Skip to content

Bump the dependencies group across 1 directory with 25 updates #3227

Bump the dependencies group across 1 directory with 25 updates

Bump the dependencies group across 1 directory with 25 updates #3227

Triggered via pull request May 3, 2026 10:05
Status Failure
Total duration 16m 36s
Artifacts –

pr.yaml

on: pull_request
Detect changed files
7s
Detect changed files
Trunk Check runner [linux]
1m 6s
Trunk Check runner [linux]
Matrix: linter_tests
Matrix: Tool Tests
Repo Tests  /  Plugin Tests
22s
Repo Tests / Plugin Tests
Action Tests
31s
Action Tests
Windows Linter Tests
0s
Windows Linter Tests
Windows Tool Tests
0s
Windows Tool Tests
Aggregate Test Results
3s
Aggregate Test Results
Fit to window
Zoom out
Zoom in

Annotations

12 errors, 11 warnings, and 1 notice
Repo Tests / Plugin Tests
Process completed with exit code 1.
Action Tests
Process completed with exit code 1.
osv-scanner(GHSA-3ppc-4f35-3m26): package-lock.json#L2471
[new] 'minimatch' has a ReDoS via repeated wildcards with non-matching literal in pattern. Current version is vulnerable: 9.0.4.
osv-scanner(GHSA-23c5-xmqv-rm74): package-lock.json#L2471
[new] 'minimatch' ReDoS: nested *() extglobs generate catastrophically backtracking regular expressions. Current version is vulnerable: 9.0.4.
osv-scanner(GHSA-7r86-cg39-jmmj): package-lock.json#L2471
[new] 'minimatch' has ReDoS: matchOne() combinatorial backtracking via multiple non-adjacent GLOBSTAR segments. Current version is vulnerable: 9.0.4.
Trunk Check runner [linux]
Process completed with exit code 1.
Linter Tests macOS
Process completed with exit code 1.
Linter Tests macOS
Calling `depends_on macos: :high_sierra` is disabled! There is no replacement. Please report this issue to the powershell/homebrew-tap tap (not Homebrew/* repositories): /opt/homebrew/Library/Taps/powershell/homebrew-tap/Formula/powershell.rb:33
Tool Tests (macOS)
Process completed with exit code 1.
Linter Tests ubuntu-latest
Process completed with exit code 100.
Tool Tests (ubuntu-latest)
Process completed with exit code 1.
Aggregate Test Results
Process completed with exit code 1.
Detect changed files
Node.js 20 actions are deprecated. The following actions are running on Node.js 20 and may not work as expected: dorny/paths-filter@de90cc6fb38fc0963ad72b210f1f284cd68cea36. Actions will be forced to run with Node.js 24 by default starting June 2nd, 2026. Node.js 20 will be removed from the runner on September 16th, 2026. Please check if updated versions of these actions are available that support Node.js 24. To opt into Node.js 24 now, set the FORCE_JAVASCRIPT_ACTIONS_TO_NODE24=true environment variable on the runner or in your workflow file. Once Node.js 24 becomes the default, you can temporarily opt out by setting ACTIONS_ALLOW_USE_UNSECURE_NODE_VERSION=true. For more information see: https://github.blog/changelog/2025-09-19-deprecation-of-node-20-on-github-actions-runners/
Detect changed files
'base' input parameter is ignored when action is triggered by pull request event
Action Tests
Node.js 20 actions are deprecated. The following actions are running on Node.js 20 and may not work as expected: astral-sh/setup-uv@v5. Actions will be forced to run with Node.js 24 by default starting June 2nd, 2026. Node.js 20 will be removed from the runner on September 16th, 2026. Please check if updated versions of these actions are available that support Node.js 24. To opt into Node.js 24 now, set the FORCE_JAVASCRIPT_ACTIONS_TO_NODE24=true environment variable on the runner or in your workflow file. Once Node.js 24 becomes the default, you can temporarily opt out by setting ACTIONS_ALLOW_USE_UNSECURE_NODE_VERSION=true. For more information see: https://github.blog/changelog/2025-09-19-deprecation-of-node-20-on-github-actions-runners/
osv-scanner(GHSA-f886-m6hf-6m8v): package-lock.json#L5697
[new] brace-expansion: Zero-step sequence causes process hang and memory exhaustion. Current version is vulnerable: 2.0.1.
Trunk Check runner [linux]
Node.js 20 actions are deprecated. The following actions are running on Node.js 20 and may not work as expected: actions/cache@v4. Actions will be forced to run with Node.js 24 by default starting June 2nd, 2026. Node.js 20 will be removed from the runner on September 16th, 2026. Please check if updated versions of these actions are available that support Node.js 24. To opt into Node.js 24 now, set the FORCE_JAVASCRIPT_ACTIONS_TO_NODE24=true environment variable on the runner or in your workflow file. Once Node.js 24 becomes the default, you can temporarily opt out by setting ACTIONS_ALLOW_USE_UNSECURE_NODE_VERSION=true. For more information see: https://github.blog/changelog/2025-09-19-deprecation-of-node-20-on-github-actions-runners/
Trunk Check runner [linux]
Unexpected input(s) 'cache-key', valid inputs are ['']
Linter Tests macOS
gnupg 2.5.19 is already installed and up-to-date. To reinstall 2.5.19, run: brew reinstall gnupg
Linter Tests macOS
php 8.5.5 is already installed and up-to-date. To reinstall 8.5.5, run: brew reinstall php
Linter Tests macOS
cpanminus 1.7049 is already installed and up-to-date. To reinstall 1.7049, run: brew reinstall cpanminus
Tool Tests (macOS)
gnupg 2.5.19 is already installed and up-to-date. To reinstall 2.5.19, run: brew reinstall gnupg
Tool Tests (macOS)
php 8.5.5 is already installed and up-to-date. To reinstall 8.5.5, run: brew reinstall php
osv-scanner(GHSA-v6h2-p8h4-qcjw): package-lock.json#L5697
[new] 'brace-expansion' Regular Expression Denial of Service vulnerability. Current version is vulnerable: 2.0.1.