Bump dependency version for actions/github and actions/tool-cache. #2236
Conversation
There was a problem hiding this comment.
Pull request overview
This PR bumps major versions for two @actions packages due to dependency updates. The @actions/tool-cache package is upgraded from 2.0.2 to 3.0.0, and @actions/github is upgraded from 6.0.1 to 7.0.0.
Key changes:
- Updated four core dependencies for @actions/tool-cache to their v2.x/v3.x versions
- Updated @actions/http-client to v3.0.1 for @actions/github
- Added release notes documenting the dependency updates
Reviewed changes
Copilot reviewed 4 out of 6 changed files in this pull request and generated 1 comment.
Show a summary per file
| File | Description |
|---|---|
| packages/tool-cache/package.json | Bumped version to 3.0.0 and updated dependencies (@actions/core, @actions/exec, @actions/http-client, @actions/io) to major versions |
| packages/tool-cache/package-lock.json | Updated lockfile with new dependency versions and integrity hashes |
| packages/tool-cache/RELEASES.md | Added 3.0.0 release notes documenting dependency updates |
| packages/github/package.json | Bumped version to 7.0.0 and updated @actions/http-client to v3.0.1 |
| packages/github/package-lock.json | Updated lockfile with new @actions/http-client version and integrity hash |
| packages/github/RELEASES.md | Added 7.0.0 release notes documenting @actions/http-client update |
Files not reviewed (2)
- packages/github/package-lock.json: Language not supported
- packages/tool-cache/package-lock.json: Language not supported
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
| "resolved": "https://registry.npmjs.org/@octokit/core/-/core-5.2.2.tgz", | ||
| "integrity": "sha512-/g2d4sW9nUDJOMz3mabVQvOGhVa4e/BN/Um7yca9Bb2XTzPPnfTWHWQg+IsEYO7M3Vx+EXvaM/I2pJWIMun1bg==", | ||
| "license": "MIT", | ||
| "peer": true, |
There was a problem hiding this comment.
The @octokit/core package should not be marked as a peer dependency. It is listed as a regular dependency in package.json (line 13), but the package-lock.json incorrectly includes "peer": true. This field should be removed as @octokit/core is a direct dependency of @actions/github, not a peer dependency. This inconsistency could cause issues during package installation or dependency resolution.
| "peer": true, |
No description provided.