fix: bump pinned forgejo-workflows renovate.yml to Node 24 fix #23

Merged

james merged 1 commit from fix/renovate-node-version-pin into main

2026-09-19 14:31:59 +00:00

james commented

2026-09-11 23:06:21 +00:00

Owner

[email protected] requires Node ^24.11.0 (uses RegExp.escape, a Node 24+ builtin). The reusable workflow this repo calls was pinned at 280a4499, which ran the job on Node 22 -- every scheduled run crashed on an unhandled rejection loading Renovate's bazel manager, before it ever scanned a dependency. Because the rejection was unhandled rather than a caught fatal error, npx still exited 0, so every run showed as success in Actions while doing nothing: no Renovate PRs or Dependency Dashboard issue have ever been created since Renovate was added in #12.

Fix merged upstream in colibrisec/forgejo-workflows (Node 22 -> 24). This bumps the pin here to 95bdd86, the merged commit.

[email protected] requires Node ^24.11.0 (uses `RegExp.escape`, a Node 24+ builtin). The reusable workflow this repo calls was pinned at `280a4499`, which ran the job on Node 22 -- every scheduled run crashed on an unhandled rejection loading Renovate's bazel manager, before it ever scanned a dependency. Because the rejection was unhandled rather than a caught fatal error, `npx` still exited 0, so every run showed as `success` in Actions while doing nothing: no Renovate PRs or Dependency Dashboard issue have ever been created since Renovate was added in #12. Fix merged upstream in `colibrisec/forgejo-workflows` (Node 22 -> 24). This bumps the pin here to `95bdd86`, the merged commit.

james added 1 commit

2026-09-11 23:06:21 +00:00

fix: bump pinned forgejo-workflows renovate.yml to Node 24 fix

security-scan / security-scan (pull_request) Successful in 1m17s

Details

test / web (pull_request) Successful in 1m6s

Details

test / coverage-badge (pull_request) Has been skipped

Details

codecov/project 33.35% (No base report)

codecov/patch 100.00% >= target 80%

test / go (pull_request) Successful in 2m26s

Details

1cce320778

[email protected] requires Node ^24.11.0 (uses RegExp.escape, a Node 24+
builtin). The reusable workflow was pinned at 280a4499, which ran the
job on Node 22, causing an unhandled rejection on every scheduled run
that crashed Renovate before it scanned any dependencies. Because the
rejection was unhandled rather than a caught fatal error, npx still
exited 0, so every run showed as 'success' while doing nothing -- no
Renovate PRs or Dependency Dashboard issue were ever created since it
was added in #12.

Bumps the pin to 95bdd86, which merges the Node 22->24 fix in
colibrisec/forgejo-workflows.

forgejo-actions commented

2026-09-11 23:07:31 +00:00

🔎 ojo scan results

Severity	Count
🟠 HIGH	3
🟡 MEDIUM	2
🟢 LOW	1
⚪ UNKNOWN	1

Details (7)

Type	Severity	ID/Rule	Location	Description
sast	🟠 HIGH	go-ssrf	internal/integrations/jira.go:67	http.NewRequestWithContext URL argument is built via Sprintf/concatenation, or is a local variable derived from request/env input, rather than a validated/allowlisted URL
sast	🟠 HIGH	go-ssrf	internal/integrations/jira.go:101	http.NewRequestWithContext URL argument is built via Sprintf/concatenation, or is a local variable derived from request/env input, rather than a validated/allowlisted URL
sast	🟠 HIGH	go-ssrf	internal/integrations/jira.go:141	http.NewRequestWithContext URL argument is built via Sprintf/concatenation, or is a local variable derived from request/env input, rather than a validated/allowlisted URL
vuln	🟡 MEDIUM	CVE-2026-84373	@vitest/[email protected]	Vitest: Path Traversal / Arbitrary File Read via @vitest/mocker Redirect Mock
vuln	🟡 MEDIUM	CVE-2026-84373	[email protected]	Vitest: Path Traversal / Arbitrary File Read via @vitest/mocker Redirect Mock
misconfig	🟢 LOW	dockerfile-no-healthcheck	deploy/docker/Dockerfile:1	image has no HEALTHCHECK
vuln	⚪ UNKNOWN	GO-2026-5932	golang.org/x/[email protected]	The golang.org/x/crypto/openpgp package is unmaintained, unsafe by design, and has known security issues

### 🔎 ojo scan results | Severity | Count | |---|---| | 🟠 HIGH | 3 | | 🟡 MEDIUM | 2 | | 🟢 LOW | 1 | | ⚪ UNKNOWN | 1 | <details><summary>Details (7)</summary> | Type | Severity | ID/Rule | Location | Description | |---|---|---|---|---| | sast | 🟠 HIGH | go-ssrf | <a href="https://git.colibrisec.org/ColibriSec/balam/src/commit/1cce32077855d0e6f712ad5b3aa7ce35c23b10a6/internal/integrations/jira.go#L67" target="_blank" rel="noopener noreferrer">internal/integrations/jira.go:67</a> | http.NewRequestWithContext URL argument is built via Sprintf/concatenation, or is a local variable derived from request/env input, rather than a validated/allowlisted URL | | sast | 🟠 HIGH | go-ssrf | <a href="https://git.colibrisec.org/ColibriSec/balam/src/commit/1cce32077855d0e6f712ad5b3aa7ce35c23b10a6/internal/integrations/jira.go#L101" target="_blank" rel="noopener noreferrer">internal/integrations/jira.go:101</a> | http.NewRequestWithContext URL argument is built via Sprintf/concatenation, or is a local variable derived from request/env input, rather than a validated/allowlisted URL | | sast | 🟠 HIGH | go-ssrf | <a href="https://git.colibrisec.org/ColibriSec/balam/src/commit/1cce32077855d0e6f712ad5b3aa7ce35c23b10a6/internal/integrations/jira.go#L141" target="_blank" rel="noopener noreferrer">internal/integrations/jira.go:141</a> | http.NewRequestWithContext URL argument is built via Sprintf/concatenation, or is a local variable derived from request/env input, rather than a validated/allowlisted URL | | vuln | 🟡 MEDIUM | <a href="https://github.com/vitest-dev/vitest/security/advisories/GHSA-82fw-gwwq-j7x9" target="_blank" rel="noopener noreferrer">CVE-2026-84373</a> | @vitest/[email protected] | Vitest: Path Traversal / Arbitrary File Read via @vitest/mocker Redirect Mock | | vuln | 🟡 MEDIUM | <a href="https://github.com/vitest-dev/vitest/security/advisories/GHSA-82fw-gwwq-j7x9" target="_blank" rel="noopener noreferrer">CVE-2026-84373</a> | [email protected] | Vitest: Path Traversal / Arbitrary File Read via @vitest/mocker Redirect Mock | | misconfig | 🟢 LOW | dockerfile-no-healthcheck | <a href="https://git.colibrisec.org/ColibriSec/balam/src/commit/1cce32077855d0e6f712ad5b3aa7ce35c23b10a6/deploy/docker/Dockerfile#L1" target="_blank" rel="noopener noreferrer">deploy/docker/Dockerfile:1</a> | image has no HEALTHCHECK | | vuln | ⚪ UNKNOWN | <a href="https://go.dev/issue/44226" target="_blank" rel="noopener noreferrer">GO-2026-5932</a> | golang.org/x/[email protected] | The golang.org/x/crypto/openpgp package is unmaintained, unsafe by design, and has known security issues | </details>

forgejo-actions commented

2026-09-11 23:08:39 +00:00

Codecov Results 📊

✅ Patch coverage is 100.00%. Project has 4737 uncovered lines.

Generated by Codecov Action

## Codecov Results 📊 :white_check_mark: Patch coverage is **100.00%**. Project has **4737** uncovered lines. --- *Generated by [Codecov Action](https://github.com/getsentry/codecov-action)*

james merged commit 39c93e5374 into main

2026-09-19 14:31:59 +00:00

james referenced this pull request from a commit

2026-09-19 14:31:59 +00:00

Merge pull request 'fix: bump pinned forgejo-workflows renovate.yml to Node 24 fix' (#23) from fix/renovate-node-version-pin into main

james deleted branch fix/renovate-node-version-pin

2026-09-19 14:32:00 +00:00