Conversation
chore: back-merge master into development
✅ Snyk checks have passed. No issues have been found so far.
💻 Catch issues earlier using the plugins for VS Code, JetBrains IDEs, Visual Studio, and Eclipse. |
🔒 Security Scan Results
⏱️ SLA Breach Summary
✅ BUILD PASSED - All security checks passed |
chore: back-merge master into development
🔒 Security Scan Results
⏱️ SLA Breach Summary
✅ BUILD PASSED - All security checks passed |
🔒 Security Scan Results
⏱️ SLA Breach Summary
✅ BUILD PASSED - All security checks passed |
Bumps runtime dependencies axios (^1.18.1 -> ^1.20.0) and qs (^6.15.2 -> ^6.16.0), plus dev dependencies @babel/eslint-parser, @slack/bolt, @types/lodash, jest, nock, ts-jest and webpack. npm audit across the dependency tree before and after: before 17 vulnerabilities (3 critical, 6 high, 7 moderate, 1 low) after 10 vulnerabilities (3 critical, 1 high, 5 moderate, 1 low) Seven resolved, five of them high severity. The qs advisory is the consumer-facing one, since qs is a runtime dependency. The ten that remain are all dev-only (babel-traverse, mocha, nyc, istanbul, serialize-javascript, uuid, diff, mochawesome) and are not shipped. Verified with npm run lint (clean) and npm run test:unit (686 passing). Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
The Coverage report step (lucassabreu/comment-coverage-clover) creates a comment on the pull request, which is a write operation. unit-test.yml declared no permissions block, so the job received the repository default. The job log for run 35718905177 records what the token actually held: GITHUB_TOKEN Permissions Contents: read Metadata: read Packages: read All read, no write, so the POST to the issue-comments endpoint returned 403 "Resource not accessible by integration". Build, tests and the dorny/test-reporter step all succeeded; only the coverage comment failed. This affects every run since 2026-08-02, including on development and master. The last successful run was 2026-07-29. Declaring a permissions block sets unlisted scopes to none, so contents: read is included for actions/checkout. checks: write is deliberately not granted: the test-reporter step is currently succeeding without it. Mirrors back-merge-pr.yml and sca-scan.yml, which already declare the same two scopes. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
chore: update dependencies and changelog for v1.31.2
✅ Snyk checks have passed. No issues have been found so far.
💻 Catch issues earlier using the plugins for VS Code, JetBrains IDEs, Visual Studio, and Eclipse. |
🔒 Security Scan Results
⏱️ SLA Breach Summary
✅ BUILD PASSED - All security checks passed |
|
Coverage report for commit: 0fdb0fb Summary - Lines: 82.77% | Methods: 95.77% | Branches: 65.89%
🤖 comment via lucassabreu/comment-coverage-clover |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
Brings back-merge branch up to date with development so master can be back-merged cleanly (DX-20927). Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
DX-20927 | Back-merge master into development
🔒 Security Scan Results
⏱️ SLA Breach Summary
✅ BUILD PASSED - All security checks passed |
There was a problem hiding this comment.
Copilot review overview
🟡 Changes recommended
The explicit workflow permissions omit checks: write, preventing the test reporter from creating check runs.
Review effort: Balanced
Findings: 1
Open (1)
What changed in this PR
Updates vulnerable dependencies and prepares patch release 1.31.2.
Changes:
- Upgrades runtime and development dependencies.
- Regenerates the dependency lockfile.
- Pins the coverage action and updates release notes.
| File | Description |
|---|---|
package.json |
Bumps package and dependency versions. |
package-lock.json |
Locks the updated dependency graph. |
CHANGELOG.md |
Documents release 1.31.2. |
.github/workflows/unit-test.yml |
Pins coverage action and adjusts permissions. |
💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.
aniket-shikhare-cstk
approved these changes
Sep 29, 2026
dange-cstk
approved these changes
Sep 29, 2026
Aravind-Kumar-cstk
approved these changes
Sep 29, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Security