Repository navigation
build(deps): bump korthout/backport-action from 4.7.0 to 4.7.1 - #129
dependabot[bot] wants to merge 1 commit into
Conversation
Bumps [korthout/backport-action](https://github.com/korthout/backport-action) from 4.7.0 to 4.7.1. - [Release notes](https://github.com/korthout/backport-action/releases) - [Commits](korthout/backport-action@v4.7.0...v4.7.1) --- updated-dependencies: - dependency-name: korthout/backport-action dependency-version: 4.7.1 dependency-type: direct:production update-type: version-update:semver-patch ... Signed-off-by: dependabot[bot] <support@github.com>
dependabot
Bot
added
dependencies
PR SummaryLow Risk Overview That release fixes backports when Reviewed by Cursor Bugbot for commit 8b8cb65. Bugbot is set up for automated code reviews on this repo. Configure here. |
![github-actions[bot]](https://avatars.githubusercontent.com/in/15368?s=60&v=4){kind=small}
There was a problem hiding this comment.
This Dependabot patch bumps korthout/backport-action from v4.7.0 to v4.7.1. The release only fixes a bug: the action no longer tries to enable auto-merge on draft backport PRs. Nothing in this change needs fixing, and it is safe to merge.
Findings: 0 blocking | 1 non-blocking | 0 posted inline
Blockers
- None at the file/PR level.
Non-blocking
- None at the file/PR level.
- 1 non-blocking pre-existing issue(s) listed below under pre-existing issues.
Pre-existing issues
- [suggestion] .github/workflows/backport.yml pins third-party actions by mutable tag (korthout/backport-action@v4.x, actions/checkout@v7) instead of by commit SHA. This step runs with an app-generated token, so a retagged upstream release could run with elevated permissions. Consider pinning to full commit SHAs, with the version noted in a comment.
Bumps korthout/backport-action from 4.7.0 to 4.7.1.
Release notes
Sourced from korthout/backport-action's releases.
Commits
0ebd44fdist: release 4.7.1a4743ebdist: build new artifactsf3f9f88Merge pull request #797 from korthout/backport-793-to-release-v4029c104Assert auto-merge on the created draft pull request909abe7Document skipped auto-merge under draft_commit_conflicts3a3b0efLog when auto-merge is skipped for a draft pull requestb5e4f7dUse GitHub's draft state to decide on auto-merge35c3295Reject auto-merge on draft pull requests in FakeGithub114b28afix: skip auto merge on draft prs77f37c7Merge pull request #787 from korthout/backport-786-to-release-v4Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting
@dependabot rebase.Dependabot commands and options
You can trigger Dependabot actions by commenting on this PR:
@dependabot rebasewill rebase this PR@dependabot recreatewill recreate this PR, overwriting any edits that have been made to it@dependabot show <dependency name> ignore conditionswill show all of the ignore conditions of the specified dependency@dependabot ignore this major versionwill close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)@dependabot ignore this minor versionwill close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)@dependabot ignore this dependencywill close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)