Skip to content

Pin dependencies#27144

Merged
ErisDS merged 1 commit intomainfrom
renovate/pin-dependencies
Apr 8, 2026
Merged

Pin dependencies#27144
ErisDS merged 1 commit intomainfrom
renovate/pin-dependencies

Conversation

@renovate
Copy link
Copy Markdown
Contributor

@renovate renovate bot commented Apr 5, 2026

This PR contains the following updates:

Package Type Update Change
@tailwindcss/postcss (source) devDependencies pin ^44.2.1
actions/download-artifact action pinDigest d3f86a1
actions/upload-artifact action pinDigest ea165f8
asdf-vm/actions action pinDigest b7bcd02
axllent/mailpit pinDigest 0b5c5f7
caddy final pinDigest fce4f15
codecov/codecov-action action pinDigest 75cd116
docker/build-push-action action pinDigest 10e90e3
docker/dockerfile syntax pinDigest 7eca945
docker/login-action action pinDigest c94ce9f
docker/metadata-action action pinDigest c299e40
docker/setup-buildx-action action pinDigest 8d2750c
gacts/purge-jsdelivr-cache action pinDigest 8d92aea
ghcr.io/astral-sh/uv final pinDigest 4de5495
minio/mc pinDigest a7fe349
minio/minio pinDigest 149fdd7
mysql pinDigest 679e7e9
node final pinDigest 8b1d14e
node final pinDigest 752ea8a
peter-evans/repository-dispatch action pinDigest ff45666
redis pinDigest 352c1fd
slackapi/slack-github-action action pinDigest 91efab1
stripe/stripe-cli pinDigest a7a01c0
szenius/set-timezone action pinDigest 1f9716b
tailwindcss (source) devDependencies pin ^44.2.1
tinybirdco/tinybird-local service pinDigest a652699
tinybirdco/tinybird-local pinDigest a652699
tryghost/actions action pinDigest 0cbdcbe

⚠️ Renovate's pin functionality does not currently wire in the release age for a package, so the Minimum Release Age checks can apply. You will need to manually validate the Minimum Release Age for these package(s).

Add the preset :preserveSemverRanges to your config if you don't want to pin your dependencies.


Configuration

📅 Schedule: Branch creation - At any time (no schedule defined), Automerge - Only on Sunday and Saturday ( * * * * 0,6 ), Between 12:00 AM and 12:59 PM, only on Monday ( * 0-12 * * 1 ), Between 10:00 PM and 11:59 PM, Monday through Friday ( * 22-23 * * 1-5 ), Between 12:00 AM and 04:59 AM, Tuesday through Saturday ( * 0-4 * * 2-6 ) in timezone Etc/UTC.

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about these updates again.


  • If you want to rebase/retry this PR, check this box

This PR was generated by Mend Renovate. View the repository job log.

@github-actions github-actions bot added the dependencies Pull requests that update a dependency file label Apr 5, 2026
@codecov
Copy link
Copy Markdown

codecov bot commented Apr 5, 2026

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 73.07%. Comparing base (f1888ef) to head (4b79c3e).
⚠️ Report is 1 commits behind head on main.

Additional details and impacted files
@@            Coverage Diff             @@
##             main   #27144      +/-   ##
==========================================
- Coverage   73.08%   73.07%   -0.01%     
==========================================
  Files        1544     1544              
  Lines      123391   123391              
  Branches    14858    14858              
==========================================
- Hits        90178    90174       -4     
- Misses      32196    32198       +2     
- Partials     1017     1019       +2     
Flag Coverage Δ
admin-tests 54.37% <ø> (-0.03%) ⬇️
e2e-tests 73.07% <ø> (-0.01%) ⬇️

Flags with carried forward coverage won't be shown. Click here to find out more.

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:
  • ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
  • 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

@renovate renovate bot force-pushed the renovate/pin-dependencies branch 28 times, most recently from 42c46e9 to a77f724 Compare April 7, 2026 10:37
@renovate renovate bot force-pushed the renovate/pin-dependencies branch 12 times, most recently from 15490f2 to 84bba9c Compare April 8, 2026 07:48
ErisDS added a commit that referenced this pull request Apr 8, 2026
ref #27144
SonarCloud is blocking Renovate's pin-dependencies PRs on rule docker:S8431,
which warns when Docker image references include both a tag and a digest.
Renovate intentionally uses tag@digest for Docker pinning so the image stays
human-readable while still being immutable. Suppress that rule for Dockerfiles
so Renovate's pinned image format no longer blocks dependency PRs.
@renovate renovate bot force-pushed the renovate/pin-dependencies branch 13 times, most recently from 1e3b95b to c64063c Compare April 8, 2026 12:48
ErisDS added a commit that referenced this pull request Apr 8, 2026
ref #27144
Renovate was rebasing automerge-eligible branches on every run, which
kept cancelling long-running CI jobs (e.g. Playwright setup) whenever
main moved during the working day. The existing automergeSchedule only
limited when Renovate could finalise a merge, not when it could run or
rebase branches.

Add a matching Renovate schedule that restricts runs to the same
weekend, Monday morning, weekday evening and early morning windows as
automerge, with each block starting one hour earlier so Renovate has
time to rebase branches and refresh PRs before automerge is eligible
to act on them. This keeps rebase churn out of the normal working day
while still letting Renovate finish everything it needs to do before
each automerge window opens.
@renovate renovate bot force-pushed the renovate/pin-dependencies branch from c64063c to 0c65d39 Compare April 8, 2026 13:01
@sonarqubecloud
Copy link
Copy Markdown

sonarqubecloud bot commented Apr 8, 2026

Quality Gate Failed Quality Gate failed

Failed conditions
1 Security Hotspot

See analysis details on SonarQube Cloud

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

dependencies Pull requests that update a dependency file

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant