Skip to content

Sync dev with master after the #424 promotion - #425

Merged
AminDhouib merged 21 commits into
devfrom
master
Sep 18, 2026
Merged

AminDhouib merged 21 commits into
devfrom
master

Conversation

@AminDhouib

Copy link
Copy Markdown
Member

Folds the master-only commits back into dev so the next feature branch starts from the full history:

PR Change
#414 next 16.3.3 across the four manifests + version-scoped js-yaml@3 override (two critical unauthenticated RCE advisories)
#403 pnpm/action-setup v6.1.0 and actions/upload-artifact v7.0.1 pins across all workflows
#423 timeout-minutes on every workflow job
#387 vitest 4.1.11 across 19 manifests, lockfile regenerated after #414

Plus the #424 merge commit itself. No changesets involved; nothing publishes.

AminDhouib and others added 21 commits September 11, 2026 02:30
Promote dev to master: post-3.3.0 fixes for 3.3.1
…updates

Bumps the github-actions group with 2 updates in the / directory: [pnpm/action-setup](https://github.com/pnpm/action-setup) and [actions/upload-artifact](https://github.com/actions/upload-artifact).


Updates `pnpm/action-setup` from 6.0.10 to 6.1.0
- [Release notes](https://github.com/pnpm/action-setup/releases)
- [Commits](pnpm/action-setup@0977fd9...ea17c68)

Updates `actions/upload-artifact` from 4.6.2 to 7.0.1
- [Release notes](https://github.com/actions/upload-artifact/releases)
- [Commits](actions/upload-artifact@ea165f8...043fb46)

---
updated-dependencies:
- dependency-name: actions/upload-artifact
  dependency-version: '7'
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: github-actions
- dependency-name: pnpm/action-setup
  dependency-version: 6.1.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: github-actions
...

Signed-off-by: dependabot[bot] <support@github.com>
Promote dev to master: Google Drive shared drives
chore: promote dev to master (3.3.2 — shared-drives review fixes)
chore: promote dev to master (3.3.3 — drive decline reporting)
…ed RCE)

Clears GHSA-p293-qw3h-jr36 and GHSA-2xp9-vwfh-vxw4 (critical RCE, next <16.3.3),
GHSA-rgj7-g3m4-5g8c (sharp, transitively via next) and GHSA-2883-xcg3-v3hh
(js-yaml 3.x, via a version-scoped override).

pnpm audit --prod: 31 -> 22 findings, critical 2 -> 0, 9 cleared, 0 new.
timeout-minutes (3 x observed p90 rounded up to a multiple of 5, class default where run history is too thin to fit):
- e2e.yml / Docs-E2E: timeout-minutes: 45 -- no timeout-minutes; class=e2e; class default
- e2e.yml / E2E: timeout-minutes: 45 -- no timeout-minutes; class=e2e; class default
- e2e.yml / E2E-Status: timeout-minutes: 45 -- no timeout-minutes; class=e2e; class default
- e2e.yml / LocalStack-Integration: timeout-minutes: 45 -- no timeout-minutes; class=e2e; class default
- e2e.yml / Resolve-Affected: timeout-minutes: 30 -- no timeout-minutes; class=other; class default
- e2e.yml / Smoke-Packages: timeout-minutes: 30 -- no timeout-minutes; class=build; class default
- e2e.yml / Storybook-Builds: timeout-minutes: 30 -- no timeout-minutes; class=build; class default
- main.yml / Build: timeout-minutes: 30 -- no timeout-minutes; class=build; class default
- main.yml / Bundle-Size: timeout-minutes: 30 -- no timeout-minutes; class=build; class default
- main.yml / Dependency-Audit: timeout-minutes: 30 -- no timeout-minutes; class=other; class default
- main.yml / Docs-Gate: timeout-minutes: 30 -- no timeout-minutes; class=build; class default
- main.yml / Knip: timeout-minutes: 15 -- no timeout-minutes; class=lint; class default
- main.yml / Lint: timeout-minutes: 15 -- no timeout-minutes; class=lint; class default
- main.yml / Oxlint: timeout-minutes: 15 -- no timeout-minutes; class=lint; class default
- main.yml / Prettier-check: timeout-minutes: 15 -- no timeout-minutes; class=lint; class default
- main.yml / Status-Check: timeout-minutes: 15 -- no timeout-minutes; class=typecheck; class default
- main.yml / Test: timeout-minutes: 20 -- no timeout-minutes; class=unit-test; class default
- main.yml / Typecheck: timeout-minutes: 15 -- no timeout-minutes; class=typecheck; class default
- nightly.yml / Drive-Sandbox: timeout-minutes: 45 -- no timeout-minutes; class=e2e; class default
- nightly.yml / E2E-Full: timeout-minutes: 45 -- no timeout-minutes; class=e2e; class default
- nightly.yml / Landing-Feedback: timeout-minutes: 45 -- no timeout-minutes; class=e2e; class default
- nightly.yml / Lighthouse: timeout-minutes: 45 -- no timeout-minutes; class=e2e; class default
- nightly.yml / Mastra-Evals: timeout-minutes: 30 -- no timeout-minutes; class=other; class default
- nightly.yml / Nightly-Status: timeout-minutes: 45 -- no timeout-minutes; class=e2e; class default
- nightly.yml / Smoke-Packages: timeout-minutes: 30 -- no timeout-minutes; class=build; class default
- nightly.yml / Storybook-Builds: timeout-minutes: 30 -- no timeout-minutes; class=build; class default
- publish-sdk.yml / publish: timeout-minutes: 60 -- no timeout-minutes; class=release; class default
- publish.yml / publish: timeout-minutes: 30 -- no timeout-minutes; class=build; class default

Deliberately not included (marked skipped in the plan):
- e2e.yml (path-filter-workflow): required rollup contexts would hang
- main.yml (path-filter-workflow): required rollup contexts would hang
fix(deps): next 16.3.3 — clears 2 critical unauthenticated RCE advisories
Promote dev to master: MinIO quay.io images + SEO/landing batch
Bumps [vitest](https://github.com/vitest-dev/vitest/tree/HEAD/packages/vitest) from 4.1.2 to 4.1.11.
- [Release notes](https://github.com/vitest-dev/vitest/releases)
- [Changelog](https://github.com/vitest-dev/vitest/blob/main/docs/releases.md)
- [Commits](https://github.com/vitest-dev/vitest/commits/v4.1.11/packages/vitest)

---
updated-dependencies:
- dependency-name: vitest
  dependency-version: 4.1.11
  dependency-type: direct:development
...

Signed-off-by: dependabot[bot] <support@github.com>
…s/github-actions-b157e121d7

chore(deps): bump the github-actions group across 1 directory with 2 updates
ci: timeout-minutes for workflow jobs
…vitest-4.1.11

chore(deps-dev): bump vitest from 4.1.2 to 4.1.11
@codesandbox

codesandbox Bot commented Sep 18, 2026

Copy link
Copy Markdown

Review or Edit in CodeSandbox

Open the branch in Web EditorVS CodeInsiders

Open Preview

@AminDhouib
AminDhouib merged commit 85098e9 into dev Sep 18, 2026
21 of 23 checks passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants