Skip to content

action-allowlist-review: bump JamesIves/github-pages-deploy-action from 4.8.0 to 4.9.0 in /.github/actions/for-dependabot-triggered-reviews - #1171

Open
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/github_actions/dot-github/actions/for-dependabot-triggered-reviews/JamesIves/github-pages-deploy-action-4.9.0
Open

action-allowlist-review: bump JamesIves/github-pages-deploy-action from 4.8.0 to 4.9.0 in /.github/actions/for-dependabot-triggered-reviews#1171
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/github_actions/dot-github/actions/for-dependabot-triggered-reviews/JamesIves/github-pages-deploy-action-4.9.0

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Aug 11, 2026

Copy link
Copy Markdown
Contributor

Bumps JamesIves/github-pages-deploy-action from 4.8.0 to 4.9.0.

Release notes

Sourced from JamesIves/github-pages-deploy-action's releases.

v4.9.0

What's Changed

Bug Fixes 🐝

Build 🔧

Other Changes

New Contributors

Full Changelog: JamesIves/github-pages-deploy-action@v4...v4.9.0

Commits
  • fa24774 Merge remote-tracking branch 'origin/dev' into releases/v4
  • 1e0489f fix: use a dedicated RELEASE_PAT for release creation
  • 737d5af ci: run sponsors README update twice a week instead of daily
  • 5d78d7b ci: run integration tests weekly instead of daily
  • 36c7ef9 Deploy Production Code for Commit b09969f18cbaf8fd7f336068c0c4d9abfdcbf68a 🚀
  • 74a589d Merge remote-tracking branch 'origin/dev' into releases/v4
  • b09969f style: fix prettier formatting in LFS changes
  • 87729a6 feat: add Git LFS support for deployment branch
  • cc13712 fix: add missing checkout step to integration-rebase-conflicts-cleanup
  • d866689 Merge branch 'dev' of https://github.com/JamesIves/github-pages-deploy-action...
  • Additional commits viewable in compare view

Dependabot compatibility score

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
  • @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
  • @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
  • @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

@dependabot
action-allowlist-review: bump JamesIves/github-pages-deploy-action
bec6cd2 
Bumps [JamesIves/github-pages-deploy-action](https://github.com/jamesives/github-pages-deploy-action) from 4.8.0 to 4.9.0.
- [Release notes](https://github.com/jamesives/github-pages-deploy-action/releases)
- [Commits](JamesIves/github-pages-deploy-action@d92aa23...fa24774)

---
updated-dependencies:
- dependency-name: JamesIves/github-pages-deploy-action
  dependency-version: 4.9.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot Bot added dependencies Pull requests that update a dependency file github_actions Pull requests that update GitHub Actions code labels Aug 11, 2026
@dependabot dependabot Bot added dependencies Pull requests that update a dependency file github_actions Pull requests that update GitHub Actions code labels Aug 11, 2026
This was referenced Aug 12, 2026
Open
Open
@potiuk

potiuk commented Aug 27, 2026

Copy link
Copy Markdown
Member

The verify failure here is a gap in our own tooling, not a problem with the action.

Vendored npm registry check reports 13 extra files - but 0 modified, 0 errors, 116 packages verified against integrity-checked registry tarballs, JS build verification green, and the vendored node_modules comparison matching all 3008 files across 75 packages. Those 13 "extra" files are every file of exactly three packages: @types/esrecurse, @types/estree, @types/json-schema. A whole package coming back unaccounted-for is tarball resolution failing, not tampering - DefinitelyTyped roots its tarballs at the bare package name rather than package/, so no extracted path lined up and every file looked injected.

#1174 detects the tarball root instead of assuming it. Against this exact commit it reports 116 verified, 0 extra, 0 mismatched, 0 errors. Once it lands, re-running verify here should go green.

@dfoulks1 @ppkarwasz - #1174 is waiting on a review; this PR is blocked behind it.

Drafted-by: Claude Code (Opus 5); reviewed by @potiuk before posting

@potiuk potiuk mentioned this pull request Aug 27, 2026
Open
1 task
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@dfoulks1 dfoulks1 Awaiting requested review from dfoulks1 dfoulks1 is a code owner
@potiuk potiuk Awaiting requested review from potiuk potiuk is a code owner
@ppkarwasz ppkarwasz Awaiting requested review from ppkarwasz ppkarwasz is a code owner

At least 1 approving review is required to merge this pull request.

Assignees

No one assigned

Labels

dependencies Pull requests that update a dependency file github_actions Pull requests that update GitHub Actions code

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

1 participant

@potiuk