bug fixes:

Documentation updates:

Dependency update:

New Contributors

Full Changelog: actions/setup-node@v6...v7.0.0

v6.5.0

What's Changed

Full Changelog: actions/setup-node@v6.4.0...v6.5.0

v6.4.0

What's Changed

Dependency updates:

New Contributors

Full Changelog: actions/setup-node@v6...v6.4.0

v6.3.0

What's Changed

Enhancements:

... (truncated)

Commits
  • 8207627 Migrate to ESM and upgrade dependencies (#1574)
  • 04be95c Add cache-primary-key and cache-matched-key as outputs (#1577)
  • 7c2c68d docs: Update caching recommendations to mitigate cache poisoning risks (#1567)
  • 6a61c03 Merge pull request #1569 from jasongin/update-actions-cache-5.1.0
  • 30eb73b Resolve high-severity audit issues
  • 4e1a87a Update dist
  • 360237f Strict equality
  • 4f8aac5 Bump @​actions/cache to 5.1.0, log cache write denied
  • f4a67bb Only use mirrorToken in getManifest if it's provided (#1548)
  • 0355742 Remove dummy NODE_AUTH_TOKEN export (#1558)
  • Additional commits viewable in compare view

Updates actions/upload-artifact from 4.6.2 to 7.0.1

Release notes

Sourced from actions/upload-artifact's releases.

v7.0.1

What's Changed

Full Changelog: actions/upload-artifact@v7...v7.0.1

v7.0.0

v7 What's new

Direct Uploads

Adds support for uploading single files directly (unzipped). Callers can set the new archive parameter to false to skip zipping the file during upload. Right now, we only support single files. The action will fail if the glob passed resolves to multiple files. The name parameter is also ignored with this setting. Instead, the name of the artifact will be the name of the uploaded file.

ESM

To support new versions of the @actions/* packages, we've upgraded the package to ESM.

What's Changed

New Contributors

Full Changelog: actions/upload-artifact@v6...v7.0.0

v6.0.0

v6 - What's new

[!IMPORTANT] actions/upload-artifact@v6 now runs on Node.js 24 (runs.using: node24) and requires a minimum Actions Runner version of 2.327.1. If you are using self-hosted runners, ensure they are updated before upgrading.

Node.js 24

This release updates the runtime to Node.js 24. v5 had preliminary support for Node.js 24, however this action was by default still running on Node.js 20. Now this action by default will run on Node.js 24.

What's Changed

Full Changelog: actions/upload-artifact@v5.0.0...v6.0.0

v5.0.0

What's Changed

... (truncated)

Commits
  • 043fb46 Merge pull request #797 from actions/yacaovsnc/update-dependency
  • 634250c Include changes in typespec/ts-http-runtime 0.3.5
  • e454baa Readme: bump all the example versions to v7 (#796)
  • 74fad66 Update the readme with direct upload details (#795)
  • bbbca2d Support direct file uploads (#764)
  • 589182c Upgrade the module to ESM and bump dependencies (#762)
  • 47309c9 Merge pull request #754 from actions/Link-/add-proxy-integration-tests
  • 02a8460 Add proxy integration test
  • b7c566a Merge pull request #745 from actions/upload-artifact-v6-release
  • e516bc8 docs: correct description of Node.js 24 support in README
  • Additional commits viewable in compare view

Updates fallow-rs/fallow from 3.17.0 to 3.25.0

Release notes

Sourced from fallow-rs/fallow's releases.

v3.25.0: positional path scope, runtime coverage joins callbacks and object members

Scope any file command to a path

Bare fallow, check, dupes, health, audit, security, fix, list and similar-code now take an optional positional path:

npx fallow src/components
npx fallow health src/api/client.ts
npx fallow fix src/legacy

The whole-project graph is still built, so every cross-file fact stays sound. Only the reported findings narrow, and fix plans and applies only the fixes that touch scoped files.

Resolution is root-first for a bare relative path, ./ and ../ are honoured as current-directory claims, and a missing or outside-root path is rejected with an actionable exit-2 error rather than silently analysing the whole project. The scope composes with --workspace as one more workspace root and intersects with --changed-since and --diff-file. audit narrows its changed-file universe so verdict and base attribution stay coherent, while its base pass stays unscoped because it runs in another worktree.

Runtime coverage joins far more of your code

fallow coverage analyze --cloud joins cloud runtime rows against a static index that was built from the health and complexity pass, which enumerates declarations and bindings only. Everything else the runtime instrumenter names, an arrow passed to a call and named after its callee (rows.map(...), sqliteTable("t", {}, (table) => [...]), .references(() => ...)), an object-literal method, a getter or setter, and a function assigned to a member, had nothing to join against. Those rows landed in cloud_functions_unmatched instead of reaching findings and hot_paths, and in a typical service those are exactly the highest-traffic functions, so the hot-path list was led by whichever declaration happened to be enumerated.

The index now carries every function the instrumenter would name, resolved through the same walker the static inventory upload uses, so the identity matches the stable_id the cloud stores. A function known only by the callee it was passed to is flagged as a callback and its verdict copy names the call site ("Callback passed to map; ...") instead of pointing at a declaration that does not exist.

The static function inventory was fixed on the same terms: an object-literal method, a function-valued property, a getter or setter, a function assigned to a member expression, and an anonymous export default were left at their (anonymous_N) placeholder while the instrumenter names them run, execute, get closed, rollback and default. Both sides now agree, so an uploaded inventory entry and the runtime row for the same function share one identity.

... (truncated)

Commits
  • 30167b4 chore: release v3.25.0
  • 03aad8c fix(cli): print forward slashes in the check and health human output
  • 423ce06 fix(coverage): index instrumenter-named callbacks and object members for the ...
  • b7722af feat(coverage): report the caller-edge size guard in the inventory blob
  • 69d8d81 feat: support positional PATH scope across file commands
  • 4b8d691 chore: advance the schema policy baseline to v3.24.1
  • 594fccb chore(docker): pin FALLOW_VERSION 3.24.1 with refreshed checksums
  • 59ce79f chore(napi): sync package.json / package-lock / index.js to v3.24.1
  • c2da9fc chore: release v3.24.1
  • 3628395 ci: stop a third-party apt source failing the cross-compile jobs
  • Additional commits viewable in compare view

Updates actions/github-script from 7.0.1 to 9.0.0

Release notes

Sourced from actions/github-script's releases.

v9.0.0

New features:

  • getOctokit factory function — Available directly in the script context. Create additional authenticated Octokit clients with different tokens for multi-token workflows, GitHub App tokens, and cross-org access. See Creating additional clients with getOctokit for details and examples.
  • Orchestration ID in user-agent — The ACTIONS_ORCHESTRATION_ID environment variable is automatically appended to the user-agent string for request tracing.

Breaking changes:

  • require('@actions/github') no longer works in scripts. The upgrade to @actions/github v9 (ESM-only) means require('@actions/github') will fail at runtime. If you previously used patterns like const { getOctokit } = require('@actions/github') to create secondary clients, use the new injected getOctokit function instead — it's available directly in the script context with no imports needed.
  • getOctokit is now an injected function parameter. Scripts that declare const getOctokit = ... or let getOctokit = ... will get a SyntaxError because JavaScript does not allow const/let redeclaration of function parameters. Use the injected getOctokit directly, or use var getOctokit = ... if you need to redeclare it.
  • If your script accesses other @actions/github internals beyond the standard github/octokit client, you may need to update those references for v9 compatibility.

What's Changed

New Contributors

Full Changelog: actions/github-script@v8.0.0...v9.0.0

v8.0.0

What's Changed

⚠️ Minimum Compatible Runner Version

v2.327.1
Release Notes

Make sure your runner is updated to this version or newer to use this release.

New Contributors

Full Changelog: actions/github-script@v7.1.0...v8.0.0

v7.1.0

What's Changed

... (truncated)

Commits
  • 3a2844b Merge pull request #700 from actions/salmanmkc/expose-getoctokit + prepare re...
  • ca10bbd fix: use @​octokit/core/types import for v7 compatibility
  • 86e48e2 merge: incorporate main branch changes
  • c108472 chore: rebuild dist for v9 upgrade and getOctokit factory
  • afff112 Merge pull request #712 from actions/salmanmkc/deployment-false + fix user-ag...
  • ff8117e ci: fix user-agent test to handle orchestration ID
  • 81c6b78 ci: use deployment: false to suppress deployment noise from integration tests
  • 3953caf docs: update README examples from @​v8 to @​v9, add getOctokit docs and v9 brea...
  • c17d55b ci: add getOctokit integration test job
  • a047196 test: add getOctokit integration tests via callAsyncFunction
  • Additional commits viewable in compare view

Updates actions/labeler from 6.2.0 to 7.0.0

Release notes

Sourced from actions/labeler's releases.

v7.0.0

What's Changed

Enhancements:

Full Changelog: actions/labeler@v6...v7.0.0

Commits

Updates anthropics/claude-code-action from 1.0.185 to 1.0.222

Release notes

Sourced from anthropics/claude-code-action's releases.

v1.0.222

Full Changelog: anthropics/claude-code-action@v1.0.221...v1.0.222

v1.0.221

Full Changelog: anthropics/claude-code-action@v1.0.220...v1.0.221

v1.0.220

Full Changelog: anthropics/claude-code-action@v1.0.219...v1.0.220

v1.0.219

Full Changelog: anthropics/claude-code-action@v1.0.218...v1.0.219

v1.0.218

Full Changelog: anthropics/claude-code-action@v1.0.217...v1.0.218

v1.0.217

Full Changelog: anthropics/claude-code-action@v1.0.216...v1.0.217

v1.0.216

Full Changelog: anthropics/claude-code-action@v1.0.215...v1.0.216

v1.0.215

Full Changelog: anthropics/claude-code-action@v1.0.214...v1.0.215

v1.0.214

Full Changelog: anthropics/claude-code-action@v1.0.213...v1.0.214

v1.0.213

Full Changelog: anthropics/claude-code-action@v1.0.212...v1.0.213

v1.0.212

Full Changelog: anthropics/claude-code-action@v1.0.211...v1.0.212

v1.0.211

Full Changelog: anthropics/claude-code-action@v1.0.210...v1.0.211

v1.0.210

Full Changelog: anthropics/claude-code-action@v1.0.209...v1.0.210

v1.0.209

Full Changelog: anthropics/claude-code-action@v1.0.208...v1.0.209

v1.0.208

Full Changelog: anthropics/claude-code-action@v1.0.207...v1.0.208

v1.0.207

Full Changelog: anthropics/claude-code-action@v1.0.206...v1.0.207

v1.0.206

What's Changed

... (truncated)

Commits
  • 56cf60f chore: bump Claude Code to 2.1.269 and Agent SDK to 0.3.269
  • 0a8d3c9 chore: bump Claude Code to 2.1.268 and Agent SDK to 0.3.268
  • 19dda84 chore: bump Claude Code to 2.1.267 and Agent SDK to 0.3.267
  • 5ccc3a3 chore: bump Claude Code to 2.1.266 and Agent SDK to 0.3.266
  • 0d0e087 chore: bump Claude Code to 2.1.265 and Agent SDK to 0.3.265
  • 9c5ddab chore: bump Claude Code to 2.1.263 and Agent SDK to 0.3.263
  • d75b94d chore: bump Claude Code to 2.1.261 and Agent SDK to 0.3.261
  • ef8bb1e chore: bump Claude Code to 2.1.260 and Agent SDK to 0.3.260
  • fa2b266 chore: bump Claude Code to 2.1.259 and Agent SDK to 0.3.259
  • 8251c10 chore: bump Claude Code to 2.1.258 and Agent SDK to 0.3.258
  • Additional commits viewable in compare view

Updates changesets/action from 1.9.0 to 2.1.2

Release notes

Sourced from changesets/action's releases.

v2.1.2

Patch Changes

v2.1.1

Patch Changes

v2.1.0

Minor Changes

  • #718 3b7c71c Thanks @​bluwy! - Add a cwd input to the root action, /select-mode, /version, /pack, and /publish sub-actions to set the current working directory to execute Changesets in. This input existed in v1 but was incorrectly removed.

Patch Changes

v2.0.0

Major Changes

  • #692 cb3f011 Thanks @​Andarist! - Release commits and tags are now pushed using the GitHub API by default.

    Replace the commit-mode input with the boolean push-with-git-cli input. Set push-with-git-cli: true to continue using the Git CLI.

    Regardless of the push mode, custom GitHub tokens must be passed explicitly through the github-token input. The GITHUB_TOKEN environment variable and credentials configured by actions/checkout or embedded in remote URLs are not substitutes for this input. When the Git CLI is enabled, github-token takes precedence over those repository credentials.

  • #680 ca57073 Thanks @​bluwy! - Add a new push-git-tags option that complements create-github-releases to control specifically if git tags should be created but not GitHub releases.

    If create-github-releases was previously set to false, which also indirectly disabled git tag creation, git tags will now be created instead by default. If this is not desired, set push-git-tags to false explicitly.

  • #657 4f718b5 Thanks @​Andarist! - Removed compatibility support for old Changesets v1.

  • #681 7359107 Thanks @​bluwy! - Rename the root action inputs and outputs to better match the sub-actions' conventions.

    Inputs:

    • version -> version-script
    • publish -> publish-script
    • commit -> commit-message
    • title -> pr-title
    • branch -> pr-base-branch

... (truncated)

Changelog

Sourced from changesets/action's changelog.

@​changesets/action

2.1.2

Patch Changes

2.1.1

Patch Changes

2.1.0

Minor Changes

  • #718 3b7c71c Thanks @​bluwy! - Add a cwd input to the root action, /select-mode, /version, /pack, and /publish sub-actions to set the current working directory to execute Changesets in. This input existed in v1 but was incorrectly removed.

Patch Changes

2.0.0

Major Changes

  • #692 cb3f011 Thanks @​Andarist! - Release commits and tags are now pushed using the GitHub API by default.

    Replace the commit-mode input with the boolean push-with-git-cli input. Set push-with-git-cli: true to continue using the Git CLI.

    Regardless of the push mode, custom GitHub tokens must be passed explicitly through the github-token input. The GITHUB_TOKEN environment variable and credentials configured by actions/checkout or embedded in remote URLs are not substitutes for this input. When the Git CLI is enabled, github-token takes precedence over those repository credentials.

  • #680 ca57073 Thanks @​bluwy! - Add a new push-git-tags option that complements create-github-releases to control specifically if git tags should be created but not GitHub releases.

    If create-github-releases was previously set to false, which also indirectly disabled git tag creation, git tags will now be created instead by default. If this is not desired, set push-git-tags to false explicitly.

  • #657 4f718b5 Thanks @​Andarist! - Removed compatibility support for old Changesets v1.

  • #681 7359107 Thanks @​bluwy! - Rename the root action inputs and outputs to better match the sub-actions' conventions.

    Inputs:

... (truncated)

Commits
  • ae32849 v2.1.2
  • 0138f45 Version Packages (#726)
  • 8833883 Handle error when pushing git tags with the git CLI (#735)
  • e08fde7 Improve log messages (#730)
  • 371fd77 Bump human-id in the production-dependencies group across 1 directory (#732)
  • 85efcaf Bump actions/checkout in the github-actions group across 1 directory (#734)
  • 5bb9d5c Bump the development-dependencies group across 1 directory with 7 updates (#733)
  • ca85897 Always prepare branch for version (#729)
  • 36f529f Fix root action double error logs (#724)
  • d7669c8 Version Packages (

@dependabot dependabot Bot added the dependencies Dependency updates (label applied by Dependabot) label Aug 30, 2026
@dependabot @github

dependabot Bot commented on behalf of github Aug 30, 2026

Copy link
Copy Markdown
Contributor Author

Labels

The following labels could not be found: github-actions. Please create it before Dependabot can add it to a pull request.

Please fix the above issues or remove invalid values from dependabot.yml.

@chatgpt-codex-connector chatgpt-codex-connector Bot left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 129fa9097f

ℹ️ About Codex in GitHub

Codex has been enabled to automatically review pull requests in this repo. Reviews are triggered when you

  • Open a pull request for review
  • Mark a draft as ready
  • Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

When you sign up for Codex through ChatGPT, Codex can also answer questions or update the PR, like "@codex address that feedback".

Comment thread .github/workflows/release.yml Outdated
- name: Create Release PR or Publish
id: changesets
uses: changesets/action@a45c4d594aa4e2c509dc14a9f2b3b67ba3780d0d # v1.9.0
uses: changesets/action@8488615a623b1b9c987934bb89eae8af6a946ac1 # v2.1.1

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

P1 Badge Migrate the release step to the v2 input contract

When the Release workflow next handles changesets, v2.1.1 will not consume the v1 keys left below (publish, version, commit, title, and createGithubReleases) or the custom token supplied only through env. The v2 release notes rename these inputs to publish-script, version-script, commit-message, pr-title, and create-github-releases, and require custom tokens through github-token; as written, pnpm release:publish—the repository's preflight/build/publish chain—is no longer invoked, while a Version PR falls back to the default workflow token and therefore cannot trigger its CI runs. Migrate the complete configuration when adopting v2.

AGENTS.md reference: AGENTS.md:L320-L321

Useful? React with 👍 / 👎.

@pkg-pr-new

pkg-pr-new Bot commented Aug 30, 2026

Copy link
Copy Markdown

Open in StackBlitz

@nextlyhq/adapter-drizzle

npm i https://pkg.pr.new/@nextlyhq/adapter-drizzle@5d2db2c

@nextlyhq/adapter-mysql

npm i https://pkg.pr.new/@nextlyhq/adapter-mysql@5d2db2c

@nextlyhq/adapter-postgres

npm i https://pkg.pr.new/@nextlyhq/adapter-postgres@5d2db2c

@nextlyhq/adapter-sqlite

npm i https://pkg.pr.new/@nextlyhq/adapter-sqlite@5d2db2c

@nextlyhq/admin

npm i https://pkg.pr.new/@nextlyhq/admin@5d2db2c

@nextlyhq/admin-css

npm i https://pkg.pr.new/@nextlyhq/admin-css@5d2db2c

@nextlyhq/blocks-engine

npm i https://pkg.pr.new/@nextlyhq/blocks-engine@5d2db2c

@nextlyhq/blocks-react

npm i https://pkg.pr.new/@nextlyhq/blocks-react@5d2db2c

@nextlyhq/builder

npm i https://pkg.pr.new/@nextlyhq/builder@5d2db2c

create-nextly-app

npm i https://pkg.pr.new/create-nextly-app@5d2db2c

@nextlyhq/eslint-plugin

npm i https://pkg.pr.new/@nextlyhq/eslint-plugin@5d2db2c

nextly

npm i https://pkg.pr.new/nextly@5d2db2c

@nextlyhq/plugin-form-builder

npm i https://pkg.pr.new/@nextlyhq/plugin-form-builder@5d2db2c

@nextlyhq/plugin-mcp

npm i https://pkg.pr.new/@nextlyhq/plugin-mcp@5d2db2c

@nextlyhq/plugin-page-builder

npm i https://pkg.pr.new/@nextlyhq/plugin-page-builder@5d2db2c

@nextlyhq/plugin-sdk

npm i https://pkg.pr.new/@nextlyhq/plugin-sdk@5d2db2c

@nextlyhq/plugin-seo

npm i https://pkg.pr.new/@nextlyhq/plugin-seo@5d2db2c

@nextlyhq/storage-s3

npm i https://pkg.pr.new/@nextlyhq/storage-s3@5d2db2c

@nextlyhq/storage-uploadthing

npm i https://pkg.pr.new/@nextlyhq/storage-uploadthing@5d2db2c

@nextlyhq/storage-vercel-blob

npm i https://pkg.pr.new/@nextlyhq/storage-vercel-blob@5d2db2c

@nextlyhq/ui

npm i https://pkg.pr.new/@nextlyhq/ui@5d2db2c

commit: 5d2db2c

@github-actions

github-actions Bot commented Aug 30, 2026

Copy link
Copy Markdown
Contributor

Whole-Repository Code Hygiene Summary

Full dead-code, duplication, and complexity report for the PR branch as it stands now. Playground is excluded. Quality gate enforcement on introduced issues is performed by the Changed files job.

🌿 Fallow

Warning

Review needed

⚠️ 73 code issues · ⚠️ 677 clone groups · ⚠️ 1036 health findings

See inline review comments for per-finding details.

Code issues (73)
Category Count
Unused files 2
Unused exports 5
Unused dependencies 19
Unused devDependencies 6
Unresolved imports 2
Unlisted dependencies 1
Circular dependencies 38
Duplication (677 groups · 28396 lines · 3.9%)
Locations Lines Tokens
schemas/_dialect-bundles/mysql.relations.ts:40-134
schemas/_dialect-bundles/postgres.relations.ts:40-134
schemas/_dialect-bundles/sqlite.relations.ts:40-134
95 593
cli/commands/db-sync-demote.ts:70-75
cli/commands/db-sync-promote.ts:38-43
cli/commands/dev-build.ts:100-105
cli/commands/dev-build.ts:179-184
cli/commands/dev-build.ts:299-304
cli/commands/dev-build.ts:411-416
cli/commands/dev-build.ts:552-557
cli/commands/dev-server.ts:575-580
cli/commands/dev-server.ts:840-845
cli/commands/dev-server.ts:1143-1148
cli/commands/migrate-field-groups.ts:110-115
6 70
entries/EntryList/EntryTableSkeleton.tsx:74-98
collection/components/CollectionTableSkeleton.tsx:94-118
field-group/components/FieldGroupTableSkeleton.tsx:90-114
plugins/components/PluginsTableSkeleton.tsx:86-110
singles/components/SinglesTableSkeleton.tsx:77-101
src/components/table-skeleton.tsx:100-124
25 89
collections/config/validate-config.ts:380-433
field-groups/config/validate-field-group.ts:185-238
singles/config/validate-single.ts:190-243
54 152
dispatcher/handlers/collection-dispatcher.ts:925-967
field-groups/services/field-group-table-provisioning.ts:186-236
singles/services/reconcile-single-companion.ts:110-160
51 149

… and 672 more groups.

Across 425 files.

Complexity (1036 functions above threshold)
File Function Severity Cyclomatic Cognitive CRAP Lines
singles/services/single-mutation-service.ts:966 <arrow> critical 246 ! 308 ! 13317.5 ! 1650
collections/services/collection-mutation-service.ts:6366 <arrow> critical 168 ! 155 ! 6264.4 ! 1307
src/init/reload-config.ts:1417 applyReload critical 143 ! 211 ! 4560 ! 1470
shared/lib/entry-validation.ts:245 validateFieldValue critical 109 ! 157 ! 2675.3 ! 432
dynamic-collections/services/dynamic-collection-schema-service.ts:1050 generateAlterTableMigration critical 104 ! 221 ! 2440.3 ! 782

5134 files, 80066 functions analyzed (thresholds: cyclomatic > 20, cognitive > 15, CRAP >= 30)

Codebase health

Metric Value
Maintainability 91.7 / 100
Avg complexity 1.8

Tip

Run fallow fix --dry-run to preview auto-fixes.
Add /** @public */ above exports to preserve them.

@github-actions github-actions Bot removed the dependencies Dependency updates (label applied by Dependabot) label Aug 30, 2026
@dependabot
dependabot Bot force-pushed the dependabot/github_actions/main/all-actions-336e1aad07 branch 3 times, most recently from 48eda5b to 5fbbae0 Compare September 7, 2026 04:17

@chatgpt-codex-connector chatgpt-codex-connector Bot left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 5fbbae00fc

ℹ️ About Codex in GitHub

Codex has been enabled to automatically review pull requests in this repo. Reviews are triggered when you

  • Open a pull request for review
  • Mark a draft as ready
  • Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

When you sign up for Codex through ChatGPT, Codex can also answer questions or update the PR, like "@codex address that feedback".

Comment thread .github/workflows/release.yml Outdated
- name: Create Release PR or Publish
id: changesets
uses: changesets/action@a45c4d594aa4e2c509dc14a9f2b3b67ba3780d0d # v1.9.0
uses: changesets/action@8488615a623b1b9c987934bb89eae8af6a946ac1 # v2.1.1

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

P1 Badge Disable v2 package-tag pushes

When the existing input-renaming fix restores publish-script, v2 will still push Changesets' per-package tags by default even when create-github-releases: false; the v2.0.0 release notes explicitly require push-git-tags: false to preserve the old no-tags behavior. That bypasses this workflow's registry verification at lines 138–140 and creates package tags alongside the deliberately consolidated vX.Y.Z tag at lines 159–224, including during a partial publish that verification would reject, so set push-git-tags: false as part of the v2 migration.

Useful? React with 👍 / 👎.

@dependabot
dependabot Bot force-pushed the dependabot/github_actions/main/all-actions-336e1aad07 branch 4 times, most recently from 6757e49 to 84d4e0a Compare September 10, 2026 23:33
@coderabbitai

coderabbitai Bot commented Sep 10, 2026

Copy link
Copy Markdown

Important

Review skipped

Bot user detected.

To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Advanced

Run ID: 9585e84a-2312-4cdb-818b-4ee9aa0b1ebf

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

  • 🔍 Trigger review

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

Comment @coderabbitai help to get the list of available commands.

@chatgpt-codex-connector chatgpt-codex-connector Bot left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 84d4e0a2e2

ℹ️ About Codex in GitHub

Codex has been enabled to automatically review pull requests in this repo. Reviews are triggered when you

  • Open a pull request for review
  • Mark a draft as ready
  • Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

When you sign up for Codex through ChatGPT, Codex can also answer questions or update the PR, like "@codex address that feedback".

- name: Create Release PR or Publish
id: changesets
uses: changesets/action@a45c4d594aa4e2c509dc14a9f2b3b67ba3780d0d # v1.9.0
uses: changesets/action@ae32849d5ba541f9ae29e40e22a623bc13562f51 # v2.1.2

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

P1 Badge Use the renamed Changesets output

Separately from the stale v1 inputs, the v2.0.0 release notes state that the root-action outputs were renamed, but both finalization guards below still read the camelCase hasChangesets. Once publishing is restored, v2 exposes has-changesets, so these expressions resolve to an empty value and neither release:verify nor the consolidated GitHub Release runs, allowing npm publication to finish without the repository's integrity check, tag, or release; update both references using bracket syntax for the hyphenated output.

AGENTS.md reference: AGENTS.md:L321-L322

Useful? React with 👍 / 👎.

Bumps the all-actions group with 9 updates in the / directory:

| Package | From | To |
| --- | --- | --- |
| [actions/checkout](https://github.com/actions/checkout) | `7.0.0` | `7.0.1` |
| [pnpm/action-setup](https://github.com/pnpm/action-setup) | `6.0.9` | `6.1.0` |
| [actions/setup-node](https://github.com/actions/setup-node) | `6.0.0` | `7.0.0` |
| [actions/upload-artifact](https://github.com/actions/upload-artifact) | `4.6.2` | `7.0.1` |
| [fallow-rs/fallow](https://github.com/fallow-rs/fallow) | `3.17.0` | `3.25.0` |
| [actions/github-script](https://github.com/actions/github-script) | `7.0.1` | `9.0.0` |
| [actions/labeler](https://github.com/actions/labeler) | `6.2.0` | `7.0.0` |
| [anthropics/claude-code-action](https://github.com/anthropics/claude-code-action) | `1.0.185` | `1.0.222` |
| [changesets/action](https://github.com/changesets/action) | `1.9.0` | `2.1.2` |



Updates `actions/checkout` from 7.0.0 to 7.0.1
- [Release notes](https://github.com/actions/checkout/releases)
- [Changelog](https://github.com/actions/checkout/blob/main/CHANGELOG.md)
- [Commits](actions/checkout@9c091bb...3d3c42e)

Updates `pnpm/action-setup` from 6.0.9 to 6.1.0
- [Release notes](https://github.com/pnpm/action-setup/releases)
- [Commits](pnpm/action-setup@0ebf471...ea17c68)

Updates `actions/setup-node` from 6.0.0 to 7.0.0
- [Release notes](https://github.com/actions/setup-node/releases)
- [Commits](actions/setup-node@v6...8207627)

Updates `actions/upload-artifact` from 4.6.2 to 7.0.1
- [Release notes](https://github.com/actions/upload-artifact/releases)
- [Commits](actions/upload-artifact@ea165f8...043fb46)

Updates `fallow-rs/fallow` from 3.17.0 to 3.25.0
- [Release notes](https://github.com/fallow-rs/fallow/releases)
- [Changelog](https://github.com/fallow-rs/fallow/blob/main/release.toml)
- [Commits](fallow-rs/fallow@ecf5a31...30167b4)

Updates `actions/github-script` from 7.0.1 to 9.0.0
- [Release notes](https://github.com/actions/github-script/releases)
- [Commits](actions/github-script@60a0d83...3a2844b)

Updates `actions/labeler` from 6.2.0 to 7.0.0
- [Release notes](https://github.com/actions/labeler/releases)
- [Commits](actions/labeler@b8dd2d9...bf12e9b)

Updates `anthropics/claude-code-action` from 1.0.185 to 1.0.222
- [Release notes](https://github.com/anthropics/claude-code-action/releases)
- [Commits](anthropics/claude-code-action@9db594c...56cf60f)

Updates `changesets/action` from 1.9.0 to 2.1.2
- [Release notes](https://github.com/changesets/action/releases)
- [Changelog](https://github.com/changesets/action/blob/main/CHANGELOG.md)
- [Commits](changesets/action@a45c4d5...ae32849)

---
updated-dependencies:
- dependency-name: actions/checkout
  dependency-version: 7.0.1
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: all-actions
- dependency-name: actions/github-script
  dependency-version: 9.0.0
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: all-actions
- dependency-name: actions/labeler
  dependency-version: 7.0.0
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: all-actions
- dependency-name: actions/setup-node
  dependency-version: 7.0.0
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: all-actions
- dependency-name: actions/upload-artifact
  dependency-version: 7.0.1
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: all-actions
- dependency-name: anthropics/claude-code-action
  dependency-version: 1.0.208
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: all-actions
- dependency-name: changesets/action
  dependency-version: 2.1.1
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: all-actions
- dependency-name: fallow-rs/fallow
  dependency-version: 3.19.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: all-actions
- dependency-name: pnpm/action-setup
  dependency-version: 6.0.10
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: all-actions
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot
dependabot Bot force-pushed the dependabot/github_actions/main/all-actions-336e1aad07 branch from c3181ea to 5d2db2c Compare September 14, 2026 04:19
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

0 participants